Re: [ogpx] Protocol for permitting policy decisions

[Joshua Bell <[e-mail]>]

On Wed, Oct 7, 2009 at 2:07 PM, Meadhbh Hamrick
<[e-mail]>wrote;wrote:

> oh. hey. so i was just thinking about the "should we define global
> keys for region meta-data?" question.
>
> i think if we were to move forward with the AD telling the RD what
> it's concerned about plan, we _should_ have global identifiers. i just
> think that if everyone had different identifiers for the same concept,
> you would get protocol interop, but you would still have systems that
> don't know what each other are talking about.
>

Thinking while I type here - these aren't finished thoughts, just some
brainstorms:

So fundamental to this, we're talking about one system making policy
decisions based on data from another system that's in a different trust
domain (e.g. separate organizations). That implies to me that they must have
done an out-of-band trust negotiation, otherwise they have no reason to, er,
trust the data, so the policy decision is advisory at best. And at that
point, wouldn't we assume they're attempting to actively enable system
interop and would therefore also have that opportunity to agree on a
concept/identifier set? IMHO, that wouldn't live in the protocol itself, but
perhaps a standard set of interchange profiles...

Sample scenario (using the VW1=AD1+RD1, VW2=AD2+RD2 rough terminology we've
been batting about):

VW1 and VW2 want to enable inter-VW tourism (i.e. AD1 agents can visit RD2).
VW2 has a policy that they only allow in users of a certain quality (e.g.
"speaks Latin"). Only a subset of AD1 agents have that quality. Therefore,
RD2 would only accept teleports of AD1 agents that have that quality (based
on the sort of handshake discussed earlier in this thread). However, RD2
needs some trust relationship with AD1, otherwise malicious AD3 can come
along which claims all of its users speak Latin and its users slip in. So
VW1 and VW2 trade keys and sign some paperwork, and at that point (while the
lawyers are busy) they could handshake on sharing "agent linguistic
information profile v2.3" data.

On the other hand, there might be more hard-core requirements (age, security
clearance, etc) that would use different profiles.

Hopefully there's also the nil-trust case where this information might be
shared on a purely informational basis - e.g. even ADx asserts some quality
about an agent to RDy, ADx feels comfortable broadcasting that information
(since it can't trust that RDy will keep it confidential) and RDy feels
comfortable using that information even without trusting it (since it has no
reason to believe ADx is telling the truth).

Now... this all doesn't sound like it should new. I'm vaguely reminded of
W3C's PICS (which died quietly after negligible adoption), but there weren't
two active (and potentially liable...) entities involved in that, just the
single provider and user. Surely there are other examples?