From SHutchinson at us.mufg.jp Mon Jun 26 13:58:31 2023 From: SHutchinson at us.mufg.jp (Stephen Hutchinson) Date: Mon, 26 Jun 2023 13:58:31 +0000 Subject: [policy-charter] [External] Re: Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: As long as we don?t lose the policy synchronization/push/whatever piece that started this whole effort last year, I?m fine with it being under a larger ?authorization? umbrella. Selfishly, I have far less concerns about a variety of PEPs being able to interact with different PDPs than I do with how does one keep the policy that resides in a multitude of PDPs somewhat in sync. From the trench I work in, my difficulties all spring from lack of PAP-PDP Interop much more so than PDP-PEP. Steve ?Hutch? Hutchinson Director, Security Architecture MUFG Americas HQA Architecture Remote: Richmond, VA T:+1-804-245-4172 shutchinson at us.mufg.jp @IdentityHutch [Description: MUFG] From: policy-charter On Behalf Of Andrew Hughes via policy-charter Sent: Friday, June 23, 2023 1:00 PM To: Policy Charter Mail List Cc: Andrew Hughes Subject: [External] Re: [policy-charter] Link to PDP-PEP Interop WG Charter draft document *** External email: Please be careful when opening attachments or clicking links. *** Anyone else want to weigh in on this? I'm onboard with Pieter's suggestion that the attached document describes a deliverable of a larger work group - if so, I'd like to get closure on the description quickly I hope it's a simple and non-controversial deliverable... Andrew Hughes Director - Identity Standards andrewhughes at pingidentity.com Mobile/Signal: +1 250 888 9474 On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter > wrote: My perspective is that we should have one Work Group focused on authorization with multiple deliverables (e.g. OpenID Connect and SSF for example has multiple deliverables) to start with. This way everyone interested in the authorization topic has visibility into the different work items and we get the benefit of wider participation and review. Agreed that something with Authorization in the name would make sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) or AuthIT/AuthZIT Framework (Authorization Interoperability Technology Framework)?. From: policy-charter > On Behalf Of Allan Foster via policy-charter Sent: Friday, June 16, 2023 10:46 PM To: Policy Charter Mail List > Cc: Allan Foster > Subject: Re: [policy-charter] Link to PDP-PEP Interop WG Charter draft document So, I wonder if we should do two different WGs, or one WG with two different standards?. (At least, for now?) I am inclined to think the WG should be AuthZ something??. and have two separate streams?. (or standards?) Thoughts Allan On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter > wrote: Thanks Andrew! Added a first comment in there... The season's open! ./\. On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter > wrote: Here is the document I have started - the link puts you into "suggest" mode. Please add text with self-attribution. Be respectful of others' contributions. https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true [Ping Identity] Andrew Hughes Director - Identity Standards andrewhughes at pingidentity.com Connect with us: [Glassdoor logo][LinkedIn logo][twitter logo][facebook logo][youtube logo][Blog logo] [https://www.pingidentity.com/content/dam/picr/img/em/2022-PrideMonth-426x106.png] CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.-- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter -- [This is Alexandre Babeanu's card. Their email is alex at 3edges.com. Their phone number is +1 604 728 8130.] CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information. -- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter -- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you. ====================================================================== This email is confidential, and your receipt of it is subject to the recipient terms appearing at: https://www.mufgamericas.com/emailrecipientterms . If you have received this email in error, please inform us by email reply and then delete the message. Any use of this email inconsistent with those terms is strictly prohibited. Additionally, for information on cybersecurity and Corporate & Investment Banking, please click here. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 7138 bytes Desc: image001.png URL: From alex at 3edges.com Mon Jun 26 15:42:12 2023 From: alex at 3edges.com (Alex Babeanu) Date: Mon, 26 Jun 2023 08:42:12 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: Sounds good to me too. Thanks, ./\. On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < policy-charter at lists.openid.net> wrote: > Anyone else want to weigh in on this? > > I'm onboard with Pieter's suggestion that the attached document describes > a deliverable of a larger work group - if so, I'd like to get closure on > the description quickly > > I hope it's a simple and non-controversial deliverable... > > Andrew Hughes > Director - Identity Standards > andrewhughes at pingidentity.com > Mobile/Signal: +1 250 888 9474 > > > > On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < > policy-charter at lists.openid.net> wrote: > >> My perspective is that we should have one Work Group focused on >> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >> example has multiple deliverables) to start with. This way everyone >> interested in the authorization topic has visibility into the different >> work items and we get the benefit of wider participation and review. >> >> >> >> Agreed that something with Authorization in the name would make sense, >> something like AuthZEN Framework (AuthoriZation ExchaNge Framework) or >> AuthIT/AuthZIT Framework (Authorization Interoperability Technology >> Framework)?. >> >> >> >> *From:* policy-charter *On >> Behalf Of *Allan Foster via policy-charter >> *Sent:* Friday, June 16, 2023 10:46 PM >> *To:* Policy Charter Mail List >> *Cc:* Allan Foster >> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter draft >> document >> >> >> >> So, I wonder if we should do two different WGs, or one WG with two >> different standards?. (At least, for now?) >> >> >> >> I am inclined to think the WG should be AuthZ something??. and have two >> separate streams?. (or standards?) >> >> >> >> Thoughts >> >> >> >> Allan >> >> >> >> >> >> >> >> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >> Thanks Andrew! >> >> Added a first comment in there... The season's open! >> >> >> >> ./\. >> >> >> >> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >> Here is the document I have started - the link puts you into "suggest" >> mode. Please add text with self-attribution. Be respectful of others' >> contributions. >> >> >> >> >> >> >> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >> >> >> >> >> [image: Ping Identity] >> >> *Andrew Hughes* >> Director - Identity Standards >> andrewhughes at pingidentity.com >> >> *Connect with us: * >> >> [image: Glassdoor logo] >> [image: >> LinkedIn logo] [image: twitter >> logo] [image: facebook logo] >> [image: youtube logo] >> [image: Blog logo] >> >> >> >> >> >> >> >> >> *CONFIDENTIALITY NOTICE: This email may contain confidential and >> privileged material for the sole use of the intended recipient(s). Any >> review, use, distribution or disclosure by others is strictly prohibited. >> If you have received this communication in error, please notify the sender >> immediately by e-mail and delete the message and any file attachments from >> your computer. Thank you.*-- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> >> >> >> >> -- >> >> [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. >> Their phone number is +1 604 728 8130.] >> >> >> >> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >> hereto, is for the sole use of the intended recipient(s) and may contain >> confidential and/or proprietary information. >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited. > If you have received this communication in error, please notify the sender > immediately by e-mail and delete the message and any file attachments from > your computer. Thank you.*-- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -- [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. Their phone number is +1 604 728 8130.] -- CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information. -------------- next part -------------- An HTML attachment was scrubbed... URL: From david.brossard at gmail.com Tue Jun 27 15:09:26 2023 From: david.brossard at gmail.com (David Brossard) Date: Tue, 27 Jun 2023 08:09:26 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: I added notes and comments in the Google Doc . I think it is worth highlighting we're not after yet another standard . We want to: 1. increase interoperability between existing standards. In my mind, the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and IDQL. 1. interop from a policy management perspective 2. interop from a runtime request/response perspective 2. increase awareness of externalized authz so that software developers/owners/SaaS never rebuild their own 1. Be the OAuth/SAML of authZ 2. Define and propose standard authZ patterns 1. use cases 2. integration patterns On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < policy-charter at lists.openid.net> wrote: > Sounds good to me too. > Thanks, > > ./\. > > On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < > policy-charter at lists.openid.net> wrote: > >> Anyone else want to weigh in on this? >> >> I'm onboard with Pieter's suggestion that the attached document describes >> a deliverable of a larger work group - if so, I'd like to get closure on >> the description quickly >> >> I hope it's a simple and non-controversial deliverable... >> >> Andrew Hughes >> Director - Identity Standards >> andrewhughes at pingidentity.com >> Mobile/Signal: +1 250 888 9474 >> >> >> >> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> My perspective is that we should have one Work Group focused on >>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>> example has multiple deliverables) to start with. This way everyone >>> interested in the authorization topic has visibility into the different >>> work items and we get the benefit of wider participation and review. >>> >>> >>> >>> Agreed that something with Authorization in the name would make sense, >>> something like AuthZEN Framework (AuthoriZation ExchaNge Framework) or >>> AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>> Framework)?. >>> >>> >>> >>> *From:* policy-charter *On >>> Behalf Of *Allan Foster via policy-charter >>> *Sent:* Friday, June 16, 2023 10:46 PM >>> *To:* Policy Charter Mail List >>> *Cc:* Allan Foster >>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>> draft document >>> >>> >>> >>> So, I wonder if we should do two different WGs, or one WG with two >>> different standards?. (At least, for now?) >>> >>> >>> >>> I am inclined to think the WG should be AuthZ something??. and have >>> two separate streams?. (or standards?) >>> >>> >>> >>> Thoughts >>> >>> >>> >>> Allan >>> >>> >>> >>> >>> >>> >>> >>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>> Thanks Andrew! >>> >>> Added a first comment in there... The season's open! >>> >>> >>> >>> ./\. >>> >>> >>> >>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>> Here is the document I have started - the link puts you into "suggest" >>> mode. Please add text with self-attribution. Be respectful of others' >>> contributions. >>> >>> >>> >>> >>> >>> >>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>> >>> >>> >>> >>> [image: Ping Identity] >>> >>> *Andrew Hughes* >>> Director - Identity Standards >>> andrewhughes at pingidentity.com >>> >>> *Connect with us: * >>> >>> [image: Glassdoor logo] >>> [image: >>> LinkedIn logo] [image: twitter >>> logo] [image: facebook logo] >>> [image: youtube logo] >>> [image: Blog logo] >>> >>> >>> >>> >>> >>> >>> >>> >>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>> privileged material for the sole use of the intended recipient(s). Any >>> review, use, distribution or disclosure by others is strictly prohibited. >>> If you have received this communication in error, please notify the sender >>> immediately by e-mail and delete the message and any file attachments from >>> your computer. Thank you.*-- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >>> >>> >>> >>> -- >>> >>> [image: This is Alexandre Babeanu's card. Their email is >>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>> >>> >>> >>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>> hereto, is for the sole use of the intended recipient(s) and may contain >>> confidential and/or proprietary information. >>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >> >> *CONFIDENTIALITY NOTICE: This email may contain confidential and >> privileged material for the sole use of the intended recipient(s). Any >> review, use, distribution or disclosure by others is strictly prohibited. >> If you have received this communication in error, please notify the sender >> immediately by e-mail and delete the message and any file attachments from >> your computer. Thank you.*-- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > > > -- > [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. > Their phone number is +1 604 728 8130.] > > > CONFIDENTIALITY NOTICE: This e-mail message, including any attachments > hereto, is for the sole use of the intended recipient(s) and may contain > confidential and/or proprietary information. > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -- --- David Brossard http://www.linkedin.com/in/davidbrossard http://twitter.com/davidjbrossard http://about.me/brossard --- Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx Prenez vos pr?cautions sur Internet: http://www.securite-informatique.gouv.fr/gp_rubrique34.html -------------- next part -------------- An HTML attachment was scrubbed... URL: From david.brossard at gmail.com Tue Jun 27 15:16:35 2023 From: david.brossard at gmail.com (David Brossard) Date: Tue, 27 Jun 2023 08:16:35 -0700 Subject: [policy-charter] PEP-PDP Group In-Reply-To: <2a5c3d88-c433-453a-8085-c3e2834ea9c2@Canary> References:

<6df4307c-f221-1068-3a3f-5c1672a9eaaf@umbrella.associates> <2a5c3d88-c433-453a-8085-c3e2834ea9c2@Canary> Message-ID: I agree with Allan. There's another aspect to runtime authZ: it eliminates the need to define entitlements up front. It eliminates the need for role, permissions, and entitlements engineering, and consequently provisioning and de-provisioning. This makes me think another area of investigation for this WG is bridging the runtime authz world (XACML, OPA...) with the non-runtime authz world (OAuth scopes & claims, SCIM entitlements...) AuthZ frameworks should be capable of generating dynamic claims that are fed into a token. CAEP could be used to update/revoke/enrich such tokens. This means we need different ways to query a policy. And perhaps different ways to write policies. Let's assume a business authz policy: - *Policy*: Claims processors can approve a claim in their region if the amount claimed is less than the approver's limit. - *Direct request*: Can Alice approve claim #123? (in the background, attribute retrieval is run to figure out who Alice is and what claim 123's region and amount are) - Answer: Permit/Deny + obligations - *Indirect request*: tell me what Alice can do on claims - Answer: approve + claim amount < $500 + region = Moose Jaw. On Wed, Jun 14, 2023 at 8:15?AM Allan Foster via policy-charter < policy-charter at lists.openid.net> wrote: > > Alex, I am not sure I fully agree with your statement! > > Although you might not use a PEP to protect those resources, There is > still a reasonable use case to treat the spec as the API and transport for > those resources to call out to a centralized AuthZ server. > > I think there are at least two use cases for standardization (as we > discussed at IDentiverse) > > 1. A standardized interface between PEPs or agents and the PDP. This > would allow de-weaponization of agents, and interoperability at the agent > level?. > 2. A standardization athe policy level so that IF the PDP cannot be > centralized, the interop would be at the Policy level. Enabling the Policy > Management to be centralized. > > A SaaS might not be willing to call out to a central PDP for AuthZ (and > all the performance problems that brings) but might well be willing to > accept the Policy definition into its own AuthZ system > > I see these as complimentary. > > On another note, We want to ensure that whatever we do at the PEP/PDP > level, we allow for real time decisions. AuthZ decisions are not > necessarily entitlements, and the decision may well depend on environmental > issues at the time of the request. > > Allan > > > > On Tuesday, Jun 13, 2023 at 11:45, Alex Babeanu wrote: > This is a good discussion, that said a PEP is actually *not* mandated in > all cases. For example you would *not* use a PEP to secure GraphQL APIs > nor COTS software. > > I'm going to share soon a doc, to all contribute on, that lists common > authorization design patterns. I think it would be a good basis for > discussion, and at least to scope what we're trying to do... > > Thanks, > ./\lex. > > On Tue, Jun 13, 2023 at 11:30?AM Allan Foster via policy-charter < > policy-charter at lists.openid.net> wrote: > >> So I am thinking we also want to set some scope of what we want to >> cover? >> >> >> >> Off the top of my head?. I can put some more context around these if >> they aren?t clear >> >> >> >> The Transport layer >> >> The Envelope Layer >> >> The request/response transaction layer >> >> How meta-data is handled? (both request and response) >> >> Extension mechanisms >> >> Exception mechanism >> >> >> >> Allan >> >> >> >> >> >> >> >> *From: *policy-charter on >> behalf of Omri Gazitt via policy-charter > > >> *Date: *Tuesday, June 13, 2023 at 10:54 >> *To: *Policy Charter Mail List >> *Cc: *Omri Gazitt >> *Subject: *Re: [policy-charter] PEP-PDP Group >> >> I agree with David that looking at existing systems is a good place to >> start. If the idea is that PDPs can add a "standard" API that PEPs can >> call, then it would be good if the API supports the existing message >> exchange patterns (and doesn't mandate things that aren't supported). >> >> >> >> Here are three examples, to get us started: >> >> - OPA is interesting in the sense that its primary REST API is very >> document-oriented - you have a set of rules that are defined in a >> JSON-style hierarchy and you issue a GET or POST on that resource in the >> hierarchy to evaluate the rule that is rooted there. This seems like a >> special case. OPA does have a generic query >> >> API, which allows you to pass input and evaluate a rego query based on the >> loaded policy document and the input. >> - Auth0 FGA (one of the zanzibar implementations) has a check >> API >> that takes a JSON payload containing a user key, relation name, and object >> key, and returns an allowed decision (true or false). Most zanzibar >> implementations seem to do something similar - e.g. SpiceDB has a >> check >> >> API that takes a resource, permission, and subject. >> - Topaz (Aserto's OSS authorizer) has a query >> API that takes >> an identity and policy (rule/decisions to evaluate), and optionally a >> resource context and additional input, and returns what OPA would return. >> It also has a simpler is >> API that >> evaluates a policy (rule/decisions) with an identity and resource context. >> >> >> >> >> >> On Tue, Jun 13, 2023 at 1:54?AM Roland Baum via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >> I'm in as well :-D >> >> >> >> Roland Baum >> umbrella.associates GmbH >> >> >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > > > -- > [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. > Their phone number is +1 604 728 8130.] > > > CONFIDENTIALITY NOTICE: This e-mail message, including any attachments > hereto, is for the sole use of the intended recipient(s) and may contain > confidential and/or proprietary information. > > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -- --- David Brossard http://www.linkedin.com/in/davidbrossard http://twitter.com/davidjbrossard http://about.me/brossard --- Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx Prenez vos pr?cautions sur Internet: http://www.securite-informatique.gouv.fr/gp_rubrique34.html -------------- next part -------------- An HTML attachment was scrubbed... URL: From andres.aguiar at okta.com Tue Jun 27 15:25:22 2023 From: andres.aguiar at okta.com (Andres Aguiar) Date: Tue, 27 Jun 2023 12:25:22 -0300 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: Hi all! Any reason not to include Google Zanzibar-inspired AuthZ implementations (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this effort? Regards, Andres On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < policy-charter at lists.openid.net> wrote: > *This message originated outside your organization.