Title

Declaration of policy domains in policy expressions

Description and Justification

An explicit declaration of policy domain is important and improves processing efficiency. Such an explicit declaration could:

   1. Make explicit requirements on intersection and merging.
   2. Allow the policy vocabulary to be explicitly declared thus alleviating the need to iterate through all assertions contained in the policy.
   3. Enable the association of semantics with the absence of an assertion.
   4. Facilitate reuse by allowing specialized policy engines to process policies for a specific domain.
   5. Avoid combinatorial explosion in computing policy intersections whereby there must be a way to determine which policies must be intersected with others.

Otherwise, all combinations must be attempted. Combinatorial explosion may render impossible the effective and efficient computability of intersection of large policies.

Target

WS-Policy Framework V.Next

Proposal

Of identified options, one solution would be to add a new attribute to the Policy element:

/wsp:Policy/@Domains where @Domains could take a list of URIs to indicate the domains that the policy addresses. The URIs are separated by a space similar to the PolicyURI attribute. The domains would define suitable URIs such as the default namespace.

An example of an RM policy with its domain:

<wsp:Policy wsu:Id="anRMPolicy"
            Domains="http://schemas.xmlsoap.org/ws/2005/02/rm/policy"
            xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
            xmlns:wsrm="http://schemas.xmlsoap.org/ws/2005/02/rm/policy"/>
  <wsrm:RMAssertion/>
</wsp:Policy>

The intersection of policies that address different domains is an empty policy. Policies can be merged by adding up the URIs of the respective Domains attributes and applying the regular policy merge algorithm. Nested policies MAY use the Domains attribute to declare the domains they address. The top-level policy element SHOULD enumerate all Domains that its nested policies are declaring in their respective Domains attribute.