Re: [xacml] on postconditions

if given this:
> With this definition we can not predict which poscondition(s) will be
> executed for a given
> authorization request. This is not desirable.

'do_something' cannot be guaranteed:
> on_grant(action, subject, resource) do_something;
> on_deny(action, subject, resource) do_something;

because that would require acknowledgement that it occured (implying
dependence on grant/deny).

sounds like 'post condition' in this sense is more like 'post request'.

b