Recently, Cheh Goh presented a generic policy approach [Goh 97], which is slightly different from the ones presented before.
Central to this policy concept are the states of a managed system, object, or resource and the formulated constraints on these states or state transitions. With the help of constraints, the desired behaviour of the states of the managed objects is described. A system is compliant with the policies if it satisfies all of the constraints on the system and state transitions.
Figure shows permissible and impermissible states
and state transitions according to stated policies. There is a
distinction between passive and active policy enforcement, which is
described later in more detail in subsection
and
.
In comparison to the approaches influenced by the policy work of the
Imperial College, in [Goh 97] no categorisation in authorisation
and delegation policies is made. Instead, his view treats policies as
constraint descriptions and these are powerful enough to include the
approaches presented in the sections above. We will discuss this in
section and
in more
detail.
In general, actions are not implicitly considered as part of a constraint-based policy as they are, for example, in Sloman's delegation policies. The reason for this is that, given the constraints, there are a potentially large number of valid ways to move a system into a state where it is compliant with the set of stated policies. A (passive) policy does not restrict the enforcement to fulfil the constraints through a specified algorithm which would be encoded in the policy itself. So called implementables are added to active policies during the final phase of the refinement process. In the following subsection, this is described in more detail.