xacml — archive

[Bill Parducci]

if given this: > With this definition we can not predict which poscondition(s) will be > executed for a given > authorization request. This is not desirable. 'do_something' cannot be guaranteed: > on_grant(action, subject, resource) do_something; > on_deny(action, subject, resource) do_something; because that would require acknowledgement that it occured (implying dependence on grant/deny). sounds like 'post condition' in this sense is more like 'post request'. b