RE: Groups vs. Roles

Hi

> "A role is thus a special case of a group, in which all the policies have
> the same subject."

????? i am not sure i understand this......

> This would imply that although roles are useful, one never has to reference
> a role from a policy. One can simply reference the group which has a one to
> one mapping with the named role. This is not inconsistent with my first
> statement:

i'm not sure ......

roles are dynamic by nature and can be activated and released.

-p