1. Permission Enhancements Topics Topics Demo of Work Completed to Date Demo of Work Completed to Date Grant Restrictions Grant Restrictions

2. Grant Restriction: Limit on the scope of the audience towards which an authorized user is allowed to perform some activity. Grant Restriction: Limit on the scope of the audience towards which an authorized user is allowed to perform some activity. A user can publish channels, but only to a subset of the user population. A user can publish channels, but only to a subset of the user population. Grant Restrictions

3. Address by adding a new permission whose Target attribute is a fine-grained filter (group of users). Address by adding a new permission whose Target attribute is a fine-grained filter (group of users). Owner:UP_FRAMEWORK Owner:UP_FRAMEWORK Activity:MANAGE Activity:MANAGE Target:filter.2 (group of users) Target:filter.2 (group of users) Principal:filter.1 (group of users) Principal:filter.1 (group of users) Grant Restrictions

4. granted P2, PUBLISH Channels P3, PUBLISH Fragments P1, MANAGE Group (filter.2) Content Publishers (filter.1) User1 User2 … member of restriction P1 - Owner: UP_FRAMEWORKActivity: MANAGETarget: filter.2Principal: filter.1 P2 - Owner: UP_FRAMEWORKActivity: PUBLISHTarget: CHAN_ID.*Principal: filter.1 P3 - Owner: UP_FRAMEWORKActivity: PUBLISHTarget: FRAG_ID.*Principal: filter.1 Permission Grant Set

5. A user’s restriction set will be reflected in the filter hierarchy being used by an application A user’s restriction set will be reflected in the filter hierarchy being used by an application Restriction set itself cannot be modified by user. Restriction set itself cannot be modified by user. Multiple restriction sets are OR-d together. Multiple restriction sets are OR-d together. Users will have the ability to further restrict the audience by AND-ing more criteria to the restriction set. Users will have the ability to further restrict the audience by AND-ing more criteria to the restriction set. Grant Restrictions

6. Applications will need an additional permission to preserve the restriction set that allowed the activity to occur. Applications will need an additional permission to preserve the restriction set that allowed the activity to occur. Channel publishing will now produce both a SUBSCRIBE and MANAGE (channel) permission grant. Channel publishing will now produce both a SUBSCRIBE and MANAGE (channel) permission grant. The MANAGE permission grant’s principal is the AND- ed set of restrictions. The MANAGE permission grant’s principal is the AND- ed set of restrictions. Protects the published channel to the degree that a user must be authorized (member of AND-ed set) to modify. Protects the published channel to the degree that a user must be authorized (member of AND-ed set) to modify. Grant Restrictions

7. Grant restrictions introduce a potentially undesirable side-effect, affectionately called ‘cross-pollination’. Grant restrictions introduce a potentially undesirable side-effect, affectionately called ‘cross-pollination’. Occurs when an unintended audience is the recipient of an object created by some activity. Occurs when an unintended audience is the recipient of an object created by some activity. Grant Restrictions

8. * Cross-pollination: Published channels intended for Physics majors would also User1 member of Year=Senior granted P4, PUBLISH Channels P3, MANAGE Group (filter.3) *filter.3 - (Group=Prospective Students) Year=Senior AND Major=Physics granted P2, PUBLISH Channels P1, MANAGE Group (filter.2) *filter.2 - (Major=Physics) be accessible by Prospective Students.

9. Solution to Cross-pollination is to allow a user to specify under ‘what capacity’ an activity is to be performed. Solution to Cross-pollination is to allow a user to specify under ‘what capacity’ an activity is to be performed. ‘What capacity’ represents the group (principal) that the user is a member of and performing the activity on behalf of. ‘What capacity’ represents the group (principal) that the user is a member of and performing the activity on behalf of. Year=Senior Year=Senior Year=Senior AND Major=Physics Year=Senior AND Major=Physics Grant Restrictions

10. User will be asked on behalf of ‘what capacity’ they wish to perform an activity when defining a hierarchy User will be asked on behalf of ‘what capacity’ they wish to perform an activity when defining a hierarchy Filter hierarchy will allow selection of one of the groups they are a member of (i.e. capacity). Filter hierarchy will allow selection of one of the groups they are a member of (i.e. capacity). This allows targeting only to the set of users (group or groups) that the are ‘managed’ by the group identified in the capacity. This allows targeting only to the set of users (group or groups) that the are ‘managed’ by the group identified in the capacity.