RE: [xacml] Function Completeness

[Daniel Engovatov <dengovatov@crosslogix.com>]

>As I was saying, I am looking at functional completeness. I see a
>deficiency in things you can say, which makes coverage of the language
>incomplete.

In the MatchId?  Why our languge should be "complete" in the MatchId?

MatchId is not for making authorization decisions. It is for selecting
applicable rules. - Different purpose - different semantics.

In your example - if you do not want to permit a person over 250lb to jump
a parachute, as its reserve is TSO'd to 250lb - you write it in condition.

permit(anysubject, parachute, jump) if (integer-greater 250 subject:weight)

You suggest:
permit(subject with (not (integer-greater weigth 250)), parachute, jump) if
true;

It has no advantage over the previous expression - logically equivalent
but a disadvantage of messing up simple target matching semantics.

> Use cases may serve as a set of requirments to satisfy, but they do not
> cover the entire space of use cases. You certainly do not produce every
> use case you may envision.

It does not mean that we have to put in every possible feature - just in
case.
For each feature there should be at least one requirement.
Remember the KISS priciple, and an older one: "Pluralitas non est ponenda
sine neccesitate"


Regards,
Daniel;