* > > ------------------------------ > > I added notes and comments in the Google Doc > . > I think it is worth highlighting we're not after yet another standard > . > We want to: > > 1. increase interoperability between existing standards. In my mind, > the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and IDQL. > 1. interop from a policy management perspective > 2. interop from a runtime request/response perspective > 2. increase awareness of externalized authz so that software > developers/owners/SaaS never rebuild their own > 1. Be the OAuth/SAML of authZ > 2. Define and propose standard authZ patterns > 1. use cases > 2. integration patterns > > > On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < > policy-charter at lists.openid.net> wrote: > >> Sounds good to me too. >> Thanks, >> >> ./\. >> >> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> Anyone else want to weigh in on this? >>> >>> I'm onboard with Pieter's suggestion that the attached document >>> describes a deliverable of a larger work group - if so, I'd like to get >>> closure on the description quickly >>> >>> I hope it's a simple and non-controversial deliverable... >>> >>> Andrew Hughes >>> Director - Identity Standards >>> andrewhughes at pingidentity.com >>> Mobile/Signal: +1 250 888 9474 >>> >>> >>> >>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> My perspective is that we should have one Work Group focused on >>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>> example has multiple deliverables) to start with. This way everyone >>>> interested in the authorization topic has visibility into the different >>>> work items and we get the benefit of wider participation and review. >>>> >>>> >>>> >>>> Agreed that something with Authorization in the name would make sense, >>>> something like AuthZEN Framework (AuthoriZation ExchaNge Framework) or >>>> AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>> Framework)?. >>>> >>>> >>>> >>>> *From:* policy-charter *On >>>> Behalf Of *Allan Foster via policy-charter >>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>> *To:* Policy Charter Mail List >>>> *Cc:* Allan Foster >>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>> draft document >>>> >>>> >>>> >>>> So, I wonder if we should do two different WGs, or one WG with two >>>> different standards?. (At least, for now?) >>>> >>>> >>>> >>>> I am inclined to think the WG should be AuthZ something??. and have >>>> two separate streams?. (or standards?) >>>> >>>> >>>> >>>> Thoughts >>>> >>>> >>>> >>>> Allan >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>> Thanks Andrew! >>>> >>>> Added a first comment in there... The season's open! >>>> >>>> >>>> >>>> ./\. >>>> >>>> >>>> >>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>> Here is the document I have started - the link puts you into "suggest" >>>> mode. Please add text with self-attribution. Be respectful of others' >>>> contributions. >>>> >>>> >>>> >>>> >>>> >>>> >>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>> >>>> >>>> >>>> >>>> [image: Ping Identity] >>>> >>>> >>>> *Andrew Hughes* >>>> Director - Identity Standards >>>> andrewhughes at pingidentity.com >>>> >>>> *Connect with us: * >>>> >>>> [image: Glassdoor logo] >>>> [image: >>>> LinkedIn logo] [image: twitter >>>> logo] >>>> [image: >>>> facebook logo] >>>> [image: >>>> youtube logo] >>>> [image: >>>> Blog logo] >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>> privileged material for the sole use of the intended recipient(s). Any >>>> review, use, distribution or disclosure by others is strictly prohibited. >>>> If you have received this communication in error, please notify the sender >>>> immediately by e-mail and delete the message and any file attachments from >>>> your computer. Thank you.*-- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> >>>> [image: This is Alexandre Babeanu's card. Their email is >>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>> >>>> >>>> >>>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>>> hereto, is for the sole use of the intended recipient(s) and may contain >>>> confidential and/or proprietary information. >>>> -- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>>> -- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>> >>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>> privileged material for the sole use of the intended recipient(s). Any >>> review, use, distribution or disclosure by others is strictly prohibited. >>> If you have received this communication in error, please notify the sender >>> immediately by e-mail and delete the message and any file attachments from >>> your computer. Thank you.*-- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >>> >> >> >> -- >> [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. >> Their phone number is +1 604 728 8130.] >> >> >> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >> hereto, is for the sole use of the intended recipient(s) and may contain >> confidential and/or proprietary information. >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> >> > > > -- > --- > David Brossard > http://www.linkedin.com/in/davidbrossard > http://twitter.com/davidjbrossard > > http://about.me/brossard > > --- > Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx > > Prenez vos pr?cautions sur Internet: > http://www.securite-informatique.gouv.fr/gp_rubrique34.html > > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -------------- next part -------------- An HTML attachment was scrubbed... URL: From david.brossard at gmail.com Tue Jun 27 15:39:47 2023 From: david.brossard at gmail.com (David Brossard) Date: Tue, 27 Jun 2023 08:39:47 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: We totally should! It is an oversight on my part because I am so policy biased. Sorry! On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar wrote: > Hi all! > > Any reason not to include Google Zanzibar-inspired AuthZ implementations > (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this > effort? > > Regards, > > Andres > > > On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < > policy-charter at lists.openid.net> wrote: > >> *This message originated outside your organization.* >> >> ------------------------------ >> >> I added notes and comments in the Google Doc >> . >> I think it is worth highlighting we're not after yet another standard >> . >> We want to: >> >> 1. increase interoperability between existing standards. In my mind, >> the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and IDQL. >> 1. interop from a policy management perspective >> 2. interop from a runtime request/response perspective >> 2. increase awareness of externalized authz so that software >> developers/owners/SaaS never rebuild their own >> 1. Be the OAuth/SAML of authZ >> 2. Define and propose standard authZ patterns >> 1. use cases >> 2. integration patterns >> >> >> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> Sounds good to me too. >>> Thanks, >>> >>> ./\. >>> >>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> Anyone else want to weigh in on this? >>>> >>>> I'm onboard with Pieter's suggestion that the attached document >>>> describes a deliverable of a larger work group - if so, I'd like to get >>>> closure on the description quickly >>>> >>>> I hope it's a simple and non-controversial deliverable... >>>> >>>> Andrew Hughes >>>> Director - Identity Standards >>>> andrewhughes at pingidentity.com >>>> Mobile/Signal: +1 250 888 9474 >>>> >>>> >>>> >>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> My perspective is that we should have one Work Group focused on >>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>> example has multiple deliverables) to start with. This way everyone >>>>> interested in the authorization topic has visibility into the different >>>>> work items and we get the benefit of wider participation and review. >>>>> >>>>> >>>>> >>>>> Agreed that something with Authorization in the name would make sense, >>>>> something like AuthZEN Framework (AuthoriZation ExchaNge Framework) or >>>>> AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>> Framework)?. >>>>> >>>>> >>>>> >>>>> *From:* policy-charter *On >>>>> Behalf Of *Allan Foster via policy-charter >>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>> *To:* Policy Charter Mail List >>>>> *Cc:* Allan Foster >>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>> draft document >>>>> >>>>> >>>>> >>>>> So, I wonder if we should do two different WGs, or one WG with two >>>>> different standards?. (At least, for now?) >>>>> >>>>> >>>>> >>>>> I am inclined to think the WG should be AuthZ something??. and have >>>>> two separate streams?. (or standards?) >>>>> >>>>> >>>>> >>>>> Thoughts >>>>> >>>>> >>>>> >>>>> Allan >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>> Thanks Andrew! >>>>> >>>>> Added a first comment in there... The season's open! >>>>> >>>>> >>>>> >>>>> ./\. >>>>> >>>>> >>>>> >>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>> Here is the document I have started - the link puts you into "suggest" >>>>> mode. Please add text with self-attribution. Be respectful of others' >>>>> contributions. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>> >>>>> >>>>> >>>>> >>>>> [image: Ping Identity] >>>>> >>>>> >>>>> *Andrew Hughes* >>>>> Director - Identity Standards >>>>> andrewhughes at pingidentity.com >>>>> >>>>> *Connect with us: * >>>>> >>>>> [image: Glassdoor logo] >>>>> [image: >>>>> LinkedIn logo] [image: >>>>> twitter logo] >>>>> [image: >>>>> facebook logo] >>>>> [image: >>>>> youtube logo] >>>>> [image: >>>>> Blog logo] >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>> privileged material for the sole use of the intended recipient(s). Any >>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>> If you have received this communication in error, please notify the sender >>>>> immediately by e-mail and delete the message and any file attachments from >>>>> your computer. Thank you.*-- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>> >>>>> >>>>> >>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>>>> hereto, is for the sole use of the intended recipient(s) and may contain >>>>> confidential and/or proprietary information. >>>>> -- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>>> -- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>> >>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>> privileged material for the sole use of the intended recipient(s). Any >>>> review, use, distribution or disclosure by others is strictly prohibited. >>>> If you have received this communication in error, please notify the sender >>>> immediately by e-mail and delete the message and any file attachments from >>>> your computer. Thank you.