Subject: RE: Policy issues: definition of Roles

From: [email-masked]
Date: Wed, 9 Feb 2000 13:53:08 -0600

Hi John,

This matches the way I have been thinking about roles. 
My only quibble would be with naming #2 as PDP roles.
It is not certain that PDP's will always be the consumers doing translation,
so I would  refer to these as referent or
abstract roles since at every level of abstraction they refer to
another level of abstraction. 

<js>
Well, we're getting very close here. Let me propose a summary to see if we
can agree. Roles have three fundamentally different uses:

  1) to directly influence device configuration - let's
     call this PEP ROLES for now
  2) to translate from a high-level description of policy
     into one that configures the device either directly
     or indirectly - let's call this PDP ROLES for now
  3) to be used as a selector to retrieve a subset of
     applicable policies from a larger set of available
     policies - let's call this SELECTOR ROLES for now

Note that the second use is subtlely different than the third. The second
uses roles as a means to translate between expressing policy in general
terms and in configuring the device to implement or support that policy. So
in Shai's example, the PDP has two inputs. One input is the definition of
the policy from the administrator's point-of-view, which probably can not be
used in its current form to configure devices. The other is from the devices
that it controls. They announce their capabilities in terms of roles. The
PDP then uses roles to translate policy from a business expression (Gold
service, or don't allow more than 30% of my core bandwidth to be devoted to
a certain type of traffic, or...) to a form that is used to ultimately
configure the devices that it controls.

The third use is not focused on translation. Rather, it is a way of
selecting policies and/or policy information to be retrieved for further
processing.
</js>

---

From: "John C. Strassner" <[email-masked]>
Date: Thu, 10 Feb 2000 08:41:56 -0800

Hi Avri,

that seems reasonable, though I like the term "translation roles" slightly 
better (but not enough to argue about) ;-)

John