<div dir="ltr">It's on another thread on policy-charter<div><br></div><div><a href="https://sgnl-ai.github.io/authzapi/" target="_blank">https://sgnl-ai.github.io/authzapi/</a><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 27, 2023 at 10:04 PM David Brossard <<a href="mailto:david.brossard@gmail.com">david.brossard@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Omri's email is pretty much on point. Here's my experience.</div><div><br></div>At Axiomatics, we realized over time that authorization could be grouped into (at least) 3 buckets:<div><ul><li>functional: can a given user print (as a whole)? This is useful when building UIs, basic entitlements, or possibly even claims inside a token</li><li>transactional: can a given user do a given action on a given item? E.g. can Alice view transaction #123?</li><li>data-centric: this one is a variant of the transactional case but at scale. Essentially, which transactions can Alice view? You want to address this type of question for data filtering.</li></ul><div>The XACML core spec doesn't address the latter type which is why we came up with partial evaluation and an API called "reverse query". It's identical in spirit to what Omri states OPA contains. I'm guessing it's also similar to the "expand API" in Zanzibar.</div><div><br></div><div>And then you realize reverse querying/partial evaluation is not just about data filtering. It can be for testing, access review, policy reports, gap analyses... You can ask broader to narrower questions e.g.</div><div><ul><li>What can happen?</li><li>What can Alice do?</li><li>What can Alice view?</li><li>What can Alice view in the sales department on a Monday?</li></ul><div>You get the point.</div></div><div><br></div><div>I think we need to document this type of API because it's fundamental to being able to deploy a successful authorization framework. While the traditional permit/deny API is easy to understand and implement, it's not enough to address filtering, access reviews, etc...</div><div><br></div><div>Additionally, there are 2 types of policies we may want to consider:</div></div><div><ul><li>business policies: they reflect exactly what you want to do e.g. "managers can edit documents in their department if the status is draft". This is the sort of policy XACML/ALFA were born to tackle.</li><li>entitlements policies: they are here to grant entitlements to users e.g. "managers in the sales department can have the claim editDoc". Those are not my cup of tea and should only be written when you're dealing with a system that cannot handle the richness of ABAC policies</li></ul><div><a class="gmail_plusreply" id="m_-5470085780224843278plusReplyChip-3" href="mailto:omri@aserto.com" target="_blank">@Omri Gazitt</a> , can you share a link to <a class="gmail_plusreply" id="m_-5470085780224843278plusReplyChip-4" href="mailto:atul@sgnl.ai" target="_blank">@Atul Tulshibagwale</a>'s document? Thanks!</div></div><div><br></div><div>David</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 27, 2023 at 11:43 AM Pieter Kasselman <<a href="mailto:pieter.kasselman@microsoft.com" target="_blank">pieter.kasselman@microsoft.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<div lang="EN-IE">
<div>
<p class="MsoNormal"><span>Hi David, the difference between the direct and indirect requests are interesting. The Direct request feels like a request for a decision while the indirect request feels like policy retrieval (with
some parameters to scope retrieval of policies as it relate to Alice and claims). Can you describe the use cases for when the direct vs when the indirect approach is used?<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> policy-charter <<a href="mailto:policy-charter-bounces@lists.openid.net" target="_blank">policy-charter-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>David Brossard via policy-charter<br>
<b>Sent:</b> Tuesday, June 27, 2023 4:17 PM<br>
<b>To:</b> Policy Charter Mail List <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>><br>
<b>Cc:</b> David Brossard <<a href="mailto:david.brossard@gmail.com" target="_blank">david.brossard@gmail.com</a>><br>
<b>Subject:</b> Re: [policy-charter] PEP-PDP Group<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I agree with Allan. There's another aspect to runtime authZ: it eliminates the need to define entitlements up front. It eliminates the need for role, permissions, and entitlements engineering, and consequently provisioning and de-provisioning.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This makes me think another area of investigation for this WG is bridging the runtime authz world (XACML, OPA...) with the non-runtime authz world (OAuth scopes & claims, SCIM entitlements...) AuthZ frameworks should be capable of generating
dynamic claims that are fed into a token. CAEP could be used to update/revoke/enrich such tokens.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This means we need different ways to query a policy. And perhaps different ways to write policies. Let's assume a business authz policy:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<ul type="disc">
<li class="MsoNormal">
<b><span style="color:black;background:rgb(255,229,153)">Policy</span></b>: Claims processors can approve a claim in their region if the amount claimed is less than the approver's limit.<u></u><u></u></li><li class="MsoNormal">
<b><span style="color:black;background:rgb(255,229,153)">Direct request</span></b>: Can Alice approve claim #123? (in the background, attribute retrieval is run to figure out who Alice is and what claim 123's region and amount are)<u></u><u></u></li></ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">
Answer: Permit/Deny + obligations<u></u><u></u></li></ul>
</ul>
<ul type="disc">
<li class="MsoNormal">
<b><span style="color:black;background:rgb(255,229,153)">Indirect request</span></b>: tell me what Alice can do on claims<u></u><u></u></li></ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal">