*-- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>> >>> >>> -- >>> [image: This is Alexandre Babeanu's card. Their email is >>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>> >>> >>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>> hereto, is for the sole use of the intended recipient(s) and may contain >>> confidential and/or proprietary information. >>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >>> >> >> >> -- >> --- >> David Brossard >> http://www.linkedin.com/in/davidbrossard >> http://twitter.com/davidjbrossard >> >> http://about.me/brossard >> >> --- >> Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx >> >> Prenez vos pr?cautions sur Internet: >> http://www.securite-informatique.gouv.fr/gp_rubrique34.html >> >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: From alex at 3edges.com Tue Jun 27 15:42:27 2023 From: alex at 3edges.com (Alex Babeanu) Date: Tue, 27 Jun 2023 08:42:27 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: Also, are we deciding to completely ignore NGAC? I think that should be considered as well, considering it's the latest standard for authorization out there... https://standards.incits.org/apps/group_public/project/details.php?project_id=2328 ./\. On Tue, Jun 27, 2023 at 8:40?AM David Brossard via policy-charter < policy-charter at lists.openid.net> wrote: > We totally should! It is an oversight on my part because I am so policy > biased. Sorry! > > On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar > wrote: > >> Hi all! >> >> Any reason not to include Google Zanzibar-inspired AuthZ implementations >> (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this >> effort? >> >> Regards, >> >> Andres >> >> >> On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> *This message originated outside your organization.* >>> >>> ------------------------------ >>> >>> I added notes and comments in the Google Doc >>> . >>> I think it is worth highlighting we're not after yet another standard >>> . >>> We want to: >>> >>> 1. increase interoperability between existing standards. In my mind, >>> the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and IDQL. >>> 1. interop from a policy management perspective >>> 2. interop from a runtime request/response perspective >>> 2. increase awareness of externalized authz so that software >>> developers/owners/SaaS never rebuild their own >>> 1. Be the OAuth/SAML of authZ >>> 2. Define and propose standard authZ patterns >>> 1. use cases >>> 2. integration patterns >>> >>> >>> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> Sounds good to me too. >>>> Thanks, >>>> >>>> ./\. >>>> >>>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> Anyone else want to weigh in on this? >>>>> >>>>> I'm onboard with Pieter's suggestion that the attached document >>>>> describes a deliverable of a larger work group - if so, I'd like to get >>>>> closure on the description quickly >>>>> >>>>> I hope it's a simple and non-controversial deliverable... >>>>> >>>>> Andrew Hughes >>>>> Director - Identity Standards >>>>> andrewhughes at pingidentity.com >>>>> Mobile/Signal: +1 250 888 9474 >>>>> >>>>> >>>>> >>>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>>> My perspective is that we should have one Work Group focused on >>>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>>> example has multiple deliverables) to start with. This way everyone >>>>>> interested in the authorization topic has visibility into the different >>>>>> work items and we get the benefit of wider participation and review. >>>>>> >>>>>> >>>>>> >>>>>> Agreed that something with Authorization in the name would make >>>>>> sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) >>>>>> or AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>>> Framework)?. >>>>>> >>>>>> >>>>>> >>>>>> *From:* policy-charter *On >>>>>> Behalf Of *Allan Foster via policy-charter >>>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>>> *To:* Policy Charter Mail List >>>>>> *Cc:* Allan Foster >>>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>>> draft document >>>>>> >>>>>> >>>>>> >>>>>> So, I wonder if we should do two different WGs, or one WG with two >>>>>> different standards?. (At least, for now?) >>>>>> >>>>>> >>>>>> >>>>>> I am inclined to think the WG should be AuthZ something??. and have >>>>>> two separate streams?. (or standards?) >>>>>> >>>>>> >>>>>> >>>>>> Thoughts >>>>>> >>>>>> >>>>>> >>>>>> Allan >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>> Thanks Andrew! >>>>>> >>>>>> Added a first comment in there... The season's open! >>>>>> >>>>>> >>>>>> >>>>>> ./\. >>>>>> >>>>>> >>>>>> >>>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>> Here is the document I have started - the link puts you into >>>>>> "suggest" mode. Please add text with self-attribution. Be respectful of >>>>>> others' contributions. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> [image: Ping Identity] >>>>>> >>>>>> >>>>>> *Andrew Hughes* >>>>>> Director - Identity Standards >>>>>> andrewhughes at pingidentity.com >>>>>> >>>>>> *Connect with us: * >>>>>> >>>>>> [image: Glassdoor logo] >>>>>> [image: >>>>>> LinkedIn logo] [image: >>>>>> twitter logo] >>>>>> [image: >>>>>> facebook logo] >>>>>> [image: >>>>>> youtube logo] >>>>>> [image: >>>>>> Blog logo] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>> If you have received this communication in error, please notify the sender >>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>> your computer. Thank you.*-- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> >>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>> >>>>>> >>>>>> >>>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any >>>>>> attachments hereto, is for the sole use of the intended recipient(s) and >>>>>> may contain confidential and/or proprietary information. >>>>>> -- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>>> -- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>> >>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>> privileged material for the sole use of the intended recipient(s). Any >>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>> If you have received this communication in error, please notify the sender >>>>> immediately by e-mail and delete the message and any file attachments from >>>>> your computer. Thank you.*-- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>> >>>> >>>> -- >>>> [image: This is Alexandre Babeanu's card. Their email is >>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>> >>>> >>>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>>> hereto, is for the sole use of the intended recipient(s) and may contain >>>> confidential and/or proprietary information. >>>> -- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>> >>> >>> -- >>> --- >>> David Brossard >>> http://www.linkedin.com/in/davidbrossard >>> http://twitter.com/davidjbrossard >>> >>> http://about.me/brossard >>> >>> --- >>> Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx >>> >>> Prenez vos pr?cautions sur Internet: >>> http://www.securite-informatique.gouv.fr/gp_rubrique34.html >>> >>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >> -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -- [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. Their phone number is +1 604 728 8130.] -- CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information. -------------- next part -------------- An HTML attachment was scrubbed... URL: From andrewhughes at pingidentity.com Tue Jun 27 15:53:10 2023 From: andrewhughes at pingidentity.com (Andrew Hughes) Date: Tue, 27 Jun 2023 08:53:10 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: C'mon everyone - we are almost at 14 specs! You can do it! only a few more to go before we need a 15th one! ;-) [Ref: xkcd comic # something] Andrew Hughes Director - Identity Standards andrewhughes at pingidentity.com Mobile/Signal: +1 250 888 9474 On Tue, Jun 27, 2023 at 8:42?AM Alex Babeanu via policy-charter < policy-charter at lists.openid.net> wrote: > Also, are we deciding to completely ignore NGAC? I think that should be > considered as well, considering it's the latest standard for authorization > out there... > > https://standards.incits.org/apps/group_public/project/details.php?project_id=2328 > > ./\. > > On Tue, Jun 27, 2023 at 8:40?AM David Brossard via policy-charter < > policy-charter at lists.openid.net> wrote: > >> We totally should! It is an oversight on my part because I am so policy >> biased. Sorry! >> >> On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar >> wrote: >> >>> Hi all! >>> >>> Any reason not to include Google Zanzibar-inspired AuthZ implementations >>> (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this >>> effort? >>> >>> Regards, >>> >>> Andres >>> >>> >>> On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> *This message originated outside your organization.* >>>> >>>> ------------------------------ >>>> >>>> I added notes and comments in the Google Doc >>>> . >>>> I think it is worth highlighting we're not after yet another standard >>>> . >>>> We want to: >>>> >>>> 1. increase interoperability between existing standards. In my >>>> mind, the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and >>>> IDQL. >>>> 1. interop from a policy management perspective >>>> 2. interop from a runtime request/response perspective >>>> 2. increase awareness of externalized authz so that software >>>> developers/owners/SaaS never rebuild their own >>>> 1. Be the OAuth/SAML of authZ >>>> 2. Define and propose standard authZ patterns >>>> 1. use cases >>>> 2. integration patterns >>>> >>>> >>>> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> Sounds good to me too. >>>>> Thanks, >>>>> >>>>> ./\. >>>>> >>>>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>>> Anyone else want to weigh in on this? >>>>>> >>>>>> I'm onboard with Pieter's suggestion that the attached document >>>>>> describes a deliverable of a larger work group - if so, I'd like to get >>>>>> closure on the description quickly >>>>>> >>>>>> I hope it's a simple and non-controversial deliverable... >>>>>> >>>>>> Andrew Hughes >>>>>> Director - Identity Standards >>>>>> andrewhughes at pingidentity.com >>>>>> Mobile/Signal: +1 250 888 9474 >>>>>> >>>>>> >>>>>> >>>>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>>> My perspective is that we should have one Work Group focused on >>>>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>>>> example has multiple deliverables) to start with. This way everyone >>>>>>> interested in the authorization topic has visibility into the different >>>>>>> work items and we get the benefit of wider participation and review. