RE: [xacml] Re: policy model, part 1

[Tim Moses <tim.moses@entrust.com>]

Title: RE: [xacml] Re: policy model, part 1

Anne - I wonder if we are talking at cross-purposes.  Meta-policy is quite different from base policy.  Meta-policy is the set of rules for combining rules.  The XACML specification defines the meta-policy.  Base policy, on the other hand, is a policy that includes references to other policies, and writers of XACML instances can define their own base policy.  All the best.  Tim.

-----------------------------------------
Tim Moses
Tel: 613.270.3183

-----Original Message-----
From: Anne Anderson [mailto:Anne.Anderson@Sun.com]
Sent: Thursday, February 14, 2002 12:41 PM
To: Tim Moses
Cc: XACML TC
Subject: RE: [xacml] Re: policy model, part 1

On 14 February, Tim Moses writes: RE: [xacml] Re: policy model, part 1
 > Anne - Is your concern at all alleviated by the fact that there is a
 > specified meta-policy, identified within the ruleStatement, that has to be
 > identical to the meta-policy identified in all the other rules with which
 > the rule can be combined?  This should ensure that a rule-writer can deduce
 > what the effect of his or her rule will be.  All the best.  Tim.

The following concern is alleviated:
 > Accommodating extensible semantics at the rule or referenced
 > policy level, where those semantics affect the base policy
 > evaluation, is incompatible with efficient hierarchical,
 > distributed policy evaluation.

I had several other concerns that are independent.  I have not
had a chance to read your new 0.9 spec (THANKS!!!!) to see if my
other concerns are addressed.

Anne
--
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692