Answer: approve + claim amount < $500 + region = Moose Jaw.<u></u><u></u></li></ul>
</ul>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jun 14, 2023 at 8:15 AM Allan Foster via policy-charter <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><img border="0" width="1" height="1" style="width: 0.0104in; height: 0.0104in;" id="m_-5470085780224843278m_-392978669304514450_x0000_i1026" src="https://receipts.canarymail.io/track/AE980BFE3A76DE71B7ADC1325DB56676_AD07948957141DF08A5D6A4ADB81455C.png"></span><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div id="m_-5470085780224843278m_-392978669304514450m_-414447914740678160CanaryBody">
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">Alex, I am not sure I fully agree with your statement!<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">Although you might not use a PEP to protect those resources, There is still a reasonable use case to treat the spec as the API and transport for those resources
to call out to a centralized AuthZ server.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">I think there are at least two use cases for standardization (as we discussed at IDentiverse)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">1. A standardized interface between PEPs or agents and the PDP. This would allow de-weaponization of agents, and interoperability at the agent level…. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">2. A standardization athe policy level so that IF the PDP cannot be centralized, the interop would be at the Policy level. Enabling the Policy Management to
be centralized. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">A SaaS might not be willing to call out to a central PDP for AuthZ (and all the performance problems that brings) but might well be willing to accept the Policy
definition into its own AuthZ system<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">I see these as complimentary.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">On another note, We want to ensure that whatever we do at the PEP/PDP level, we allow for real time decisions. AuthZ decisions are not necessarily entitlements,
and the decision may well depend on environmental issues at the time of the request. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">Allan<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
</div>
<div id="m_-5470085780224843278m_-392978669304514450m_-414447914740678160CanarySig">
<div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
</div>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt" id="m_-5470085780224843278m_-392978669304514450m_-414447914740678160CanaryBlockquote">
<div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">On Tuesday, Jun 13, 2023 at 11:45, Alex Babeanu <<a href="mailto:alex@3edges.com" target="_blank">alex@3edges.com</a>> wrote:<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">This is a good discussion, that said a PEP is actually
<b>not</b> mandated in all cases. For example you would <b>not</b> use a PEP to secure GraphQL APIs nor COTS software.<br>
<br>
I'm going to share soon a doc, to all contribute on, that lists common authorization design patterns. I think it would be a good basis for discussion, and at least to scope what we're trying to do...<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">Thanks,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">./\lex.<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">On Tue, Jun 13, 2023 at 11:30 AM Allan Foster via policy-charter <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>>
wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">So I am thinking we also want to set some scope of what we want to cover?
</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">Off the top of my head…. I can put some more context around these if they aren’t clear</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">The Transport layer</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">The Envelope Layer</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">The request/response transaction layer</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">How meta-data is handled? (both request and response)</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">Extension mechanisms</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">Exception mechanism</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">Allan</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span lang="EN-US" style="font-size:12pt;font-family:Helvetica,sans-serif;color:black">From:
</span></b><span lang="EN-US" style="font-size:12pt;font-family:Helvetica,sans-serif;color:black">policy-charter <<a href="mailto:policy-charter-bounces@lists.openid.net" target="_blank">policy-charter-bounces@lists.openid.net</a>> on behalf of Omri Gazitt
via policy-charter <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>><br>
<b>Date: </b>Tuesday, June 13, 2023 at 10:54<br>
<b>To: </b>Policy Charter Mail List <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>><br>
<b>Cc: </b>Omri Gazitt <<a href="mailto:omri@aserto.com" target="_blank">omri@aserto.com</a>><br>
<b>Subject: </b>Re: [policy-charter] PEP-PDP Group</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">I agree with David that looking at existing systems is a good place to start. If the idea is that PDPs
can add a "standard" API that PEPs can call, then it would be good if the API supports the existing message exchange patterns (and doesn't mandate things that aren't supported).</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">Here are three examples, to get us started:</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div>
<ul type="disc">
<li class="MsoNormal" style="color:black">