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Agreed that something with Authorization in the name would make >>>>>>> sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) >>>>>>> or AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>>>> Framework)?. >>>>>>> >>>>>>> >>>>>>> >>>>>>> *From:* policy-charter *On >>>>>>> Behalf Of *Allan Foster via policy-charter >>>>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>>>> *To:* Policy Charter Mail List >>>>>>> *Cc:* Allan Foster >>>>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>>>> draft document >>>>>>> >>>>>>> >>>>>>> >>>>>>> So, I wonder if we should do two different WGs, or one WG with two >>>>>>> different standards?. (At least, for now?) >>>>>>> >>>>>>> >>>>>>> >>>>>>> I am inclined to think the WG should be AuthZ something??. and >>>>>>> have two separate streams?. (or standards?) >>>>>>> >>>>>>> >>>>>>> >>>>>>> Thoughts >>>>>>> >>>>>>> >>>>>>> >>>>>>> Allan >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>> >>>>>>> Thanks Andrew! >>>>>>> >>>>>>> Added a first comment in there... The season's open! >>>>>>> >>>>>>> >>>>>>> >>>>>>> ./\. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>> >>>>>>> Here is the document I have started - the link puts you into >>>>>>> "suggest" mode. Please add text with self-attribution. Be respectful of >>>>>>> others' contributions. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> [image: Ping Identity] >>>>>>> >>>>>>> >>>>>>> *Andrew Hughes* >>>>>>> Director - Identity Standards >>>>>>> andrewhughes at pingidentity.com >>>>>>> >>>>>>> *Connect with us: * >>>>>>> >>>>>>> [image: Glassdoor logo] >>>>>>> [image: >>>>>>> LinkedIn logo] [image: >>>>>>> twitter logo] >>>>>>> [image: >>>>>>> facebook logo] >>>>>>> [image: >>>>>>> youtube logo] >>>>>>> [image: >>>>>>> Blog logo] >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>>> If you have received this communication in error, please notify the sender >>>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>>> your computer. Thank you.*-- >>>>>>> policy-charter mailing list >>>>>>> policy-charter at lists.openid.net >>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> >>>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>>> >>>>>>> >>>>>>> >>>>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any >>>>>>> attachments hereto, is for the sole use of the intended recipient(s) and >>>>>>> may contain confidential and/or proprietary information. >>>>>>> -- >>>>>>> policy-charter mailing list >>>>>>> policy-charter at lists.openid.net >>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> policy-charter mailing list >>>>>>> policy-charter at lists.openid.net >>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>> >>>>>>> >>>>>> >>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>> If you have received this communication in error, please notify the sender >>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>> your computer. Thank you.*-- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>> >>>>> >>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>>>> hereto, is for the sole use of the intended recipient(s) and may contain >>>>> confidential and/or proprietary information. >>>>> -- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>> >>>> >>>> -- >>>> --- >>>> David Brossard >>>> http://www.linkedin.com/in/davidbrossard >>>> http://twitter.com/davidjbrossard >>>> >>>> http://about.me/brossard >>>> >>>> --- >>>> Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx >>>> >>>> Prenez vos pr?cautions sur Internet: >>>> http://www.securite-informatique.gouv.fr/gp_rubrique34.html >>>> >>>> -- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > > > -- > [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. > Their phone number is +1 604 728 8130.] > > > CONFIDENTIALITY NOTICE: This e-mail message, including any attachments > hereto, is for the sole use of the intended recipient(s) and may contain > confidential and/or proprietary information. > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -- _CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.? If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._ -------------- next part -------------- An HTML attachment was scrubbed... URL: From sehutchinson at gmail.com Tue Jun 27 16:16:24 2023 From: sehutchinson at gmail.com (Steve Hutchinson) Date: Tue, 27 Jun 2023 12:16:24 -0400 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: I thought we were building the 15th one ;-) On Tue, Jun 27, 2023 at 11:53?AM Andrew Hughes via policy-charter < policy-charter at lists.openid.net> wrote: > C'mon everyone - we are almost at 14 specs! You can do it! only a few more > to go before we need a 15th one! > ;-) > > [Ref: xkcd comic # something] > > Andrew Hughes > Director - Identity Standards > andrewhughes at pingidentity.com > Mobile/Signal: +1 250 888 9474 > > > > On Tue, Jun 27, 2023 at 8:42?AM Alex Babeanu via policy-charter < > policy-charter at lists.openid.net> wrote: > >> Also, are we deciding to completely ignore NGAC? I think that should be >> considered as well, considering it's the latest standard for authorization >> out there... >> >> https://standards.incits.org/apps/group_public/project/details.php?project_id=2328 >> >> ./\. >> >> On Tue, Jun 27, 2023 at 8:40?AM David Brossard via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> We totally should! It is an oversight on my part because I am so policy >>> biased. Sorry! >>> >>> On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar >>> wrote: >>> >>>> Hi all! >>>> >>>> Any reason not to include Google Zanzibar-inspired AuthZ >>>> implementations (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the >>>> scope of this effort? >>>> >>>> Regards, >>>> >>>> Andres >>>> >>>> >>>> On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> *This message originated outside your organization.* >>>>> >>>>> ------------------------------ >>>>> >>>>> I added notes and comments in the Google Doc >>>>> . >>>>> I think it is worth highlighting we're not after yet another standard >>>>> . >>>>> We want to: >>>>> >>>>> 1. increase interoperability between existing standards. In my >>>>> mind, the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and >>>>> IDQL. >>>>> 1. interop from a policy management perspective >>>>> 2. interop from a runtime request/response perspective >>>>> 2. increase awareness of externalized authz so that software >>>>> developers/owners/SaaS never rebuild their own >>>>> 1. Be the OAuth/SAML of authZ >>>>> 2. Define and propose standard authZ patterns >>>>> 1. use cases >>>>> 2. integration patterns >>>>> >>>>> >>>>> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>>> Sounds good to me too. >>>>>> Thanks, >>>>>> >>>>>> ./\. >>>>>> >>>>>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>>> Anyone else want to weigh in on this? >>>>>>> >>>>>>> I'm onboard with Pieter's suggestion that the attached document >>>>>>> describes a deliverable of a larger work group - if so, I'd like to get >>>>>>> closure on the description quickly >>>>>>> >>>>>>> I hope it's a simple and non-controversial deliverable... >>>>>>> >>>>>>> Andrew Hughes >>>>>>> Director - Identity Standards >>>>>>> andrewhughes at pingidentity.com >>>>>>> Mobile/Signal: +1 250 888 9474 >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>> >>>>>>>> My perspective is that we should have one Work Group focused on >>>>>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>>>>> example has multiple deliverables) to start with. This way everyone >>>>>>>> interested in the authorization topic has visibility into the different >>>>>>>> work items and we get the benefit of wider participation and review. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Agreed that something with Authorization in the name would make >>>>>>>> sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) >>>>>>>> or AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>>>>> Framework)?. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *From:* policy-charter *On >>>>>>>> Behalf Of *Allan Foster via policy-charter >>>>>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>>>>> *To:* Policy Charter Mail List >>>>>>>> *Cc:* Allan Foster >>>>>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>>>>> draft document >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> So, I wonder if we should do two different WGs, or one WG with >>>>>>>> two different standards?. (At least, for now?) >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> I am inclined to think the WG should be AuthZ something??. and >>>>>>>> have two separate streams?. (or standards?) >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Thoughts >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Allan >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>>> >>>>>>>> Thanks Andrew! >>>>>>>> >>>>>>>> Added a first comment in there... The season's open! >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ./\. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>>> >>>>>>>> Here is the document I have started - the link puts you into >>>>>>>> "suggest" mode. Please add text with self-attribution. Be respectful of >>>>>>>> others' contributions. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> [image: Ping Identity] >>>>>>>> >>>>>>>> >>>>>>>> *Andrew Hughes* >>>>>>>> Director - Identity Standards >>>>>>>> andrewhughes at pingidentity.com >>>>>>>> >>>>>>>> *Connect with us: * >>>>>>>> >>>>>>>> [image: Glassdoor logo] >>>>>>>> [image: >>>>>>>> LinkedIn logo] [image: >>>>>>>> twitter logo] >>>>>>>> [image: >>>>>>>> facebook logo] >>>>>>>> [image: >>>>>>>> youtube logo] >>>>>>>> [image: >>>>>>>> Blog logo] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>>>> If you have received this communication in error, please notify the sender >>>>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>>>> your computer. Thank you.