Sorry for being not clear enough - my note is not about HTTPS (this is just an example) but about seeing SOA Service as an executable entity behind the communication interface.
RM directly points to such service understanding in the execution context explanations.
I propose to protect service consumer interests and explicitly extend security requirements onto the "service body" (by saying "SOA-based systems" instead of "SOA-based message exchanges" only).
We do not need to go with more details on this in RA: how this is done is the service provider's business.
- Michael
