Piers> Where a PEM mail message is used to request goods or services
then clearly the authorization or accounting issues need to be
addressed, and concerns in this area seem to underlay most of this
thread. While not couched in ECMA Security Framework terms, Robert
Jueneman's "T=Mgr., Secure Systems Dept." or the like exemplifies the
model advocated by proponents of role-based access control (and such an
attribute value assertion would be carried as a privilege attribute -
rather than as part of the DN - in an ECMA/SESAME PAC).
Aren't standards wonderful - they do SO much to improve
interoperability! I am particularly fond of the ones that are
promulgated years in advance of anybody understanding what they might be
used for. ;)
Peace ..Tom Jones