Re: [xacml] Discussion summary and revised post-condition proposa l

[bill parducci <bill@parducci.net>]

Carlisle Adams wrote:

 > Hi,
 >
 > I've filled in the column for Policy C below.

[...]

 >       Policy A      Policy B     Policy C
 >       ------------------------------------
 >       Permit        Permit                Permit:  P, R, and D
 >       Permit        Deny                  Deny:  S, E
 >       Permit        Indeterminate    Indeterminate:  no obligations
 >       Deny          Permit                Deny:  Q, E
 >       Deny          Deny                  Deny:  Q, S, E
 >       Deny          Indeterminate    Deny:  Q, E
 >       Indeterminate Permit                Indeterminate:  no obligations
 >       Indeterminate Deny                  Deny:  S, E
 >       Indeterminate Indeterminate    Indeterminate:  no obligations

curious as to how you arrived at these:

 >       Policy A      Policy B     Policy C
 >       ------------------------------------
 >       Permit        Indeterminate    Indeterminate:  no obligations
 >       Indeterminate Permit           Indeterminate:  no obligations
 >       Indeterminate Indeterminate    Indeterminate:  no obligations

given that policy C has this:

>         <All-must-permit>
>               Policy-A
>               Policy-B
>         </all-must-permit>

my read is that these would be resolved thus:

        Policy A      Policy B     Policy C
        ------------------------------------
        Permit        Indeterminate    Deny: E
        Indeterminate Permit           Deny: E
        Indeterminate Indeterminate    Deny: E

b

p.s. great example, polar!