Account Service schema: Password complexity missing params

We had discussed the topic of "password complexity rules" previously, and came to the conclusion that there wasn't a good answer that could cover all the common use cases with any chance of interoperability. We do have min/max password length (with the potential for allowing users to adjust those values). But describing the numerous possible combinations of rules (which seemed to even be beyond the scope of a RegEx) isn't something we were able to solve easily.

For example - in your list you allow for adjusting the quantity of 4 types of characters - but what about the combinations (must have 3 of the 4 types), and what constitutes a "special character"?

Jeff