Re: [ebxml-cppa] RE: [ebxml-msg] CPA & MS overriding parameters

[James Bryce Clark <jamie.clark@mmiec.com>]

Just got Suresh's laterst message after I sent mine.  

At 11:32 AM 11/14/01, Damodaran, Suresh 
wrote:
> <sd>
> The parameters that can be overridden are in CPA also because
> in some cases parties may decide that these MUST not be overridden,
> and state so in the policy (we may not have such a mechanism in 
> CPA,
> but the CPA TC may consider having it)
> <sd/>

We do have a mechanism in the CPA/CPP spec for non-overridable
parameters.  It's called the CPA.   I don't mean to be
flip.   The entry assumption of using a CPA is that two trading
partners plan to conduct a logically associated set of transactions --
that may progress from the first to last without intervention. 
    *  If we are only talking about a collaboration
composed of a single transaction, this issue is irrelevant.  There
is no need to vary on a per-message bassi from the CPA parameters because
they only apply to one pair of messages.
   *  If we are talking about a multi-step collaboration,
could someone give me an example of a CPA-invoked parameter that I might
as a trading partner be willing to "waive" by acceeding to an
override?   Here's what I am imagining:

    (1)   I am offering to sell widgets. 
You find my offer ni a registry along with a CPP.  My CPP asks you
always to XML-DSIG sign and hash through any substantive acceptance or
rejection -- as I will be bound to ship you $1000000 of widgets, and want
to be sure about your being bound to pay in a manner that gives me some
pretty good evidence that the "acceptance" came authentically
from you.  

    (2)   You and I enter into a CPA that
includes that level of repudiation protection as a parameter.

    (3)    I send you my binding e-offfer
to sell, upon the acceptance of which I am bound to deliver to you. 
It is containedin a message with no overrides.

    (4)    You return a message to be with
a logically valid and BP-conformant  acceptance -- but no DSIG and a
message header that essentially says "no DSIG
needed".    

Well, as a lawyer I'm just full of questions at this point, e.g., (a) Am
I bound by your acceptance? (b0 Why would I ever, if sober, agree to the
optionality of the DIOSG erquuirement in the CPA iteelf?