[xacml] New issue#1 from "Boolean Policy resolution"

[Anne Anderson <Anne.Anderson@Sun.com>]

PM-1-?: how NOT-APPLICABLE impacts a combinator expression

A "combinator expression" is a combination of predicates, where
possible combinators are <AND>, <OR>, <NOT>, <N-OF>,
<ORDERED-[AND|OR|N-OF]>.  This list of Combinators can be
extended.

Example:

<AND>
   predicate1,
   predicate2,
   predicate3
</AND>

The issue occurs when one or more of the predicates in the list
returns a result of NOT-APPLICABLE (this can occur if the
predicate is a <referencedPolicy>).  What should the result of
the combinator expression be?  What if ALL predicates in the
bominator expression return NOT-APPLICABLE?

Potential Resolution:

a) Any predicate evaluating to NOT-APPLICABLE is logically
   removed from the combinator expression.

    Example: if predicate3 in the example above returned a result of
    NOT-APPLICABLE, then the combinator expression is the result of

    <AND>
       predicate1,
       predicate2
    <AND>

b) An empty combinator expression has the following results:

  <AND></AND>   -> TRUE
  <OR></OR>     -> FALSE
  <NOT></NOT>   -> TRUE
  <N-OF></N-OF> -> FALSE

  <ORDERED-[whatever]> has same result as [whatever] above.
  Extended combinators must define the result of an empty
  expression.

   Example: If predicates 1, 2, and 3 in the example above all
   evaluate to NOT-APPLICABLE, then the combinator expression is
   <AND></AND>, and the result is TRUE.

b)-alternative: An empty combinator expression has a result of
   NOT-APPLICABLE.

Champion: Anne
-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692