W3C's role in this

XXX -- strawman

Adopt and extend P3P for server policies, user preferences, sanitized policies?
Build special-purpose access control rule language?
Build interoperable obligation language?
...?