Re: [xacml] Summary of issues: WI#10. Parameters for CombiningAlgorithms

[Polar Humenn <polar@syr.edu>]

On Thu, 1 Apr 2004, Polar Humenn wrote:

> > Using an expression defeats this (ie, if I use a designator, I'll never
> > know just by looking at the policy what parameters are being supplied).
> > Could someone provide a clear example that shows why we _need_
> > expressions instead of concrete values?
>
> Aside from you get it for free, so why not use it. You may want to
> reference a value you've defined else where.

For instance, you may want to calculate a value
based on attributes in the request context.

A bit contrived, let's say the way you combine the rules depends upon the
age difference between the potential bride and the groom. If the age
difference is below -10, you want to perform a deny overrides on the
rules, between -2 and 3, use a majority of Permits over Denies, and more
than 10, a permit overrides.

Cheers,
-Polar