I think we need to clarify two dimensions of this decision: 1. Standard (XACML-defined) operations versus policy-writer-defined operations. 2. Type of operation Boolean (output=Boolean, args=Boolean) Examples: AND, OR, NOT, ORDERED-AND, N-OF Relations (output=Boolean, args=various) Examples: GreaterThan, Equals, SubsetOf Functions (output=various, args=various) Examples: DateDuration, DateAdd, IntegerAdd, StringToUpper Conversion Functions (output=various, args=various) These are invoked implicitly by the PDP if the input provided in the request is of a different type than the argument type specified by the Function or Relation Examples: StringToInteger -- Anne H. Anderson Email:
Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692