*-- >>>>>>>> policy-charter mailing list >>>>>>>> policy-charter at lists.openid.net >>>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> -- >>>>>>>> >>>>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any >>>>>>>> attachments hereto, is for the sole use of the intended recipient(s) and >>>>>>>> may contain confidential and/or proprietary information. >>>>>>>> -- >>>>>>>> policy-charter mailing list >>>>>>>> policy-charter at lists.openid.net >>>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>>> >>>>>>>> >>>>>>>> -- >>>>>>>> policy-charter mailing list >>>>>>>> policy-charter at lists.openid.net >>>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>>> If you have received this communication in error, please notify the sender >>>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>>> your computer. Thank you.*-- >>>>>>> policy-charter mailing list >>>>>>> policy-charter at lists.openid.net >>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>> >>>>>> >>>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any >>>>>> attachments hereto, is for the sole use of the intended recipient(s) and >>>>>> may contain confidential and/or proprietary information. >>>>>> -- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> --- >>>>> David Brossard >>>>> http://www.linkedin.com/in/davidbrossard >>>>> http://twitter.com/davidjbrossard >>>>> >>>>> http://about.me/brossard >>>>> >>>>> --- >>>>> Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx >>>>> >>>>> Prenez vos pr?cautions sur Internet: >>>>> http://www.securite-informatique.gouv.fr/gp_rubrique34.html >>>>> >>>>> -- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >> >> >> -- >> [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. >> Their phone number is +1 604 728 8130.] >> >> >> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >> hereto, is for the sole use of the intended recipient(s) and may contain >> confidential and/or proprietary information. >> -- >> policy-charter mailing list >> policy-charter at lists.openid.net >> https://lists.openid.net/mailman/listinfo/policy-charter >> > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited. > If you have received this communication in error, please notify the sender > immediately by e-mail and delete the message and any file attachments from > your computer. Thank you.*-- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -------------- next part -------------- An HTML attachment was scrubbed... URL: From pieter.kasselman at microsoft.com Tue Jun 27 18:43:41 2023 From: pieter.kasselman at microsoft.com (Pieter Kasselman) Date: Tue, 27 Jun 2023 18:43:41 +0000 Subject: [policy-charter] PEP-PDP Group In-Reply-To: References:

<6df4307c-f221-1068-3a3f-5c1672a9eaaf@umbrella.associates> <2a5c3d88-c433-453a-8085-c3e2834ea9c2@Canary> Message-ID: Hi David, the difference between the direct and indirect requests are interesting. The Direct request feels like a request for a decision while the indirect request feels like policy retrieval (with some parameters to scope retrieval of policies as it relate to Alice and claims). Can you describe the use cases for when the direct vs when the indirect approach is used? From: policy-charter On Behalf Of David Brossard via policy-charter Sent: Tuesday, June 27, 2023 4:17 PM To: Policy Charter Mail List Cc: David Brossard Subject: Re: [policy-charter] PEP-PDP Group I agree with Allan. There's another aspect to runtime authZ: it eliminates the need to define entitlements up front. It eliminates the need for role, permissions, and entitlements engineering, and consequently provisioning and de-provisioning. This makes me think another area of investigation for this WG is bridging the runtime authz world (XACML, OPA...) with the non-runtime authz world (OAuth scopes & claims, SCIM entitlements...) AuthZ frameworks should be capable of generating dynamic claims that are fed into a token. CAEP could be used to update/revoke/enrich such tokens. This means we need different ways to query a policy. And perhaps different ways to write policies. Let's assume a business authz policy: * Policy: Claims processors can approve a claim in their region if the amount claimed is less than the approver's limit. * Direct request: Can Alice approve claim #123? (in the background, attribute retrieval is run to figure out who Alice is and what claim 123's region and amount are) * Answer: Permit/Deny + obligations * Indirect request: tell me what Alice can do on claims * Answer: approve + claim amount < $500 + region = Moose Jaw. On Wed, Jun 14, 2023 at 8:15?AM Allan Foster via policy-charter > wrote: Alex, I am not sure I fully agree with your statement! Although you might not use a PEP to protect those resources, There is still a reasonable use case to treat the spec as the API and transport for those resources to call out to a centralized AuthZ server. I think there are at least two use cases for standardization (as we discussed at IDentiverse) 1. A standardized interface between PEPs or agents and the PDP. This would allow de-weaponization of agents, and interoperability at the agent level?. 2. A standardization athe policy level so that IF the PDP cannot be centralized, the interop would be at the Policy level. Enabling the Policy Management to be centralized. A SaaS might not be willing to call out to a central PDP for AuthZ (and all the performance problems that brings) but might well be willing to accept the Policy definition into its own AuthZ system I see these as complimentary. On another note, We want to ensure that whatever we do at the PEP/PDP level, we allow for real time decisions. AuthZ decisions are not necessarily entitlements, and the decision may well depend on environmental issues at the time of the request. Allan On Tuesday, Jun 13, 2023 at 11:45, Alex Babeanu > wrote: This is a good discussion, that said a PEP is actually not mandated in all cases. For example you would not use a PEP to secure GraphQL APIs nor COTS software. I'm going to share soon a doc, to all contribute on, that lists common authorization design patterns. I think it would be a good basis for discussion, and at least to scope what we're trying to do... Thanks, ./\lex. On Tue, Jun 13, 2023 at 11:30?AM Allan Foster via policy-charter > wrote: So I am thinking we also want to set some scope of what we want to cover? Off the top of my head?. I can put some more context around these if they aren?t clear The Transport layer The Envelope Layer The request/response transaction layer How meta-data is handled? (both request and response) Extension mechanisms Exception mechanism Allan From: policy-charter > on behalf of Omri Gazitt via policy-charter > Date: Tuesday, June 13, 2023 at 10:54 To: Policy Charter Mail List > Cc: Omri Gazitt > Subject: Re: [policy-charter] PEP-PDP Group I agree with David that looking at existing systems is a good place to start. If the idea is that PDPs can add a "standard" API that PEPs can call, then it would be good if the API supports the existing message exchange patterns (and doesn't mandate things that aren't supported). Here are three examples, to get us started: * OPA is interesting in the sense that its primary REST API is very document-oriented - you have a set of rules that are defined in a JSON-style hierarchy and you issue a GET or POST on that resource in the hierarchy to evaluate the rule that is rooted there. This seems like a special case. OPA does have a generic query API, which allows you to pass input and evaluate a rego query based on the loaded policy document and the input. * Auth0 FGA (one of the zanzibar implementations) has a check API that takes a JSON payload containing a user key, relation name, and object key, and returns an allowed decision (true or false). Most zanzibar implementations seem to do something similar - e.g. SpiceDB has a check API that takes a resource, permission, and subject. * Topaz (Aserto's OSS authorizer) has a query API that takes an identity and policy (rule/decisions to evaluate), and optionally a resource context and additional input, and returns what OPA would return. It also has a simpler is API that evaluates a policy (rule/decisions) with an identity and resource context. On Tue, Jun 13, 2023 at 1:54?AM Roland Baum via policy-charter > wrote: I'm in as well :-D Roland Baum umbrella.associates GmbH -- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter -- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter -- [This is Alexandre Babeanu's card. Their email is alex at 3edges.com. Their phone number is +1 604 728 8130.] CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information. -- policy-charter mailing list policy-charter at lists.openid.net https://lists.openid.net/mailman/listinfo/policy-charter -- --- David Brossard http://www.linkedin.com/in/davidbrossard http://twitter.com/davidjbrossard http://about.me/brossard --- Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx Prenez vos pr?cautions sur Internet: http://www.securite-informatique.gouv.fr/gp_rubrique34.html -------------- next part -------------- An HTML attachment was scrubbed... URL: From atul at sgnl.ai Tue Jun 27 23:37:58 2023 From: atul at sgnl.ai (Atul Tulshibagwale) Date: Tue, 27 Jun 2023 16:37:58 -0700 Subject: [policy-charter] Authorization API Proposal Message-ID: Hi all, Here's a proposal of an Authorization API that we would like to contribute to this group (in its current form or if / when we find a home in a standards body). This is similar to at least a few vendors' current offerings, so I hope everyone finds this helpful, and we can accelerate our standardization efforts as a result. You can read the proposal in HTML format here: https://sgnl-ai.github.io/authzapi/ The sources (under the MIT License) are here: https://github.com/SGNL-ai/authzapi - Atul Tulshibagwale, Erik Gustavson and Marc Jordan -- Atul Tulshibagwale CTO -------------- next part -------------- An HTML attachment was scrubbed... URL: From omri at aserto.com Wed Jun 28 01:57:31 2023 From: omri at aserto.com (Omri Gazitt) Date: Tue, 27 Jun 2023 18:57:31 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: Cool - and I completely agree that the scope ought to include systems that support a relationship (and/or graph) model. So perhaps more horsemen :) Is there a new charter document that includes this as a requirement? On Tue, Jun 27, 2023 at 8:40?AM David Brossard via policy-charter < policy-charter at lists.openid.net> wrote: > We totally should! It is an oversight on my part because I am so policy > biased. Sorry! > > On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar > wrote: > >> Hi all! >> >> Any reason not to include Google Zanzibar-inspired AuthZ implementations >> (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this >> effort? >> >> Regards, >> >> Andres >> >> >> On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < >> policy-charter at lists.openid.net> wrote: >> >>> *This message originated outside your organization.