On Thu, 10 Jan 2002, Pierangela Samarati wrote:
> Hi,
>
>
> I too would like to see actions in this context.
>
> in today's TC concall, some people mentioned that "action" is already used
> with different semantics (=the operation the principal is requesting).
> that's true, so we should find another term.
Probably, but I would really like to understand the nature of this beast.
> the point is, however, that the semantics of "postconditions" now seems
> really to be a reaction of the system, not the evaluation of a state, so
> terminology should reflect the semantics.
Well, I had oringally thought that a "post-condition" would be something
that would be true if the policy evaluated to true according to its input.
That is, a "post-condition" should be a logical consequence, but maybe not
fully derivable by all available information. This post-condition would
merely be some advice to the evaluator.
Such as Policy stating that:
Subject is in Role of MissleLauncher to the
Resource of Missle on Action Launch.
Post-condition
Subject is dangerous.
>
> However, I have a question. What is the purpose for actions (i.e. these
>
> post conditions) after checking a policy? What types of actions are
>
> allowed?
>
> examples that were brough up for post-conditions were things like
> "logging the request", essentially they are actions that the system
> executes in response to granting an access, or simply having evaluated
> the authorizations (discussion on the specific behavior is still
> open).
>
>
> Do they change the state of the policy?
>
> if you mean the set of rules i guess the answer is no (they should not
> change the rules). but again, post-conditions are one of the issues
> which have not discussed fully.
Hmmmm, I really don't like the fact that these post conditions mandate
that some generic operation be performed, i.e. it could be used to alter
state, especially the state of the policy. I guess we should discuss this
further?
-Polar
> best
> -p
>
>
>
>
----------------------------------------------------------------
> To subscribe or unsubscribe from this elist use the subscription
> manager: <http://lists.oasis-open.org/ob/adm.pl>
>
