RE: Resource sets and resource string semantics

[Hal Lockhart <hal.lockhart@entegrity.com>]

I think before we discuss HOW to do this sort of thing we should discuss
whether it desirable.

> The way I would see the conversation going is:
> 
> PEP: Can Alice access http://www.hp.com/finance/fred.xls 
> PDP: Yes, and Alice can access http://www.hp.com/*
> 
> PEP: Can Alice access http://www.hp.com/finance/mary.xls
> PEP-Cache: Yes

I feel very uncomfortable about the PDP volunteering information it has not
been asked for. It seems to add various kinds of risks without clear
benefit.

> I don't like the idea of unconstrained wildcard matching etc. 
> However simple
> hierarchical partitioning is probably enough for what we 
> need. After all the
> admin will probably organize directories so that the wildcards match
> cleanly.

Our experience has been that this is not the case. Names are chosen for
reasons other that access patterns. A naming scheme which works for one
category of user does not fit another. 

This would seem to me to optimize a rather rare situation, while adding
various risks.

Hal