1. Semantic Web and Policy Workshop Panel Contribution Norman M. Sadeh School of Computer Science Carnegie Mellon University Director, e-Supply Chain Management Laboratory Director, Mobile Commerce Laboratory Co-Director, COS PhD Program

2. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 2 Policies Are Everywhere B2B contracts  e.g. quantity flexible contracts, late delivery penalties, etc. Negotiation  e.g. rules associated with auction mechanisms Security  e.g. access control policies Privacy  Information Collection Policies (aka “ P3P Privacy Policies”)  Obfuscation Policies Workflow management  What to do under different sets of conditions Context aware computing  What service to invoke to access a particular contextual attribute  Context-sensitive preferences

3. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 3 Context-Sensitive Privacy & Security Policies  Pervasive Computing “My colleagues can only see the building I am in and only when they are on company premises”  Enterprise Collaboration “Only disclose inventory levels to customers with past due shipments”  DoD Scenarios (e.g. coalition forces) “Only disclose ship departure time after the ship has left” “Only disclose information specific to the context of ongoing joint operations”  Homeland Security & Privacy (e.g. video surveillance) “Only allow for facial recognition when a crime scene is suspected”

4. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 4 Challenges in Enforcing Context-Sensitive Policies  Sources of contextual information: May not be known ahead of time May change from one entity to another May change over time  Examples: Different sources of location information depending on who & where the subject is Different sources of information to determine when supplies will arrive, depending on who the supplier is and the particular mode of transportation

5. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 5 Pervasive Computing Instantiation: MyCampus Each entity has its own set of policies & policy evaluation agents

6. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 6 Semantic Web Approach  Interleave reasoning about policies with the dynamic identification of sources of contextual information Both explicit delegation & dynamic discovery  Sources of contextual information modeled as Semantic Web Services  Service profiles & context-sensitive policies refer to shared ontologies

7. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 7 Specifying Context-Sensitive Policies

8. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 8 Motivating Scenario Public Service Directory Service Personal Service Directory Service Privacy Agents Information Disclosure Agent Notification Agent Mary’s User Agent Mary Personal Agent Directory Service Policy Repository Service Task-Specific Agents Public Agent Directory Service White Pages Directory Service Bob Company XYZ Cell Phone Operator Only people on my team can see the room I am in and only when we are in the same building Is Bob on Mary’s team today? 2 Which building is Bob in right now? 3 -Is Mary allowed to ask this? -Is there a service to find Bob’s current location? 4 What is the street address for Bob’s current location? 5 What room is Mary in? 1

9. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 9 Meta-Model for Query Processing  Monitoring query processing progress Including satisfaction of relevant policies  Meta-model information: Whether/which policy elements have (not) been verified What facts are still missing  To verify relevant policies/answer the query What sources of information are available  Local vs. external, whether they have been identified, whether queries have been submitted and answers received Etc.

10. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 10 Policy Enforcing Agent: Architecture

11. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 11 So, Where Do We Start?  Usability Challenges  “Low Hanging Fruits” B2B  Easier to invest time in specifying policies  Virtual Enterprise scenarios Contracting, security, workflow management, pricing, and plenty of other corporate policies Open Mobile & Pervasive Computing  There’s no other way  Roaming, complexity of Mobile Internet value chain, etc.  Challenges:  Moving away from highly scripted trust management protocols, usability challenges, expressiveness & computational tradeoffs, etc.

12. Copyright ©2001-2005 N. Sadeh 2005 AAAI Fall Symposium- Slide 12 Q&A