The rules on a driver should generally be placed only on the Publisher object, not on the Subscriber object. The Matching policy cannot operate correctly on the Subscriber channel because an association has not yet been set on the remote side object to match. It is sometimes desirable to place an Event Transform or Create Policy on the Subscriber channel in order to prevent sending unnecessary data across the channel. See "Managing Users on Different Servers Using Scope Filtering" in the Novell Nsure Identity Manager 2 Administration Guide.