RE: [wss] editorial comments on WSS 1.0 core

["DeMartini, Thomas" <Thomas.DeMartini@CONTENTGUARD.COM>]

] (10) Appendix B: SecurityTokenReference Model
] P53 L1813-L1814
] [original]
] | However, other mechanisms such as "principal
] | name" are not required to be unique and therefore such references
may be
] unique.
] 
] I think the last part of this sentence should be "may not be unique".
] 
] [change to]
] | However, other mechanisms such as "principal
] | name" are not required to be unique and therefore such references
may
] not be unique.

"may not" should be avoided when writing standards, because it is
ambiguous whether it means 1) "you are not permitted to do X" (the
actual English meaning) or 2) "you are permitted to not do X" (the
meaning people often are trying to get at).

If we intend to say meaning #1, then we should say "MUST NOT".
If we intend to say meaning #2, then we should say "NEED NOT".

As it turns out, "NEED NOT" and "MAY" are synonyms, so any of the
following are normatively equivalent:

* However, other mechanisms such as "principal name" are not required to
be unique and therefore such references MAY be unique.
* However, other mechanisms such as "principal name" are not required to
be unique and therefore such references NEED NOT be unique.
* However, other mechanisms such as "principal name" are not necessarily
unique and therefore such references MAY be unique.
* However, other mechanisms such as "principal name" are not necessarily
unique and therefore such references NEED NOT be unique.

Since they are all normatively equivalent, we can pick whichever one
sounds best.  I prefer the latter one.

Now, if it is the case that our intent was not to make a normative
statement, but only an informative one, then we should use the
formulation "might not":

* However, other mechanisms such as "principal name" are not necessarily
unique and therefore such references might not be unique.

&Thomas.