Two scenarios

Attached are two scenarios for consideration. The first concerns
outsourced management and what is needed to ensure only
authorized external management operations are allowed.

The second is an Application Service Provider scenario and looks
at what is needed to ensure only authorized users can access the 
applications, and only legitimate applications are used.

In each scenario, different mechanisms are needed to propagate
assertions.

I believe they complement what is already in the S2ML draft, but
I don't know if they will duplicate what is already in the Auth-XML
requirements document, as I have not seen that.

I attach the text in RTF format, as well as the powerpoint slides for the
figures. I have also attached the PDF for those who find RTF inconvenient.

Regards,
Nigel. 

 <<HPXAuthzScenarios.rtf>> 
 <<OasisUseCaseFigures.ppt>> 
 <<HPXAuthzScenarios.pdf>>