xacml — archive

[System]

Attempt to elaborate: if we are to have a build-in standard time attribute it should be on PDP, otherwise it is hard to use it in a policy (if having a policy based on the time of decision is what you want). If you do not want to have a policy based on the time of decision, then we should probably let the implementation to decide when, where and how the relevant time is computed and placed into the context. If we see too many problems with "build-in" clock, I would agree to drop it altogether, although I think that some reference decision time clock is a useful feature (not only for decision, but also for such sanity checks, like not granting access three years in the future, or in the last century..).. Daniel;