[xacml] 7.7 Obligations

[Anne Anderson <Anne.Anderson@Sun.com>]

Text for new section to be part of "Functional Requirements".

7.7 Obligations

A policy or policy set may contain one or more obligations.
When such a policy or policy set is evaluated, an obligation
is passed up to the next level of evaluation (the enclosing or
referencing policy set or authorization decision) only if the
effect of the policy or policy set being evaluated matches the
value of the "xacml:FulfillOn" attribute of the obligation.

As a consequence of this procedure, no obligations are returned
to the PEP if the policies or policy sets from which they are
drawn are not evaluated, or if their evaluated result is
"Indeterminate" or "NotApplicable", or if the decision resulting
from evaluating the policy or policy set does not match the
decision resulting from evaluating an enclosing policy set.

If the PDP's evaluation is viewed as a tree of policysets and
policies, each of which returns "Permit" or "Deny", then the set
of <obligations> returned by the PDP to the PEP will include only
the obligations associated paths where the effect at each level
of evaluation is the same as the effect being returned by the
PDP.

The PDP just collects obligations; it is not responsible for
enforcing them.  The PEP is responsible for enforcing
obligations.  If the PEP does not understand an obligation, it
should deny access.

-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692