* >>> >>> ------------------------------ >>> >>> I added notes and comments in the Google Doc >>> . >>> I think it is worth highlighting we're not after yet another standard >>> . >>> We want to: >>> >>> 1. increase interoperability between existing standards. In my mind, >>> the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and IDQL. >>> 1. interop from a policy management perspective >>> 2. interop from a runtime request/response perspective >>> 2. increase awareness of externalized authz so that software >>> developers/owners/SaaS never rebuild their own >>> 1. Be the OAuth/SAML of authZ >>> 2. Define and propose standard authZ patterns >>> 1. use cases >>> 2. integration patterns >>> >>> >>> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> Sounds good to me too. >>>> Thanks, >>>> >>>> ./\. >>>> >>>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> Anyone else want to weigh in on this? >>>>> >>>>> I'm onboard with Pieter's suggestion that the attached document >>>>> describes a deliverable of a larger work group - if so, I'd like to get >>>>> closure on the description quickly >>>>> >>>>> I hope it's a simple and non-controversial deliverable... >>>>> >>>>> Andrew Hughes >>>>> Director - Identity Standards >>>>> andrewhughes at pingidentity.com >>>>> Mobile/Signal: +1 250 888 9474 >>>>> >>>>> >>>>> >>>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>>> My perspective is that we should have one Work Group focused on >>>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>>> example has multiple deliverables) to start with. This way everyone >>>>>> interested in the authorization topic has visibility into the different >>>>>> work items and we get the benefit of wider participation and review. >>>>>> >>>>>> >>>>>> >>>>>> Agreed that something with Authorization in the name would make >>>>>> sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) >>>>>> or AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>>> Framework)?. >>>>>> >>>>>> >>>>>> >>>>>> *From:* policy-charter *On >>>>>> Behalf Of *Allan Foster via policy-charter >>>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>>> *To:* Policy Charter Mail List >>>>>> *Cc:* Allan Foster >>>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>>> draft document >>>>>> >>>>>> >>>>>> >>>>>> So, I wonder if we should do two different WGs, or one WG with two >>>>>> different standards?. (At least, for now?) >>>>>> >>>>>> >>>>>> >>>>>> I am inclined to think the WG should be AuthZ something??. and have >>>>>> two separate streams?. (or standards?) >>>>>> >>>>>> >>>>>> >>>>>> Thoughts >>>>>> >>>>>> >>>>>> >>>>>> Allan >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>> Thanks Andrew! >>>>>> >>>>>> Added a first comment in there... The season's open! >>>>>> >>>>>> >>>>>> >>>>>> ./\. >>>>>> >>>>>> >>>>>> >>>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>> Here is the document I have started - the link puts you into >>>>>> "suggest" mode. Please add text with self-attribution. Be respectful of >>>>>> others' contributions. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> [image: Ping Identity] >>>>>> >>>>>> >>>>>> *Andrew Hughes* >>>>>> Director - Identity Standards >>>>>> andrewhughes at pingidentity.com >>>>>> >>>>>> *Connect with us: * >>>>>> >>>>>> [image: Glassdoor logo] >>>>>> [image: >>>>>> LinkedIn logo] [image: >>>>>> twitter logo] >>>>>> [image: >>>>>> facebook logo] >>>>>> [image: >>>>>> youtube logo] >>>>>> [image: >>>>>> Blog logo] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>> If you have received this communication in error, please notify the sender >>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>> your computer. Thank you.*-- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> >>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>> >>>>>> >>>>>> >>>>>> CONFIDENTIALITY NOTICE: This e-mail message, including any >>>>>> attachments hereto, is for the sole use of the intended recipient(s) and >>>>>> may contain confidential and/or proprietary information. >>>>>> -- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>>> -- >>>>>> policy-charter mailing list >>>>>> policy-charter at lists.openid.net >>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>> >>>>>> >>>>> >>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>> privileged material for the sole use of the intended recipient(s). Any >>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>> If you have received this communication in error, please notify the sender >>>>> immediately by e-mail and delete the message and any file attachments from >>>>> your computer. Thank you.*-- >>>>> policy-charter mailing list >>>>> policy-charter at lists.openid.net >>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>> >>>>> >>>> >>>> >>>> -- >>>> [image: This is Alexandre Babeanu's card. Their email is >>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>> >>>> >>>> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments >>>> hereto, is for the sole use of the intended recipient(s) and may contain >>>> confidential and/or proprietary information. >>>> -- >>>> policy-charter mailing list >>>> policy-charter at lists.openid.net >>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>> >>>> >>> >>> >>> -- >>> --- >>> David Brossard >>> http://www.linkedin.com/in/davidbrossard >>> http://twitter.com/davidjbrossard >>> >>> http://about.me/brossard >>> >>> --- >>> Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx >>> >>> Prenez vos pr?cautions sur Internet: >>> http://www.securite-informatique.gouv.fr/gp_rubrique34.html >>> >>> -- >>> policy-charter mailing list >>> policy-charter at lists.openid.net >>> https://lists.openid.net/mailman/listinfo/policy-charter >>> >> -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -------------- next part -------------- An HTML attachment was scrubbed... URL: From omri at aserto.com Wed Jun 28 02:07:34 2023 From: omri at aserto.com (Omri Gazitt) Date: Tue, 27 Jun 2023 19:07:34 -0700 Subject: [policy-charter] PEP-PDP Group In-Reply-To: References:

<6df4307c-f221-1068-3a3f-5c1672a9eaaf@umbrella.associates> <2a5c3d88-c433-453a-8085-c3e2834ea9c2@Canary> Message-ID: In my experience, what you call "direct request" is used for making authorization decisions which are fully specified (subject, action/relationship/permission, object). An "indirect request" can be used to filter results, which is a very adjacent scenario to authorization. - In OPA, this can be accomplished by issuing a partial query and parsing the resulting AST to construct a restriction clause for the resource/data service (e.g. a SQL WHERE clause) - In Zanzibar-inspired systems, this can be accomplished by using an "expand" API to return all the objects of a certain type which have a relationship to the subject, which (again) can be used as a restriction clause Atul's document covers both scenarios (evaluation API and search API). On Tue, Jun 27, 2023 at 11:43?AM Pieter Kasselman via policy-charter < policy-charter at lists.openid.net> wrote: > Hi David, the difference between the direct and indirect requests are > interesting. The Direct request feels like a request for a decision while > the indirect request feels like policy retrieval (with some parameters to > scope retrieval of policies as it relate to Alice and claims). Can you > describe the use cases for when the direct vs when the indirect approach is > used? > > > > *From:* policy-charter *On > Behalf Of *David Brossard via policy-charter > *Sent:* Tuesday, June 27, 2023 4:17 PM > *To:* Policy Charter Mail List > *Cc:* David Brossard > *Subject:* Re: [policy-charter] PEP-PDP Group > > > > I agree with Allan. There's another aspect to runtime authZ: it eliminates > the need to define entitlements up front. It eliminates the need for role, > permissions, and entitlements engineering, and consequently provisioning > and de-provisioning. > > > > This makes me think another area of investigation for this WG is bridging > the runtime authz world (XACML, OPA...) with the non-runtime authz world > (OAuth scopes & claims, SCIM entitlements...) AuthZ frameworks should be > capable of generating dynamic claims that are fed into a token. CAEP could > be used to update/revoke/enrich such tokens. > > > > This means we need different ways to query a policy. And perhaps different > ways to write policies. Let's assume a business authz policy: > > > > - *Policy*: Claims processors can approve a claim in their region if > the amount claimed is less than the approver's limit. > - *Direct request*: Can Alice approve claim #123? (in the background, > attribute retrieval is run to figure out who Alice is and what claim 123's > region and amount are) > > > - Answer: Permit/Deny + obligations > > > - *Indirect request*: tell me what Alice can do on claims > > > - Answer: approve + claim amount < $500 + region = Moose Jaw. > > > > > > On Wed, Jun 14, 2023 at 8:15?AM Allan Foster via policy-charter < > policy-charter at lists.openid.net> wrote: > > > > Alex, I am not sure I fully agree with your statement! > > > > Although you might not use a PEP to protect those resources, There is > still a reasonable use case to treat the spec as the API and transport for > those resources to call out to a centralized AuthZ server. > > > > I think there are at least two use cases for standardization (as we > discussed at IDentiverse) > > > > 1. A standardized interface between PEPs or agents and the PDP. This > would allow de-weaponization of agents, and interoperability at the agent > level?. > > 2. A standardization athe policy level so that IF the PDP cannot be > centralized, the interop would be at the Policy level. Enabling the Policy > Management to be centralized. > > > > A SaaS might not be willing to call out to a central PDP for AuthZ (and > all the performance problems that brings) but might well be willing to > accept the Policy definition into its own AuthZ system > > > > I see these as complimentary. > > > > On another note, We want to ensure that whatever we do at the PEP/PDP > level, we allow for real time decisions. AuthZ decisions are not > necessarily entitlements, and the decision may well depend on environmental > issues at the time of the request. > > > > Allan > > > > > > > > On Tuesday, Jun 13, 2023 at 11:45, Alex Babeanu wrote: > > This is a good discussion, that said a PEP is actually *not* mandated in > all cases. For example you would *not* use a PEP to secure GraphQL APIs > nor COTS software. > > I'm going to share soon a doc, to all contribute on, that lists common > authorization design patterns. I think it would be a good basis for > discussion, and at least to scope what we're trying to do... > > > > Thanks, > > ./\lex. > > > > On Tue, Jun 13, 2023 at 11:30?AM Allan Foster via policy-charter < > policy-charter at lists.openid.net> wrote: > > So I am thinking we also want to set some scope of what we want to cover? > > > > Off the top of my head?. I can put some more context around these if > they aren?t clear > > > > The Transport layer > > The Envelope Layer > > The request/response transaction layer > > How meta-data is handled? (both request and response) > > Extension mechanisms > > Exception mechanism > > > > Allan > > > > > > > > *From: *policy-charter on > behalf of Omri Gazitt via policy-charter > *Date: *Tuesday, June 13, 2023 at 10:54 > *To: *Policy Charter Mail List > *Cc: *Omri Gazitt > *Subject: *Re: [policy-charter] PEP-PDP Group > > I agree with David that looking at existing systems is a good place to > start. If the idea is that PDPs can add a "standard" API that PEPs can > call, then it would be good if the API supports the existing message > exchange patterns (and doesn't mandate things that aren't supported). > > > > Here are three examples, to get us started: > > - OPA is interesting in the sense that its primary REST API is very > document-oriented - you have a set of rules that are defined in a > JSON-style hierarchy and you issue a GET or POST on that resource in the > hierarchy to evaluate the rule that is rooted there. This seems like a > special case. OPA does have a generic query > > API, which allows you to pass input and evaluate a rego query based on the > loaded policy document and the input. > - Auth0 FGA (one of the zanzibar implementations) has a check > API > that takes a JSON payload containing a user key, relation name, and object > key, and returns an allowed decision (true or false). Most zanzibar > implementations seem to do something similar - e.g. SpiceDB has a check > > API that takes a resource, permission, and subject. > - Topaz (Aserto's OSS authorizer) has a query > API that takes > an identity and policy (rule/decisions to evaluate), and optionally a > resource context and additional input, and returns what OPA would return. > It also has a simpler is > API that evaluates > a policy (rule/decisions) with an identity and resource context. > > > > > > On Tue, Jun 13, 2023 at 1:54?AM Roland Baum via policy-charter < > policy-charter at lists.openid.net> wrote: > > I'm in as well :-D > > > > Roland Baum > umbrella.associates GmbH > > > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > > > > > -- > > [image: This is Alexandre Babeanu's card. Their email is alex at 3edges.com. > Their phone number is +1 604 728 8130.] > > > > CONFIDENTIALITY NOTICE: This e-mail message, including any attachments > hereto, is for the sole use of the intended recipient(s) and may contain > confidential and/or proprietary information. > > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > > > > > -- > > --- > David Brossard > http://www.linkedin.com/in/davidbrossard > http://twitter.com/davidjbrossard > http://about.me/brossard > --- > Stay safe on the Internet: http://www.ic3.gov/preventiontips.aspx > Prenez vos pr?cautions sur Internet: > http://www.securite-informatique.gouv.fr/gp_rubrique34.html > -- > policy-charter mailing list > policy-charter at lists.openid.net > https://lists.openid.net/mailman/listinfo/policy-charter > -------------- next part -------------- An HTML attachment was scrubbed... URL: From andrewhughes at pingidentity.com Wed Jun 28 02:46:39 2023 From: andrewhughes at pingidentity.com (Andrew Hughes) Date: Tue, 27 Jun 2023 19:46:39 -0700 Subject: [policy-charter] Link to PDP-PEP Interop WG Charter draft document In-Reply-To: References:

<50843d0b-b16c-4e40-abe0-a03c2c1f81c9@Canary>

Message-ID: Add your comments to the existing document if it?s for the pep PDP deliverable On Tue, Jun 27, 2023 at 6:57 PM Omri Gazitt via policy-charter < policy-charter at lists.openid.net> wrote: > Cool - and I completely agree that the scope ought to include systems that > support a relationship (and/or graph) model. > > So perhaps more horsemen :) > > Is there a new charter document that includes this as a requirement? > > On Tue, Jun 27, 2023 at 8:40?AM David Brossard via policy-charter < > policy-charter at lists.openid.net> wrote: > >> We totally should! It is an oversight on my part because I am so policy >> biased. Sorry! >> >> On Tue, Jun 27, 2023, 8:25 AM Andres Aguiar >> wrote: >> >>> Hi all! >>> >>> Any reason not to include Google Zanzibar-inspired AuthZ implementations >>> (e.g. OpenFGA, Topaz, SpiceDB, Permify, etc) as part of the scope of this >>> effort? >>> >>> Regards, >>> >>> Andres >>> >>> >>> On Tue, Jun 27, 2023 at 12:09?PM David Brossard via policy-charter < >>> policy-charter at lists.openid.net> wrote: >>> >>>> *This message originated outside your organization.* >>>> >>>> ------------------------------ >>>> >>>> I added notes and comments in the Google Doc >>>> . >>>> I think it is worth highlighting we're not after yet another standard >>>> . >>>> We want to: >>>> >>>> 1. increase interoperability between existing standards. In my >>>> mind, the four horsemen of the ap-authz-calypse are ALFA, Cedar, OPA, and >>>> IDQL. >>>> 1. interop from a policy management perspective >>>> 2. interop from a runtime request/response perspective >>>> 2. increase awareness of externalized authz so that software >>>> developers/owners/SaaS never rebuild their own >>>> 1. Be the OAuth/SAML of authZ >>>> 2. Define and propose standard authZ patterns >>>> 1. use cases >>>> 2. integration patterns >>>> >>>> >>>> On Mon, Jun 26, 2023 at 8:42?AM Alex Babeanu via policy-charter < >>>> policy-charter at lists.openid.net> wrote: >>>> >>>>> Sounds good to me too. >>>>> Thanks, >>>>> >>>>> ./\. >>>>> >>>>> On Fri, Jun 23, 2023 at 10:00?AM Andrew Hughes via policy-charter < >>>>> policy-charter at lists.openid.net> wrote: >>>>> >>>>>> Anyone else want to weigh in on this? >>>>>> >>>>>> I'm onboard with Pieter's suggestion that the attached document >>>>>> describes a deliverable of a larger work group - if so, I'd like to get >>>>>> closure on the description quickly >>>>>> >>>>>> I hope it's a simple and non-controversial deliverable... >>>>>> >>>>>> Andrew Hughes >>>>>> Director - Identity Standards >>>>>> andrewhughes at pingidentity.com >>>>>> Mobile/Signal: +1 250 888 9474 >>>>>> >>>>>> >>>>>> >>>>>> On Mon, Jun 19, 2023 at 4:30?AM Pieter Kasselman via policy-charter < >>>>>> policy-charter at lists.openid.net> wrote: >>>>>> >>>>>>> My perspective is that we should have one Work Group focused on >>>>>>> authorization with multiple deliverables (e.g. OpenID Connect and SSF for >>>>>>> example has multiple deliverables) to start with. This way everyone >>>>>>> interested in the authorization topic has visibility into the different >>>>>>> work items and we get the benefit of wider participation and review. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Agreed that something with Authorization in the name would make >>>>>>> sense, something like AuthZEN Framework (AuthoriZation ExchaNge Framework) >>>>>>> or AuthIT/AuthZIT Framework (Authorization Interoperability Technology >>>>>>> Framework)?. >>>>>>> >>>>>>> >>>>>>> >>>>>>> *From:* policy-charter *On >>>>>>> Behalf Of *Allan Foster via policy-charter >>>>>>> *Sent:* Friday, June 16, 2023 10:46 PM >>>>>>> *To:* Policy Charter Mail List >>>>>>> *Cc:* Allan Foster >>>>>>> *Subject:* Re: [policy-charter] Link to PDP-PEP Interop WG Charter >>>>>>> draft document >>>>>>> >>>>>>> >>>>>>> >>>>>>> So, I wonder if we should do two different WGs, or one WG with two >>>>>>> different standards?. (At least, for now?) >>>>>>> >>>>>>> >>>>>>> >>>>>>> I am inclined to think the WG should be AuthZ something??. and >>>>>>> have two separate streams?. (or standards?) >>>>>>> >>>>>>> >>>>>>> >>>>>>> Thoughts >>>>>>> >>>>>>> >>>>>>> >>>>>>> Allan >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Friday, Jun 16, 2023 at 14:02, Alex Babeanu via policy-charter < >>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>> >>>>>>> Thanks Andrew! >>>>>>> >>>>>>> Added a first comment in there... The season's open! >>>>>>> >>>>>>> >>>>>>> >>>>>>> ./\. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Fri, Jun 16, 2023 at 11:50?AM Andrew Hughes via policy-charter < >>>>>>> policy-charter at lists.openid.net> wrote: >>>>>>> >>>>>>> Here is the document I have started - the link puts you into >>>>>>> "suggest" mode. Please add text with self-attribution. Be respectful of >>>>>>> others' contributions. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> https://docs.google.com/document/d/1ijAaymAapYyeV_3qMVjuLtNzoskKsh7R/edit?usp=sharing&ouid=110252403279221684258&rtpof=true&sd=true >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> [image: Ping Identity] >>>>>>> >>>>>>> >>>>>>> *Andrew Hughes* >>>>>>> Director - Identity Standards >>>>>>> andrewhughes at pingidentity.com >>>>>>> >>>>>>> *Connect with us: * >>>>>>> >>>>>>> [image: Glassdoor logo] >>>>>>> [image: >>>>>>> LinkedIn logo] [image: >>>>>>> twitter logo] >>>>>>> [image: >>>>>>> facebook logo] >>>>>>> [image: >>>>>>> youtube logo] >>>>>>> [image: >>>>>>> Blog logo] >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>>>> privileged material for the sole use of the intended recipient(s). Any >>>>>>> review, use, distribution or disclosure by others is strictly prohibited. >>>>>>> If you have received this communication in error, please notify the sender >>>>>>> immediately by e-mail and delete the message and any file attachments from >>>>>>> your computer. Thank you.*-- >>>>>>> policy-charter mailing list >>>>>>> policy-charter at lists.openid.net >>>>>>> https://lists.openid.net/mailman/listinfo/policy-charter >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> >>>>>>> [image: This is Alexandre Babeanu's card. Their email is >>>>>>> alex at 3edges.com. Their phone number is +1 604 728 8130.] >>>>>>>