Re: Outreach via wikipedia articles on authentication and authorization

Rob Meijer  wrote:
> 
> Mallet uses my identity to determine that I am one of 10,000 law
> enforcement people (within her 100,000,000 user-base) that she needs to
> keep tabs on.

This statement exposes the fallacious assumption that most people make about identity, that it is in some sense a global property.  In fact, identity is a set of relations in a social graph.  I am a particular physical being who can be thrown in jail (which is why a corporation is not a person with first amendment rights, John Roberts), but my identity is a set of labels in a social context.  I am Joey's Mom's Alan.  I am HP's 0394827.  I am the UN's US's SSA's 323-39-4453.  Each of these labels identifies me in a particular context, but that identification is meaningless in another context.  If you found out that 0394827 did one thing and Alan did something else, you'd have no way to know I did both without walking the family and HP social graphs.

In your example, David gave Mallet the permission, so we presume that David and Mallet have a direct relationship.  David got the permission from Carol, so we presume that Carol and David have a direct relationship.  That does not imply that Carol's identifier appearing in the delegation chain  has any meaning to Mallet.  That identifier is a petname chosen by Bob that needs to be meaningful only to him.  We assign responsibility by walking the delegation chain, not by jumping to a particular point.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp