The following is a comment I placed on Phil Windley’s Blog.
Go there to get background if you need it. However it really this post is a self contained stream of thoughts for the most part.
Dan Greer uses the term access-control which I believe can be interchanged with authorization for the purposes of this post.
Comment:
We often think of authorizations as a boolean process resulting in either acceptance or denial.
In other words authorization is assumed to be a simple function of authenticated symbols being reduced to a boolean value True or False.
In the two dimensional case
SymbolType1 -> SymbolType2 -> Boolean
Which generalizes to
(SymbolType1, SymbolType2, …) -> Boolean
While we simplify the authorization process as a table lookup in order to explain the concept. I believe that almost all authorization processes are already computational processes, in order to make the problem more tractable.
Examining group membership attributes of an identity or role is an example of how current authorization processes use attributes associated with identity to reduce the table size, making the problem more manageable.
On the other hand we can argue that examining group membership attributes is really just
a subordinate table lookup. In which case we could view it as only on optimization to reduce the original identity/role vs resource lookup. We really haven’t changed the original problem.
What I find two things interesting with respect to the credit authorization problem:
1) The credit authorization function is a continuous function whereas we assume most authorization functions are discrete, returning only boolean values, Yes or No.
2) The credit authorization function uses statistics to see what segment of the population the applicant is most probable to be a member of, according to the presented credit attributes associated with the applicants identity.
If we take statistics away from the credit authorization process above, all we are left with is rules. Rules are just table lookups, such as: Is identity X a member of group Y. While rules optimize the tractability problem by reducing table size, we really haven’t changed the problem.
In my opinion, the statistics component in the credit authorization problem is the key. The statistics component is simply a feedback loop of auditing and accountability.
Some of this thinking comes from being neck deep in XQuery parsing and Perl6 rules.
Dan Greer, however was the one that pointed out that auditing and accountability scale, while access-control(authorization) doesn’t.
So I posit that scaling properties of credit authorization come from it’s use of past auditing and accountability data, not rules.
Notice that the credit authorization process depends an the authentication of the applicants credit attributes by trusted entities such as banks, employers, and credit reporting agencies.
These same trusted entities also provide the source auditing and accountibility data for the statistical model.
Ok this was a long comment. I may be crazy.
Comments and corrections welcome.
