Section 2 says that "an ODRL Policy must contain at least one Permission" but the UML model shows 0..*

why must an ODRL policy contain at least one permission?

Model (narrative) needs to be updated to show at least one Perm or Prohib needs to be in a Policy?

My recollection of dicussing the overall use case of ODRL is: its key feature is to grant any kind of action which can be applied to an asset and this is expressed by a Permission. A more generic permission can be constrained by a specific prohibition. Therefore at least 1 permission should be in a policy and zero to many prohibitions.

I do recall such discussions. But thinking about some policy types (eg Set) where we allow anything then perhaps the model entities should be optional, and we define constraints more tightly at the Policy Type level (and of course, they can be applied even more tightly at the Profile level).