RE: [xacml] bags and targets. Forwarded message from Seth Proctor .

>If you are allowed to have a single policy with a TARGET that says "if
>you don't have an attribute of "subject-id" throw an Indeterminate". That
>forces the PDP to evaluate each and every target, all 100,000 of them
>for each request, to make sure that the attributes are there.

Absoutely not.  The time to look up "John" in a hash map is the same whether
"John" is present or not.  It is O(1) for any case when it can be reduced to
an equality operation and indexed in advance - is not it?