Suggested discussion topic -- what are common practices in how access-control attributes are bound to resources?

My question is: in current practice today with current deployed products, how are resource metadata bound to resources (documents, etc.)  Interested in access-control related resource attributes of course (vs search, etc metadata.)  Also, how do PDP's (or PIP's) find these attributes? 

Thanks,

Martin

-- 

Martin F Smith, Principal
BFC Consulting, LLC

McLean, Va 22102

703 506-0159

703 389-3224 mobile