How to handle implicit contextual "constraints"?

Open
#25 1 comment 0 reactions 2 assignees View on GitHub

@woutslabbinck is already working on this.

Since Feb 8, 2024.

Assessment

This issue has not been assessed yet.

Description

brainstorm design research UCP

(Meta)data like the owner of the target of a request, but also the time of the request, for example, are facts that are always present. They can influence policy decisions and can be crucial to maintain good logs (even if they do not play a role in the specific policy in question).

Conceptually, however, even though some generic policy rules do not care about those facts (e.g. it applies regardless of the owner), UCP models them as needing that info. I'd argue they should not, since we can come up with an endless list of such data that could be relevant. For logs, the authz server can always add that data to the result of the policy engine, without passing it to that engine.

Apart from coupling policy reasoning and auditing logs more loosely, we should therefore decide whether we still pass all that (meta)data to the reasoner, or rather make abstraction from it, and only add it if they really form a necessary constraints for the policy at hand.

Dominant language
TypeScript
Stars
9
Forks
4
Avg merge
4d 21h
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SolidLabResearch/user-managed-access

All issues in SolidLabResearch/user-managed-access

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.