Re: [xacml] Concrete Proposal of ConditionReference (#7)

[seth proctor <Seth.Proctor@Sun.COM>]

Daniel Engovatov wrote:
> While this may be unfortunate, it may be inevitable.  Ever tried to
> insist to a customer that you must have full control on when, how and
> why THEIR data is supposed to be changing?   
> 
> When you try to make a local copy and synchronize all the PDP looking at
> the same policy to it - you can actually make things worse, as you will
> be working on stale data.
> 
> For a distributed system hooked up to a distributed data source that is
> controlled BY SOMEONE ELSE, it is not practical to provide such a
> guarantee - and in many cases it is not needed.
> 
> I believe we shall not make any assumptions about when and how context
> data is provided.   Mathematically inelegant?  Yes.  Should we provide
> an *option* to straiten this out - absolutely.  But not require that.

Well said.


seth