We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to datalog with constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.
|Title of host publication||20th IEEE Computer Security Foundations Symposium, CSF 2007, 6-8 July 2007, Venice, Italy|
|Publisher||Institute of Electrical and Electronics Engineers (IEEE)|
|Number of pages||13|
|Publication status||Published - Jul 2007|