Converting from an xml vdb to a ddl will not correctly convey the isConstraint flag for permissions as it default to false for ddl vdbs even if it is null in the xml form.

One solution is a breaking change to the syntax:

<CONDITION> [[<NOT>] <CONSTRAINT>]

that will capture null, false, and true values. Such that omitting the clause would mean that the condition is a constraint - which is the opposite of the ddl behavior currently. A switch could be introduced that would allow for the old default, should it be needed.