xacml — archive

RE: [xacml] Re: Section 7.2 Base policy (was A single tree?)

From: Polar Humenn <[email protected]>
To: [email protected]
Date: Tue, 13 Apr 2004 20:44:00 -0000

MHonArc v2.5.0b2 -->

xacml message

Subject: RE: [xacml] Re: Section 7.2 Base policy (was A single tree?)

From: Polar Humenn <[email protected]>
To: Tim Moses <[email protected]>
Date: Tue, 13 Apr 2004 16:56:25 -0400 (EDT)

I find, in the many specs that I've had experience with, if you don't have
something definitive to say, say nothing about it. When you give an answer
that seems to make mandates on points you don't control, because you don't
control them, you cause confusion.

The question "what if I find...." is not really relavent, because the spec
is about:

Here is *the* Policy.
Here is *the* RequestContext.
and, *this* is the defintiive answer.

It's not about *finding* policies, it's not about creating them on the
fly to represent some fictious requirement.

If we were writing some query language for retreiving policies, then we
would have a purpose and directive in that area.

That question is like having an standard for driving a car. One day, you
find your Honda and your Mercedes both your driveway. Do you look in the
Driving Standard to find out what to do?

Of course, it might say "You take the Mercedes."

unless, of course, you're married, and they didn't print the "over my dead
body" scenario in the standard.

Cheers,
-Polar

On Tue, 13 Apr 2004, Tim Moses wrote:

> Personally, I expect readers to ask (and that the authors should anticipate
> the question) "What if I find more than one policy that is applicable to the
> request?"  I don't object if we say "That's out of scope" or "Look in the
> LDAP - or some other - profile".  But, I don't think we should stay silent
> on the topic.  All the best.  Tim.
>
>