For token issuance, the RSTR will wrap the token issued.
For token cancellation, the RSTR will contain a RequestedTokenCanceled element.

A response that indicates a security token is being issued.
A response that indicates a security token is being canceled.

<wst:RequestSecurityTokenResponse Context="..." xmlns:wst="...">
     <wst:TokenType>...</wst:TokenType>
     <wst:RequestedSecurityToken>
          // The issued security token appears here
     </wst:RequestedSecurityToken>
     ...
</wst:RequestSecurityTokenResponse>

All related namespaces such as SOAP Envelope, WS-Trust, WS-Secure Conversation, WS-Addressing, WS-Policy, WS-Security, etc.
Entropy in the RST request, if applicable
Key size in the RST request, if applicable.

Do one of the following:
To add the assertion to the Policy Development window, see Add an Assertion.
To change the configuration of an existing assertion, proceed to step 2 below.
Right-click
Build RSTR SOAP Response
in the policy window and choose
RSTR SOAP Response Builder Properties
or double-click the assertion in the policy window. The assertion properties are displayed.
Specify the
Response Message Type
to create:
A response message that includes an issued a security token
: Choose this option to create a response with the <wst:RequestSecurityTokenResponse> element, which contains the security token that was issued (either a SAML Token or a Security Context Token).
Enter the context variable that contains the issued token.
For Security Context Tokens, this will be the ${<prefix>.issuedSCT} variable. For SAML Tokens, this should be the ${issuedSamlAssertion} variable.
Optionally choose any of the following RSTR Configuration options to include:
Include an <AppliesTo> element with WS-Addressing Address
: This optional element is used to specify the specify the address attribute of the endpoint reference.. For example, the service(s) to which this token applies.
Include a <RequestedAttachedReference> element
: Since returned tokens are considered opaque to the requestor, this optional element is used to indicate how to reference the returned token when that token does not support references using URI fragments (XML ID).
Include a <RequestedUnattachedReference> element
: In certain cases, tokens do not need to be present in the message. This optional element is used to indicate how to reference the token when it is not placed inside the message.
Include a <KeySize> element
: The size of the session key for a secure conversation token will be included in the generated message.
Set Lifetime for the returned security token
: This lifetime defines the expiry duration of the returned security token. It is not the same as the lifetime defined in the Create Security Context Token Assertion. The default expiry duration is 60 minutes for the returned security token. 
It is recommended that the issuer return this element with issued tokens (in the RSTR) so the requestor knows the actual validity period without needing to parse the returned token.
For more information about the RSTR Configuration elements, please refer to the specifications on WS-Trust and WS-Secure Conversation on www.oasis-open.org.
 
A response message that includes the results of a token cancellation
: Choose this option to create a response with <wst:RequestedTokenCanceled/> in the <wst:RequestSecurityTokenResponse> element.
Enter a prefix to be added to the context variables created by this assertion. The prefix allows you to uniquely identify the variables if the assertion appears more than once within a policy.The default variable prefix is
responseBuilder
.
Click [
OK
].