Further Comment on Use-Cases in Strawman 1..

Fundamentally, there appear to be two use-cases described
in the Strawman I document:

[Web Browser Use-Case]
  
http://lists.oasis-open.org/archives/security-use/200102/msg00030.html

[Service Use-Case]

 Subject is a service (an application, not a user with a browser); the
service
carries out essentially the same steps as in the [Web Browser Use-Case] but
without
the browser+HTTP constraints.

In each of these two cases, it may be worthwhile to consider when 
(1) security engine is a third-party provider
(2) use of web browser necessitates use of some kind of compact "credential 
artifact" reference.

In particular, I do not see case [Application Chain] as a separate use-case
at all. It is just a composition of the two basic use-cases described above.


- prateek