<span lang="EN-US" style="font-family:Helvetica,sans-serif">OPA is interesting in the sense that its primary REST API is very document-oriented - you have a set of rules that are defined in a JSON-style hierarchy and you issue a GET or POST on that resource
in the hierarchy to evaluate the rule that is rooted there. This seems like a special case. OPA does have a generic
<a href="https://www.openpolicyagent.org/docs/latest/rest-api/#execute-an-ad-hoc-query" target="_blank">
query</a> API, which allows you to pass input and evaluate a rego query based on the loaded policy document and the input. </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif"><u></u><u></u></span></li><li class="MsoNormal" style="color:black">
<span lang="EN-US" style="font-family:Helvetica,sans-serif">Auth0 FGA (one of the zanzibar implementations) has a
<a href="https://www.openpolicyagent.org/docs/latest/rest-api/#execute-an-ad-hoc-query" target="_blank">
check</a> API that takes a JSON payload containing a user key, relation name, and object key, and returns an allowed decision (true or false). Most zanzibar implementations seem to do something similar - e.g. SpiceDB has a
<a href="https://www.postman.com/authzed/workspace/spicedb/documentation/21043612-9786e5f3-2014-4b31-86c1-39335236c0e2?entity=request-c58c40ff-9fc7-4c3e-9cca-f017160ba5b8" target="_blank">
check</a> API that takes a resource, permission, and subject. </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif"><u></u><u></u></span></li><li class="MsoNormal" style="color:black">
<span lang="EN-US" style="font-family:Helvetica,sans-serif">Topaz (Aserto's OSS authorizer) has a
<a href="https://aserto.readme.io/reference/authorizerquery-1" target="_blank">query</a> API that takes an identity and policy (rule/decisions to evaluate), and optionally a resource context and additional input, and returns what OPA would return. It also has
a simpler <a href="https://aserto.readme.io/reference/authorizeris-1" target="_blank">is</a> API that evaluates a policy (rule/decisions) with an identity and resource context.</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif"><u></u><u></u></span></li></ul>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black"> </span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">On Tue, Jun 13, 2023 at 1:54 AM Roland Baum via policy-charter <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>>
wrote:</span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<p class="MsoNormal"><span lang="EN-US" style="font-family:Helvetica,sans-serif;color:black">I'm in as well :-D<br>
<br>
<br>
<br>
Roland Baum<br>
umbrella.associates GmbH<br>
<br>
<br>
-- <br>
policy-charter mailing list<br>
<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/policy-charter" target="_blank">https://lists.openid.net/mailman/listinfo/policy-charter</a></span><span lang="EN-US" style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</blockquote>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">--
<br>
policy-charter mailing list<br>
<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/policy-charter" target="_blank">https://lists.openid.net/mailman/listinfo/policy-charter</a><u></u><u></u></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><br clear="all">
<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black">--
</span></span><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><a href="https://hihello.me/p/cda689b1-0378-4b9c-88cf-33a9bc8ef0c5" target="_blank"><span style="font-size:10pt;font-family:Helvetica,sans-serif;text-decoration:none"><img border="0" width="360" height="155" style="width: 3.75in; height: 1.6145in;" id="m_-5470085780224843278m_-392978669304514450_x0000_i1025" src="https://cdn.hihello.me/cards/cda689b1-0378-4b9c-88cf-33a9bc8ef0c5/signature_logo.png?generated=1653502150176" alt="This is Alexandre Babeanu's card. Their email is alex@3edges.com. Their phone number is +1 604 728 8130."></span></a><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Helvetica,sans-serif;color:black"><br>
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information.<u></u><u></u></span></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal">-- <br>
policy-charter mailing list<br>
<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/policy-charter" target="_blank">https://lists.openid.net/mailman/listinfo/policy-charter</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><span>-- </span><u></u><u></u></p>
<div>
<p class="MsoNormal">---<br>
David Brossard<br>
<a href="http://www.linkedin.com/in/davidbrossard" target="_blank">http://www.linkedin.com/in/davidbrossard</a><br>
<a href="http://twitter.com/davidjbrossard" target="_blank">http://twitter.com/davidjbrossard</a><br>
<a href="http://about.me/brossard" target="_blank">http://about.me/brossard</a><br>
---<br>
Stay safe on the Internet: <a href="http://www.ic3.gov/preventiontips.aspx" target="_blank">
http://www.ic3.gov/preventiontips.aspx</a><br>
Prenez vos précautions sur Internet: <a href="http://www.securite-informatique.gouv.fr/gp_rubrique34.html" target="_blank">
http://www.securite-informatique.gouv.fr/gp_rubrique34.html</a><u></u><u></u></p>
</div>
</div>
</div>
</div></blockquote></div><br clear="all"><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">---<br>David Brossard<br><a href="http://www.linkedin.com/in/davidbrossard" target="_blank">http://www.linkedin.com/in/davidbrossard</a><br><a href="http://twitter.com/davidjbrossard" target="_blank">http://twitter.com/davidjbrossard</a><br><a href="http://about.me/brossard" target="_blank">http://about.me/brossard</a><br>---<br>Stay safe on the Internet: <a href="https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf" target="_blank">IC3 Prevention Tips</a><br>Prenez vos précautions sur Internet: <a href="http://www.securite-informatique.gouv.fr/gp_rubrique34.html" target="_blank">http://www.securite-informatique.gouv.fr/gp_rubrique34.html</a></div></div>
</blockquote></div>