Subject: Re: forced VCAR (was: revised security section)

From: [email-masked]
Date: Fri, 4 Feb 2000 05:28:13 -0500

Yes, we are in agreement.
- C&S VCAR Policy specification by the CU is in the CAP.
- CAP could specify that an out-of-band method (i.e., not specified by the 
current CAP draft) could be used to set the VCAR such that a CU can't 
subsequently change it.
- CAP can also specify that a CS can set a calendar-wide VCAR that CUs 
can't modify.
The requirements for such features seem clear. Thank you for taking the 
time to answer.
-- Frank

---

From: Doug Royer <[email-masked]>
Date: Fri, 04 Feb 2000 08:51:55 -0800

> - C&S VCAR Policy specification by the CU is in the CAP.

As far as POLICY goes. They are -not- really in CAP yet. 

Frank - as you are the one that put 'POLICY' in CAP. Do you think
the VCAR definitions sent out are correct? If not could you please
explain what those POLICYs mean?

If not - I would suggest we remove them from CAP as as they are currently
undefined and it would be impossible to create an interoperable CUA or CS
that knew what to do with them. We could put them back in once they
have been defined.

Any objections?

-Doug

---

From: [email-masked] (Steve Mansour)
Date: Sat, 05 Feb 2000 12:45:13 -0800

Frank (and others),

We need some clarity on the Policy specification. The only "specification"
I've seen is Doug's earlier message "POLICY in general."

I don't think there's general concensus on what each of the policies means.
Since we started working on iTIP, I've talked with many folks in this working
group about "policies", and I know we all have slightly different ideas about
certain things. For example, exactly what it means for one user to act on
behalf of another differs a bit between products.

The choices we have to resolve this, as I see them, are:

  1. We give each policy a name and define precisely what it means with VCARs
  2. We define a set of policy names and allow clients to query for the VCARs
     that describe what they mean
  3. We remove policies completely

If there's no feedback within a week or two, we'll just remove policies from
the draft. We can add them back if/when we get definitions.

-Steve

---

From: Doug Royer <[email-masked]>
Date: Sun, 27 Feb 2000 12:23:05 -0800

FYI I just removed POLICY from CAP and replaced them with VCAR's.
Except:

I removed ACTONBEHALF as it had no definition and I did not
replace it with a VCAR.

And I removed  OWNER policy as it had not difference
to assigning them as an OWNER and I did not replace it with a VCAR.

We can add them back later if we get text.

-Doug