access-permitted questions

["GRIFFIN, GLENN (GLENN)" <glenngriffin@research.att.com>]

Folks,

 

We are trying to understand the access-permitted function and have a few questions.

 

Does anyone have concrete examples (Policy, Request, Response files) using this function?

 

Has anyone implemented this function?

 

The paragraph on detecting loops is confusing with respect to the MaxDelegationDepth attribute on the Policy.  Historically it seems they both came from the Delegation Profile, but in the current Core spec there is no connection between them.  Is there supposed to be?  Is MaxDelegationDepth the limit for the number of loops?  The function definition just says “exceeds the bounds” without identifying what the bounds are or where they come from.  Is this identified anywhere?

 

Thanks,

Glenn Griffin

glenngriffin@research.att.com