xacml — archive

[System]

It seems to me that obligation is really a specific decision, thus should be part of the rule/policy recombination algorithm. The fact that its analysis may/must happen on the PEP side is just a nuisance. When obligations are used we have five different evaluation outcomes PERMIT, DENY, INDETERMINATE, NONAPPLICABLE and PERMIT WITH OBLIGATION. We should not mandate what to do with it - just like we do not mandate how to implement all recombination algorithms, but just state that this outcome must be recognized by a system that implements obligations. Daniel;;