1. Separate Admin and Client Roles  Separation of Client and Admin roles If an app has authenticated as a client, Locate will return owned Managed (Crypto) Objects If an app has authenticated as a client it will return a list of owned Entities Inother words, clients own Objects, admins own Entities  Authenticating as client or admin is outside of the scope of this set of use-cases 1 Admin Use-case implications v0.9 Denis Pochuev/SafeNet

2. Objects/Operations/Attributes (in the Admin Universe) Objects:  Entity  (?) Entity Template Operations (only with admin role):  Register  Destroy  Add/Mod/Del Attr  Locate  (?) Locate w/attributes Operations (with client role):  Update Own Credential  Get Own Credential Validity Period  Get Own Credential State 2 Admin Use-case implications v0.9 Denis Pochuev/SafeNet

3. Objects/Operations/Attributes (in the Admin Universe) continued Named Attributes:  Name  UID  Type (Client,Admin, Proxy)  Credential  Credential Validity Period  Credential State Custom Attributes 3 Admin Use-case implications v0.9 Denis Pochuev/SafeNet

4. Flows in terms of the new Objects/Operations/Attributes 2.1.4 1. Xerxes logs into KMS-1 with admin credentials 2. X: Locate name=APP_A 3. X: Mod attribute (possibly with Placeholder ID) Credential=new 4. X: Mod attribute x-version=legacy 5. X: Register name=APP_B, Type=Client Credential=new 6. X: Locate name=APP_B/Destroy (batch w/Placeholder ID) 7. X: Locate or Locate w/attributes 4 Admin Use-case implications v0.9 Denis Pochuev/SafeNet

5. Flows in terms of the new Objects/Operations/Attributes 2.2.3 1a. Yvonne logs into KMS-2 with admin credentials 1b. Y: Register name=Alice type=Client credential=alice's_cred 2. Alice: Reset Own Credential 3. A: Get UID= 4. A: Get Own Credential Validity Period 5. A: Update Own Credential 5 Admin Use-case implications v0.9 Denis Pochuev/SafeNet

6. Flows in terms of the new Objects/Operations/Attributes 2.3.3 1a. Xerxes logs into KMS-1 with admin credentials 1b. x: Locate w/attributes 2a. X: logs into KMS-2 with admin credentials 2b. X: Locate Type=admin 3. X, KMS-1: Register name=Yvonne type=admin credential=new 4. X, KMS-2: Locate name=Zander/Destroy 6 Admin Use-case implications v0.9 Denis Pochuev/SafeNet