Subject: RE: Preparing the Policy Core Information Model for Last Call

From: "Ken Roberts" <[email-masked]>
Date: Tue, 4 Jan 2000 16:20:54 -0500

John, et al,
I'm very pleased to support the Last Call on the Policy CIM, subject to some
clarification. 
The decision to remove contentious material in the name of consensus is a
time honoured standards tradition and is a useful tool to advance work - I
do not oppose its use here but do request for clarification "version 1" be
added to the RFC title. This is just to ensure that folks do not "assume"
the work is complete in all respects and go off to look at other interesting
things. 
The model as it stands is fine for what it addresses, however there are
significant omissions notably but not exclusively what has been called the
"administrative aspects" of policy including such things as security, audit,
fault (i.e. violation detection/ resolution), et al, aspects.
Lastly indulge me in wishing all my colleagues a happy, safe and prosperous
New Year and I look forward to our discussions and meetings in 2000.

--------------------------------------------------------------------------
Regards,
Ken Roberts
INM Product Architecture
Nortel Networks
?ESN   :        655-7844			?Direct  : 408-565-7844
?  Fax    :        408-565-8226
? email :      [email-masked]
 
This message may contain information proprietary to Nortel Networks
Corporation so any
unauthorised disclosure, copying or distribution of its contents is strictly
prohibited.

---

From: "John C. Strassner" <[email-masked]>
Date: Sat, 08 Jan 2000 10:41:20 -0800

Hi Ken,

sorry for the delay in responding, I've been down and out for the count 
with the flu.

Than you very much for your thoughtful comments. I've taken the liberty to 
confer with Ed and Bob, and below please find comments that represent our 
views.

regards,
John (and Ed and Bob)

At 04:20 PM 1/4/00 -0500, Ken Roberts wrote:

>John, et al,
>I'm very pleased to support the Last Call on the Policy CIM, subject to 
>some clarification.

<jcs>
Thanks for the support. This is precisely why the Last Call message
was issued. Your feedback is appreciated and incorporated.
</jcs>
>the work is complete in all respects and go off to look at other 
>interesting things.

<jcs>
Good suggestion. We will incorporate this. We could even add a small 
disclaimer in the Abstract and Intro that says something to the effect of:

     Please note: this is the first version of this document.
    It is being released in order to gain implementation
     experience.

Comments (from you and the rest of the list, of course)?

Please note that this is similar to the convention used for the rsvp 
documents' advancement on the standards track to Proposed Standard. The 
name of the primary RSVP RFC is

    Resource ReSerVation Protocol (RSVP) -- Version 1 Functional Specification

Based on this precedent, we will re-title the subject document:

    Policy Framework Core Information Model -- Version 1 Specification
</jcs>

>"administrative aspects" of policy including such things as security, 
>audit, fault (i.e. violation detection/ resolution), et al, aspects.

<jcs>
Agreed. The question is where to draw the line. The information model is 
concerned with the representation of knowledge about policies, abstracted 
into a set of classes and relationships. It was not intended to model 
security and other administrative aspects at this time, primarily
because there has been little discussion about them and also because there 
is little agreement and definition as to their requirements and goals. In 
addition, administrative aspects such as those you mention tend to be 
vendor- and/or application-specific. So while we agree with your points, we 
also think that they involve a significant amount of extra information that 
would need to be merged into the model.

The fine line we have to walk is whether these functions should be in this 
version of the model, or in a future version of the model. We have taken 
great pains to make this version of the model extensible, so that 
additional functions like those you have mentioned can be added.

Our view is that such topics should be (and are being) addressed by other 
documents that are being produced by this working group. We are consciously 
trying to distinguish between modeling policy and modeling security, and 
think that the modeling of security should be done in other working groups 
(e.g., IPSP) whose focus and core expertise is security. Our charter was 
revised to work closely with such groups. As these documents advance, and 
as the work in other working groups related to these subjects advance, we 
can then actively incorporate their results into the appropriate versions 
of our documents (hence the Version 1 title of this document).

Finally, we think that auditing, accounting, and other similar issues are 
out of scope of the charter that we have. We should try and first complete 
the work that we have, and then see if we want to recharter or form a new 
working group to solve these other issues.
</jcs>

>Lastly indulge me in wishing all my colleagues a happy, safe and 
>prosperous New Year and I look forward to our discussions and meetings in 2000.

<jcs>
Absolutely, we second the wish. And thanks for not calling it the start of 
the new millenium ;-)
</jcs>

>unauthorised disclosure, copying or distribution of its contents is 
>strictly prohibited.

---

From: "Ken Roberts" <[email-masked]>
Date: Mon, 10 Jan 2000 12:01:39 -0600

John,
I agree with your statements. My comment re audit etc. were not meant to
imply the progression of the vers.1 document should be "held up" by work on
those issues, I believe given the difficulties in getting this far vers.1
should proceed as it is - later versions is where this new work can/ should
be folded in.
Understand it is an "information" modelling document but it also is the
"core" CIM and should reflect all informational aspects of the policy model
and I certainly believe there are informational aspects to admin, security,
audit, et al. Whether the Policy Framework group undertakes the work or not
isn't especially relevant, although I'm surprised that identifying core
components and their relationships isn't part of the group charter, the
important point is that it gets done.
So I think we may have another instance of "violent agreement" (another
[im?]famous standards artefact.

 -----Original Message-----
From: 	John C. Strassner [mailto:[email-masked]] 
Sent:	Saturday, January 08, 2000 10:41 AM
To:	Roberts, Ken [SC9:1O80:EXCH]; [email-masked]
Cc:	[email-masked]; [email-masked]; [email-masked]
Subject:	RE: Preparing the Policy Core Information Model for Last
Call

Hi Ken,

regards,
John (and Ed and Bob)

<jcs>

<jcs>

    Resource ReSerVation Protocol (RSVP) -- Version 1 Functional
Specification

<jcs>

<jcs>

---

From: "John C. Strassner" <[email-masked]>
Date: Mon, 10 Jan 2000 13:28:20 -0800

Hi Ken,

thanks for the note, I do agree that we are in violent agreement, and again 
want to thank you for the suggestions you made.

regards,
John

At 12:01 PM 1/10/00 -0600, Ken Roberts wrote:

>imply the progression of the vers.1 document should be "held up" by work 
>on those issues, I believe given the difficulties in getting this far 
>vers.1 should proceed as it is - later versions is where this new work 
>can/ should be folded in.
>
>"core" CIM and should reflect all informational aspects of the policy 
>model and I certainly believe there are informational aspects to admin, 
>security, audit, et al. Whether the Policy Framework group undertakes the 
>work or not isn't especially relevant, although I'm surprised that 
>identifying core components and their relationships isn't part of the 
>group charter, the important point is that it gets done.
>
>From:   John C. Strassner 
>[<mailto:[email-masked]>mailto:[email-masked]]
>Subject:        RE: Preparing the Policy Core Information Model for Last Call
>
>Hi Ken,
>