<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Noto Sans";}
@font-face
{font-family:"Work Sans";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.gmailsignatureprefix
{mso-style-name:gmail_signature_prefix;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks for sharing this Atul. If you add me to the repository I will open issues there.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">One question I had was whether the Search API could also return a policy in a “native” format. I.e. instead of returning the detailed “decisions” array, could it return an array containing policies
expressed in a format the PEP already understands?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Cheers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Pieter<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> policy-charter <policy-charter-bounces@lists.openid.net>
<b>On Behalf Of </b>Alex Babeanu via policy-charter<br>
<b>Sent:</b> Wednesday, June 28, 2023 5:52 PM<br>
<b>To:</b> Policy Charter Mail List <policy-charter@lists.openid.net><br>
<b>Cc:</b> Alex Babeanu <alex@3edges.com>; Erik Gustavson <erik@sgnl.ai>; Marc Jordan <marc@sgnl.ai>; Gert Drapers <gert@aserto.com><br>
<b>Subject:</b> Re: [policy-charter] Authorization API Proposal<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Atul, I'm crafting some feedback on this now, please add me too: GitHub ID = "baboulebou"<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Many thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">./\.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jun 28, 2023 at 9:50 AM Atul Tulshibagwale via policy-charter <<a href="mailto:policy-charter@lists.openid.net">policy-charter@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Hi Omri,<o:p></o:p></p>
<div>
<p class="MsoNormal">Thanks for your feedback here. I think GitHub issues are a good way to provide feedback. I'll be happy to add you as a collaborator in the repo (and anyone else who would like to collaborate in updating / editing the draft). Please send
me your GitHub ID.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Atul<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jun 27, 2023 at 10:47 PM Omri Gazitt <<a href="mailto:omri@aserto.com" target="_blank">omri@aserto.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Thanks Atul - it's clear you and the SGNL team put some thought into this.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm still looking through this but I like that you're specifying both a "check" function (Access Evaluation) and an "expand" function (Search API). Both are important, but perhaps only the Access Evaluation API ought to be required.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm not sure what is the best way to provide feedback. Github issues? PRs? put it in a google doc and use comments?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Here are some thoughts (sorry, no particular order):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">> Policy Distribution Point</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">Nit - this should be "Policy Decision Point" (which you name correctly in other places in the doc)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">> The Authorization API is itself authorized using OAuth 2.0 ([<a href="https://sgnl-ai.github.io/authzapi/#RFC6749" target="_blank"><span style="color:#2222EE">RFC6749</span></a>])</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">I think this is
</span>overspecified<span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">. I can certainly see clients that call an Authorization API using an API key.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Noto Sans",sans-serif">> Terminology</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">A bit of a quibble, but perhaps we tip the hat to XACML and use the terms "subject" and "resource" instead of "principal" and "asset". I'm not religious about these terms, but "asset" in particular seems less common than "object" or "resource".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">> Principals<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">In many systems, subjects will be extracted from a JWT "sub" claim, which is a string. I'm not sure that specifying that this must be a JSON structure, and further specifying two optional fields (ipAddress and deviceId) is necessary, and
feels overspecified. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">> Assets<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Having a type and id makes sense, but could these be specified in a single string? For example, zanzibar defines these as type:id <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I do like having the ability to pass in properties in addition to the object identifier - but it seems like this should be a json object (key:value pairs), not just an array of attribute names.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">> Actions<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">It's not clear to me that separating actions into "standard" and "custom" is useful. I think the types of actions you list (CRUD) are common examples but should not be normative.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I do think it's possible to use the generic concept of "Action" to encompass permissions and relations. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">> Queries (as array)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I think that allowing a set of decisions to be requested at once is valuable, but IMO the spec should not mandate that implementations must support more than one query at a time. Some PDPs don't support that semantic and it should be considered
optional.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jun 27, 2023 at 4:38 PM Atul Tulshibagwale via policy-charter <<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Here's a proposal of an Authorization API that we would like to contribute to this group (in its current form or if / when we find a home in a standards body). This is similar to at least a few vendors' current offerings, so I hope everyone
finds this helpful, and we can accelerate our standardization efforts as a result.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You can read the proposal in HTML format here: <a href="https://sgnl-ai.github.io/authzapi/" target="_blank">https://sgnl-ai.github.io/authzapi/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The sources (under the MIT License) are here: <a href="https://github.com/SGNL-ai/authzapi" target="_blank">https://github.com/SGNL-ai/authzapi</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">- Atul Tulshibagwale, Erik Gustavson and Marc Jordan<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><span class="gmailsignatureprefix">-- </span><o:p></o:p></p>
<div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt;overflow:hidden">
<p style="margin:0cm"><a href="https://sgnl.ai/" target="_blank"><span style="font-family:"Work Sans";color:#1155CC;border:none windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="137" height="68" style="width:1.427in;height:.7083in" id="Picture_x0020_1" src="cid:~WRD0180.jpg" alt="Image removed by sender."></span></a><o:p></o:p></p>
</td>
<td valign="top" style="padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden">
<p style="margin:0cm"><span style="font-family:"Work Sans";color:black">Atul Tulshibagwale</span><o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Work Sans";color:#666666">CTO </span>
<o:p></o:p></p>
<p style="margin:0cm"><a href="https://linkedin.com/in/tulshi" target="_blank"><span style="font-size:7.5pt;font-family:"Work Sans";border:none windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="20" height="27" style="width:.2083in;height:.2812in" id="Picture_x0020_2" src="cid:~WRD0180.jpg" alt="Image removed by sender."></span></a><a href="https://twitter.com/zirotrust" target="_blank"><span style="font-size:7.5pt;font-family:"Work Sans";border:none windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="20" height="27" style="width:.2083in;height:.2812in" id="Picture_x0020_3" src="cid:~WRD0180.jpg" alt="Image removed by sender."></span></a><a href="mailto:atul@sgnl.ai" target="_blank"><span style="font-size:7.5pt;border:solid windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="21" height="21" style="width:.2187in;height:.2187in" id="Picture_x0020_4" src="cid:~WRD0180.jpg" alt="Image removed by sender."></span></a><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<p class="MsoNormal">-- <br>
policy-charter mailing list<br>
<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/policy-charter" target="_blank">https://lists.openid.net/mailman/listinfo/policy-charter</a><o:p></o:p></p>
</blockquote>
</div>
</blockquote>
</div>
<p class="MsoNormal">-- <br>
policy-charter mailing list<br>
<a href="mailto:policy-charter@lists.openid.net" target="_blank">policy-charter@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/policy-charter" target="_blank">https://lists.openid.net/mailman/listinfo/policy-charter</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><span class="gmailsignatureprefix">-- </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><a href="https://hihello.me/p/cda689b1-0378-4b9c-88cf-33a9bc8ef0c5" target="_blank"><span style="border:solid windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="360" height="360" style="width:3.75in;height:3.75in" id="Picture_x0020_5" src="cid:~WRD0180.jpg" alt="Image removed by sender. This is Alexandre Babeanu's card. Their email is alex@3edges.com. Their phone number is +1 604 728 8130."></span></a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="border:solid windowtext 1.0pt;padding:0cm"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="Picture_x0020_6" src="cid:~WRD0180.jpg" alt="Image removed by sender."></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments hereto, is for the sole use of the intended recipient(s) and may contain confidential and/or proprietary information.<o:p></o:p></p>
</div>
</body>
</html>