diff --git a/lib/package/plugins/PO034-am-hygiene.js b/lib/package/plugins/PO034-am-hygiene.js
index 4e683e6..f5a9876 100644
--- a/lib/package/plugins/PO034-am-hygiene.js
+++ b/lib/package/plugins/PO034-am-hygiene.js
@@ -19,7 +19,8 @@ const ruleId = require("../myUtil.js").getRuleId(),
   xpath = require("xpath"),
   util = require("util");
 
-const TEXT_NODE = 3; // this value is not exported by xmldom module!
+const TEXT_NODE = 3, // these values are not exported by xmldom module!
+  CDATA_SECTION_NODE = 4;
 
 const plugin = {
   ruleId,
@@ -86,6 +87,7 @@ const allowedChildren = {
   IgnoreUnresolvedVariables: [],
   Properties: [],
   DisplayName: [],
+  Description: [],
   IgnoreUnresolvedProperties: [],
   "FormParams/FormParam": [],
   "Headers/Header": [],
@@ -318,7 +320,11 @@ const onPolicy = function (policy, cb) {
                             innerChild.columnNumber
                           );
                         } else {
-                          if (innerChild.firstChild.nodeType != TEXT_NODE) {
+                          if (
+                            ![TEXT_NODE, CDATA_SECTION_NODE].includes(
+                              child.firstChild.nodeType
+                            )
+                          ) {
                             foundIssue = true;
                             _addIssue(
                               policy,
@@ -343,8 +349,31 @@ const onPolicy = function (policy, cb) {
                   });
                 }
               } else {
-                // this is a node like Set/{Verb, Version, Path, Payload}
-                // check that it has exactly one text value
+                // child is a node like {Verb, Version, Path, Payload}
+                // Check that it has exactly one text value.
+                // Unless it's a Payload which can take XML!
+
+                if (child.hasAttributes()) {
+                  for (let i = 0; i < child.attributes.length; i++) {
+                    const attr = child.attributes[i];
+                    if (
+                      child.tagName != "Payload" ||
+                      ![
+                        "contentType",
+                        "variablePrefix",
+                        "variableSuffix"
+                      ].includes(attr.name)
+                    ) {
+                      foundIssue = true;
+                      _addIssue(
+                        policy,
+                        `incorrect attribute (${attr.name}) on element <${child.tagName}>.`,
+                        child.lineNumber,
+                        child.columnNumber
+                      );
+                    }
+                  }
+                }
 
                 if (!child.hasChildNodes()) {
                   foundIssue = true;
@@ -355,21 +384,31 @@ const onPolicy = function (policy, cb) {
                     child.columnNumber
                   );
                 } else if (child.childNodes.length > 1) {
-                  foundIssue = true;
-                  _addIssue(
-                    policy,
-                    `extraneous data in element <${child.tagName}>.`,
-                    child.lineNumber,
-                    child.columnNumber
-                  );
-                } else if (child.firstChild.nodeType != TEXT_NODE) {
-                  foundIssue = true;
-                  _addIssue(
-                    policy,
-                    `confounded structure of element <${child.tagName}>.`,
-                    child.lineNumber,
-                    child.columnNumber
-                  );
+                  if (child.tagName != "Payload") {
+                    // payload can have XML
+                    foundIssue = true;
+                    _addIssue(
+                      policy,
+                      `extraneous data in element <${child.tagName}>.`,
+                      child.lineNumber,
+                      child.columnNumber
+                    );
+                  }
+                } else if (
+                  ![TEXT_NODE, CDATA_SECTION_NODE].includes(
+                    child.firstChild.nodeType
+                  )
+                ) {
+                  if (child.tagName != "Payload") {
+                    // Set/Payload can have CDATA
+                    foundIssue = true;
+                    _addIssue(
+                      policy,
+                      `confounded structure of element <${child.tagName}>.`,
+                      child.lineNumber,
+                      child.columnNumber
+                    );
+                  }
                 } else if (!child.firstChild.nodeValue) {
                   foundIssue = true;
                   _addIssue(
@@ -464,7 +503,7 @@ const onPolicy = function (policy, cb) {
                         foundIssue = true;
                         _addIssue(
                           policy,
-                          `there should be no text or child elements under element <${innerChild.tagName}>.`,
+                          `there should be no text or child elements under element <${child.tagName}>/<${innerChild.tagName}>.`,
                           innerChild.lineNumber,
                           innerChild.columnNumber
                         );
@@ -478,7 +517,7 @@ const onPolicy = function (policy, cb) {
                   foundIssue = true;
                   _addIssue(
                     policy,
-                    `there should be no text or child elements under element <${child.tagName}>.`,
+                    `there should be no text or child elements under element <${tag}>/<${child.tagName}>.`,
                     child.lineNumber,
                     child.columnNumber
                   );
diff --git a/test/fixtures/resources/PO034/pass/AM-Payload-with-CDATA.xml b/test/fixtures/resources/PO034/pass/AM-Payload-with-CDATA.xml
new file mode 100644
index 0000000..cf97312
--- /dev/null
+++ b/test/fixtures/resources/PO034/pass/AM-Payload-with-CDATA.xml
@@ -0,0 +1,29 @@
+<AssignMessage name='AM-Payload-with-CDATA'>
+  <Description>This policy sets a payload</Description>
+  <Set>
+
+      <Payload contentType='application/json' variablePrefix='%'
+               variableSuffix='#'><![CDATA[{
+  "access_token" : "%oauthv2accesstoken.OAuthV2-GenerateAccessToken-AuthzCode.access_token#",
+  "refresh_token" : "%oauthv2accesstoken.OAuthV2-GenerateAccessToken-AuthzCode.refresh_token#",
+  "scope" : "%oauthv2accesstoken.GetOAuthV2Info-AccessToken.scope#",
+  "issued_at" : "%system.timestamp#",
+  "expires_in" : "%oauthv2accesstoken.OAuthV2-GenerateAccessToken-AuthzCode.expires_in#",
+  "application_name" : "%targetapp.displayName#",
+  "status" : "%oauthv2accesstoken.GetOAuthV2Info-AccessToken.status#",
+  "organization_name" : "%organization.name#"
+}
+]]></Payload>
+      <StatusCode>200</StatusCode>
+      <ReasonPhrase>OK</ReasonPhrase>
+  </Set>
+
+  <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+
+  <!-- Set this flow variable to indicate the response is to be returned -->
+  <AssignVariable>
+    <Name>flowResponse.ready</Name>
+    <Value>true</Value>
+  </AssignVariable>
+
+</AssignMessage>
diff --git a/test/fixtures/resources/PO034/pass/AssignMessage-GoogleAuth302-Response.xml b/test/fixtures/resources/PO034/pass/AssignMessage-GoogleAuth302-Response.xml
new file mode 100644
index 0000000..2b00af4
--- /dev/null
+++ b/test/fixtures/resources/PO034/pass/AssignMessage-GoogleAuth302-Response.xml
@@ -0,0 +1,28 @@
+<AssignMessage name='AssignMessage-GoogleAuth302-Response'>
+  <DisplayName>AssignMessage-GoogleAuth302</DisplayName>
+  <!-- <AssignTo createNew='false' transport='http' type='request'></AssignTo> -->
+  <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+  <Set>
+    <!--
+         This is a 302-redirect to an Authentication request to Google.
+         See the documentation at
+         https://developers.google.com/identity/protocols/OpenIDConnect
+
+         For demonstration purposes, you can add queryparam prompt=consent to get
+         consent each time. Also, you can change the scope param to have
+         Google ask for greater consent.
+
+         To use your own app, modify the settings.js file in the
+         apiproxy/resources/jsc directory
+         with values for YOUR APP that you obtained from the Google
+         Developers Console.
+
+    -->
+    <Headers>
+    <Header
+        name='Location'><![CDATA[https://accounts.google.com/o/oauth2/v2/auth?client_id={goog_client_id}&response_type=code&scope=openid%20email&redirect_uri={goog_redirect_uri}&state={state_token}]]></Header>
+    </Headers>
+    <StatusCode>302</StatusCode>
+    <ReasonPhrase>Found</ReasonPhrase>
+  </Set>
+</AssignMessage>
diff --git a/test/fixtures/resources/PO034/pass/Set-Payload-to-XML.xml b/test/fixtures/resources/PO034/pass/Set-Payload-to-XML.xml
new file mode 100644
index 0000000..a88ce40
--- /dev/null
+++ b/test/fixtures/resources/PO034/pass/Set-Payload-to-XML.xml
@@ -0,0 +1,17 @@
+<AssignMessage name='AM-Request-2'>
+  <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+  <Set>
+    <Payload contentType='application/xml'>
+      <NotResults>
+        <Result>
+          <name>something</name>
+          <code>9283987494</code>
+        </Result>
+        <Result>
+          <name>something-else</name>
+          <code>12345</code>
+        </Result>
+      </NotResults>
+    </Payload>
+  </Set>
+</AssignMessage>
diff --git a/test/specs/PO034-am-hygiene-test.js b/test/specs/PO034-am-hygiene-test.js
index 08c44ba..8c26b38 100644
--- a/test/specs/PO034-am-hygiene-test.js
+++ b/test/specs/PO034-am-hygiene-test.js
@@ -46,8 +46,9 @@ describe(`${testID} - policy passes hygiene evaluation`, function () {
       assert.notEqual(policyType, undefined, `${policyType} should be defined`);
       plugin.onPolicy(policy, (e, foundIssues) => {
         assert.equal(e, undefined, "should be undefined");
-        assert.equal(foundIssues, false, "should be no issues");
         const messages = policy.getReport().messages;
+        debug(util.format(messages));
+        assert.equal(foundIssues, false, "should be no issues");
         assert.ok(messages, "messages should exist");
         assert.equal(messages.length, 0, "unexpected number of messages");
       });