xacml — archive

[Hal Lockhart]

Prateek asked: > How can we know the kinds of questions a PEP will ask of a PDP? I am not sure what was intended here. Perhaps this was covered under the discussion of Policy Inputs. > Ability to bind administrator identity to policy >Accomplished via trust model between PAP and PR >Could take the form of TLS/SSL or use of digital signatures >No real expansion of specifications required here > Policy repository ensures that only policy originators can edit or delete existing policy This is correct. However note that the Administration/Delegation functionality of XACML 3.0 changes this significantly. Some stakeholders envision a considerably more dynamic policy environment where policies may arrive with the request and be applied only for a single decision. > Administrators should be able to browse and refer to existing policies in new policies >Ability to reference existing policies available via