RE: [xacml] 7.7 Obligations

[Daniel Engovatov <dengovatov@crosslogix.com>]

>The PDP just collects obligations; it is not responsible for
>enforcing them.  The PEP is responsible for enforcing
>obligations.  If the PEP does not understand an obligation, it
>should deny access.

DENY?  What if it is using some extra fancy rule and policy recombination
algorithm that never returns denies - only PERMIT and NONAPPLICABLE.

Maybe it should be worded such that it is up PEP MUST recognize this, but
what to do is up to an implemention? 

Daniel