[Fwd: [xacml-comment] About XACML Administrative policy draft]

The attached questions came in today on the xacml comments list. Here
are my answers to them:

1. Yes, you are correct. Having an indirect delegates condition inside a
target that does not match administrative request does not make sense.
However, there is nothing that disallows you from writing such a policy.
Personally, I don't think it is necessary to add such a restriction.
There are infinite ways to write policies that do not make sense, and I
don't think this case needs any special treatment.

Yes, you are also correct that there is no way to match any delegate.
This is a know problem with the current draft. See issue 33 at

http://wiki.oasis-open.org/xacml/IssuesList

Before we address this issue we are going to wait for the rewrite of the
core schema to allow arbitrary attribute categories.

2. Yes, you are correct, <IndirectDelegatesCondition> can only be used
inside a condition. This is be design since the target is primarily
intended for quick indexing/pruning, and the general opinion was that
there is no need to index on the indirect delegates.

Best regards,
Erik