The controlling policy which grants the jobs binding permission then takes the form of the following four rules:

PV->SvcGroups.go

on job::/ {
  if (service == PV->SvcGroups.service)
  {
     request_category PV->SvcGroups.category
  }

  if (request_category  == PV->Bindings.svcCategory &&
      query->target fqnMatch PV->Bindings.jobNamespace)
  {
     permit bind
  }
}

on service::/ {
  if (query->target_str == PV->SvcGroups.service)
  {
     request_category PV->SvcGroups.category
  }

  if (request_category  == PV->Bindings.svcCategory &&
      job fqnMatch PV->Bindings.jobNamespace)
  {
     permit bind
  }
}