I have a simple request to use a Null driver to add users to a group
"Vocera_Messaging" if an attribute "UOHIvoceraMessaging" gets a value of
"True".

I've spent enough time on this, really hope you can tell me I've done wrong.

Here's the subscriber rules:
<rule>
<description>Filter Delete Operations</description>
<conditions>
<and>
<if-class-name mode="nocase" op="equal">User</if-class-name>
<if-operation mode="case" op="equal">delete</if-operation>
</and>
</conditions>
<actions>
<do-veto/>
</actions>
</rule>
<rule>
<description>Membership Add</description>
<conditions>
<and>
<if-class-name mode="nocase" op="equal">User</if-class-name>
<if-attr mode="nocase" name="UOHIvoceraMessaging"
op="equal">True</if-attr>
</and>
</conditions>
<actions>
<do-set-dest-attr-value name="Group Membership">
<arg-value type="dn">
<token-text xml:space="preserve">Users\Vocera_Messaging</token-text>
</arg-value>
</do-set-dest-attr-value>
<do-clone-op-attr dest-name="Security Equals" src-name="Group
Membership"/>
</actions>
</rule>
<rule>
<description>Veto further processing</description>
<conditions>
<and/>
</conditions>
<actions>
<do-veto/>
</actions>
</rule>
</policy>

Here's the trace:
09:38:44 7D721BA0 Drvrs: Generic Null ST:Start transaction.
09:38:44 7D721BA0 Drvrs: Generic Null ST:Processing events for transaction.
09:38:44 7D721BA0 Drvrs: Generic Null ST:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.0.1.0">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify cached-time="20130326133844.561Z" class-name="User"
event-id="ohiidv-idm1#20130326133844#2#1:5d7fc199-ac16-49ba-20a8-99c17f5d16ac"
qualified-src-dn="O=IDVault\OU=Users\CN=KPrice"
src-dn="\OHICOIDV\IDVault\Users\KPrice" src-entry-id="33009"
timestamp="1364305124#2">
<modify-attr attr-name="UOHIvoceraMessaging">
<remove-value>
<value timestamp="1363366822#49" type="string">False</value>
</remove-value>
<add-value>
<value timestamp="1364305124#2" type="string">True</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>
09:38:44 7D721BA0 Drvrs: Generic Null ST:Applying event transformation
policies.
09:38:44 7D721BA0 Drvrs: Generic Null ST:Applying policy:
Vocera_Messaging_Membership.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Applying to modify #1.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Evaluating selection criteria for
rule 'Filter Delete Operations'.
09:38:44 7D721BA0 Drvrs: Generic Null ST: (if-class-name equal "User") =
TRUE.
09:38:44 7D721BA0 Drvrs: Generic Null ST: (if-operation equal "delete") =
FALSE.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Rule rejected.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Evaluating selection criteria for
rule 'Membership Add'.
09:38:44 7D721BA0 Drvrs: Generic Null ST: (if-class-name equal "User") =
TRUE.
09:38:44 7D721BA0 Drvrs: Generic Null ST: (if-attr 'UOHIvoceraMessaging'
equal "True") = TRUE.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Rule selected.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Applying rule 'Membership Add'.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Action:
do-set-dest-attr-value("Group Membership","IDVault\Users\Vocera_Messaging").
09:38:44 7D721BA0 Drvrs: Generic Null ST:
arg-string("IDVault\Users\Vocera_Messaging")
09:38:44 7D721BA0 Drvrs: Generic Null ST:
token-text("IDVault\Users\Vocera_Messaging")
09:38:44 7D721BA0 Drvrs: Generic Null ST: Arg Value:
"IDVault\Users\Vocera_Messaging".
09:38:44 7D721BA0 Drvrs: Generic Null ST: Action: do-clone-op-attr("Group
Membership","Security Equals").
09:38:44 7D721BA0 Drvrs: Generic Null ST: Evaluating selection criteria for
rule 'Veto further processing'.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Rule selected.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Applying rule 'Veto further
processing'.
09:38:44 7D721BA0 Drvrs: Generic Null ST: Action: do-veto().
09:38:44 7D721BA0 Drvrs: Generic Null ST:Policy returned:
09:38:44 7D721BA0 Drvrs: Generic Null ST: