WDAI: a simple World Wide Web distributed authorization infrastructure - slide "Interpreting different security policies"

WDAI doesn't impose any security policy
Administrators use privilege and control attributes to specify their security policies

Security policy	Authorization certificate privilege attributes	Extended ACL control attributes
All-or-nothing	nothing	nothing
Identity-based	user-id	user-id
Role-, group-based	role name/group name	role name/group name
Multi-level security	security level	security classification


Interpreting different security policies