Policy administration domains

We present a model for policy administration structures. The model consists of a mathematical notation that captures the relationship between policies and objects and the entities that manage policies for those objects. In the model a system is viewed as consisting of a number of policy administration domains. The domains are arranged in a hierarchy, representing descending levels of authority. The presence of an object in a domain represents the ability of the manager of that domain to write policy for that object. A number of important issues for policy administration are identified and addressed within the model. These include meta-policy questions, such as who has control over the placement of an object in a policy administration domain and where it can be moved within the hierarchy. A number of possible approaches to each of these questions is identified and expressed in the notation presented. The model is capable of expressing policy administration in DAC, MAC and combined systems.62 page(s