Comments on Policy

[Ken Laskey <klaskey@mitre.org>]

I've got some suggested edits I'll get to another time but I like the way the concepts are built through the section.  My only pain point is that the entire focus is on access policy.  How does this change if in addition we need to accommodate privacy policy or IPR licensing?

Also, is RBAC considered a special case of ABAC where the policies are all role-based and the attribute of interest is the applicable role?

Ken

---

Ken Laskey

MITRE Corporation, M/S H305     phone:  703-983-7934

7515 Colshire Drive                        fax:        703-983-1379

McLean VA 22102-7508