Re: [ogpx] Protocol for permitting policy decisions

[Carlo Wood <[e-mail]>]

On Thu, Oct 08, 2009 at 01:17:01AM +0000, Dickson, Mike (ISS Software) wrote:
> Meadbah wrote:
> 
> i still like this scheme because a) it's really similar to the way
> seed caps work, b) it adds flexibility to our system(s), and c) it
> does what i was hoping... gives the AD the ability to make policy
> decisions (like am i going to let this 15 year old user access
> material that may land me in hot water with the local authorities.)
> 
> 
> I may be mis-understanding all this since I’m still trying to come up to speed
> but isn’t it the region that’s making the policy decision here to allow/
> disallow a connect given what AD is representing about the user?  And yes, I
> agree that for this to work there must be trust established between the
> services involved.  I’m just confused by the above statement since it implies
> the AD is making a policy decision while it’s really the RD that has the
> content (and hence the possible issue).  And the RD and AD may be run by two
> different entities….
> 
> Mike

Mike is correct, at least -- that is the way I intended it :p

The AD gathers information about a user and tells the RD (in general terms)
what information it has. Then the RD tells the AD under what circumstances
the user can be allowed in (by giving a list of ranges (or values / reg.exp)
that the given data has to match.

In the end, the AD does not make the decision therefore.

If the authority that runs the AD has a moral problem with letting in
users of 15 into a mature region, then they can arrange in ADVANCE with
the administration of the region that it either 1) doesn't contain mature
content or 2) asks for an age > 18 (or whatever satisfies the AD administration).

The real-time protocol exchange and per-user decisions however, are then
in principle in the hands of the Region. That is a Good Thing.

-- 
Carlo Wood <[e-mail]>