xacml — archive

[System]

Here is an idea for how to achieve the effect of negative policies, but in a "clean" way: membership exceptions. I looked at the policy proposal by Carlisle, which defines (initiator,action,object) triplets. The idea is to turn it into quads (initator,exceptions,action,object) with the following semantic: for purposes of evaluation, if the entity making the request is identified by the initiator, but not by the exceptions, then look consider this entry. For example, to say "fred cant" you say "everyone {except fred} can" I'll have to think about it a bit more, but it seems like it's worth pursuing. /r$ -- Zolera Systems, Securing web services (XML, SOAP, Signatures, Encryption) http://www.zolera.com