Re: [ebxml-bp] BPSS executability and where it ends

["David RR Webber" <david@drrw.info>]

Monica,

Good laundry list.  Here's one further comment on
the visibility item below.  To be secure we need to
have two modes:

1) Secure - step in BPSS is provided externally as an
    include link to a service that will perform
    this part of the BPSS - optional inputs and outputs.
    Some declarations may have to be in main header of
    master BPSS to accommodate this (declaration of
    business transaction type).

2) Insecure - step in BPSS is provided via inline include
    of XML into the main BPSS.  Can include "import" 
    of control information - such as transaction types and
    so on.

3) CPA still needs to expose the requirements between
    parties - so that level of detail will always be known - 
    role - inputs/outputs.

There's also an interesting possibility here to outsource
this capability to the OASIS BCM TC Linking and 
Switching SC work - that specifies a service for managing
these.  That way you could hide everything if you are truely
paranoid - by providing a partner with a profile - and placing
that in the ChoicePoint - and just giving them a userid / passwd
and threadid to point to that (see more details in Appendix B of
BCM specifications at OASIS BCM TC site).

The BPSS would then reference the ChoicePoint inline within
the BPSS XML - to action and manage the actual linking and 
switching in the business process.

DW.

----- Original Message ----- 
From: "Monica J. Martin" <Monica.Martin@Sun.COM>
Subject: Re: [ebxml-bp] BPSS executability and where it ends


>           o On your comment, "BPSS appears to provide a description of a
>             business process but contains 'too much' information, that
>             may be considered sensitive, or perhaps irrelevant given the
>             individual nature of 'internal' business processes of each
>             trading party,' can you give more specifics here - this I
>             believe will expose what happens in BPSS and what is
>             delegated to a lower level process.
>