[ggf-ogsa-sec-wg] VO consideration

["Takashi Kojo" <kojo@isd.nec.co.jp>]

Greetings,

While reviewing "The Security Architecture for OGS",
I got several questions. One of them seems somewhat fundamental.
The discussion might ave been done somewhere before. I would 
appreciate pointers to refer to.

The question is
What is the definition of VO with regard to OGSA Security, 
which was described in the introduction.

My motive is to find out if/how the VO model is sufficient enough
to deal with real use cases of the grid regarding with grid security.

- Would a single layer of VO be sufficient enough?
    to deal with levels of trusted users or VOs...
- How do you set up/modify the VOs with which authority?
         or maybe can you partially define them statically, too?
      What would be a set of services of VO manipulations?
- What would be a granularity of VO configuration regarding with timing?
            By command lines, sessions or more overall agreement between
            VOs?
- If the VO manipulation represents dynamic aspect of policy/trust
definition, how much should be handled by policy/trust and by
VO manipulation?
- What would be real organization(RO) policy/trust and VO policy/trust?

Kojo

----------
Takashi Kojo, NEC, kojo@bk.jp.nec.com