Re: [ggf-ogsa-sec-wg] VO consideration

["Takashi Kojo" <kojo@isd.nec.co.jp>]

Phil,

>> - What would be real organization(RO) policy/trust and VO policy/trust?
> Quite similar in abstract syntax and semantics but bearing on different
objects with
> different scope in practice.
> Just as a security officer in some RO could set policies like users in
(previously defined)
>  group G or with (previously defined) attribute A have access to resources
in (previously
> defined) pool P,  so could a security officer in the same RO involved in a
VO V set
> policies that (external) users with membership in V are authorized to
access local resources
> in the (previously defined) pool Pv.  Each RO security officer can define
which of his real
> local users and resources are cleared to be in V.

I understand this far.

I tentatively distinguished RO from VO, but are they essentially different
or
not at certain level? Assuming they have common class at certain level,
we could recursively construct a VO from combination of some VOs.

Kojo