Re: [ogpx] Protocol for permitting policy decisions

One thing to keep in mind in this whole discussion is the following: "All 
policy decisions are local" This doesn't mean they don't represent a way 
of solving a globally distributed use case, but
it highlights the fact the one software element, hosted behind and 
endpoint can't impose behavior on another such endpoint. In the case of 
how a service in an Agent Domain interacts with the services in a region 
domain, the Agent Domain is limited to controlling what *it* does. So, in 
the case of an agent domain which has the policy of not permitting its 
users to be exposed to "mature" content. The agent domain, however, 
doesn't perform the delivery of content from the region. It handles 
authentication, and global presence management, and possibly inventory 
management, but, it doesn't control what happens in the region. (In fact, 
in the current model, it doesn't even see the traffic, but seeing it 
wouldn't help) 

The decision as to what happens inside the region is local to the region. 
Just as the agent Dorian in this example doesn't see what the region is 
doing, the region doesn't see what the
agent domain is doing, nor can it influence it.

>From the point of view of the use case "Keep my agents away from "mature" 
content" the Agent Domain's leverage is limited to looking at the 
information the region exports, and deciding whether or not this is a 
region where it is safe for its agents to travel. The region, of course, 
can say whatever it wants. So.. if the Agent Domain wants certainty, it 
needs for the
region to not only export information it can use to make this decision, 
but to export it in a way that gives the agent domain increased certainty. 
 Traditionally, this takes the form of a
digital signature tied to real world, out of band assurances. 

I would argue this is all for the good. At the Protocol and Endpoint 
description level, most of what needs to happen to support this model is 
to make sure we know where services expose meta-data and how it is 
formatted. The protocol need not focus on what the meta-data represents, 
but that it is there and available for supporting policy decisions. 

>From the perspective of managing interop, I think that the bulk of our 
focus needs to be having the use cases which enable us to make sure we 
*can* export and understand
the meta-data needed to allow policy decisions to be made. 

There is a related topic, namely how we might do a distributed policy 
language permitting various services to reason about the policies 
governing a given service they wish to interact with. But.. That's not 
needed to make the protocol work. I view this as a good thing, since it is 
a decidedly non trivial problem to solve. 

I would suggest that one good way forward on this is to develop a set of 
policy use cases to drive our analysis of the protocol and specifications, 
and then look at whether we can reasonably manage these use cases.  My 
personal belief is that the bulk of our policy management is going to 
consist of checking for meta-data signed using existing PKI standards 
(x.509  is the obvious one) and making decisions based on this meta-data. 

- David W. Levine
~ Zha Ewry

Carlo Wood <carlo@alinoe.com> 
Sent by: ogpx-bounces@ietf.org
10/08/2009 07:44 AM

To
Meadhbh Hamrick <meadhbh.siobhan@gmail.com>
cc
Infinity Linden <infinity@lindenlab.com>om>, "ogpx-bounces@ietf.org" 
<ogpx-bounces@ietf.org>rg>, "ogpx@ietf.org" <ogpx@ietf.org>rg>, Magnus Zeisig 
<magnus.zeisig@iis.se>
Subject
Re: [ogpx] Protocol for permitting policy decisions

On Wed, Oct 07, 2009 at 02:07:58PM -0700, Meadhbh Hamrick wrote:
> anyway. just a though. i'm going to spend a little time trying to
> understand a couple different country's regulations for online access
> to adult materials by minors, just to get a sense for where the
> differences would lie.

Although admirable, this is just an EXAMPLE. We should look at it,
and SOLVE it, in an abstract way; so that we will tackle every
possible policy problem like it without that we have to think of
an exhausted list now.

Ie, if your investigation would show that every country in the
world handles online access to adult materials by minors in the
exact same way, than that doesn't make the abstract problem go
away, we'd just have to think of another example to tackle the
exact same problem.

-- 
Carlo Wood <carlo@alinoe.com>
_______________________________________________
ogpx mailing list
ogpx@ietf.org
https://www.ietf.org/mailman/listinfo/ogpx