Re: [xacml] An idea regarding decision explanation

[PRATEEK.MISHRA@ORACLE.COM]

Erik,

This is definitely an area of interest to us. From our perspective, providing a broader solution would be better, such as for example, providing a decision explanation facility for both positive and negative results.

One of the real benefits of using a standard policy language is that it provides a framework for policy analysis - with decision explanation a good example. 

At some level, this is the ability to construct a kind of standard audit or proof for a XACML PDP decision. Some fragment of this audit or proof could then be returned as part of a response. 

We are facing some similar issues in the IGF project, for example, we have a situation where we want to inform a requester that user consent wasnt available. 

- prateek 


> All,
>
> I have noticed that in many cases users do not seem to be happy with just a policy decision. They also want an explanation for the decision so they know what to do in case of denied access. This is perhaps also related to some of the issues you have talked about recently, Rich, I'm thinking about the missing attributes discussion.
>
> In general this is of course impossible to do in practice since in principle there is not much else you can do except to say "Here's the policy, and here's the request, you figure out what you are missing in order to get access."
>
> But I've been thinking about this. I think this could perhaps be solved in many practical cases. We can note that in general the user is probably not interested in the whole policy, but rather a small part which refers to attributes he could do something about. And in many cases policy administrators would know which parts of the policies are relevant for users. Consider the following example:
>
> - The full policy of an organization contains all kinds of policies with all kinds of targets, rules and conditions. One of the policies states that an employee with certain qualifications may buy flight tickets, but only if he has approval from the travel officer.
>
> - Assume that Alice tries to buy a flight ticket, and that she is otherwise qualified, but she does not have approval yet.
>
> In this case Alice is not interested in any way to know that she does not meet the conditions in the other policies, but it would help her a lot if we could tell her that she need approval since she can affect this.