Can policies set be deleted?

[schnef]

After reading the paper "Multi-data-types Interval Decision Diagrams
for XACML Evaluation Engine", it is unclear to me how policies are to be removed. As far as I can tell, the modifications to the graph while adding new policies seems to be a one-way operation. Am I correct? If so, what kind of solution did you have in mind in case policies were to be removed. In access control, removing and updating policies is a must have.

[canhnt]

Hi @schnef,

Creating the graph from set of policies is similar to compiling source code to binary. Whenever you update your policy repository, you need to rebuild the graph again.

Regards,
Canh.

[schnef]

That would in practice render using such a graph not very useful. Most systems probably face changes to the authorizations on a regular basis.

[canhnt]

IMO it depends on specific use-cases. I assume in practical, users don't update policies every second. as long as they're updated, a new graph is generated and cached for but policy evaluation. In this case throughput of authorization evaluation is optimized.

If your use-case needs many policy updates but does not require optimizing policy evaluation, this engine is not suitable.