Policy languages require the same composition mechanisms as programming languages

Abstract

Current policy languages come with a monolithic syntax and support only a limited set of security formalisms. Thus, contemporary policies can only inadequately prescribe the correct behavior of a distributed business application w.r.t. different views, such as usage control, safety properties, or governance. To support composing policies that involve multiple views, we propose to include well-established composability mechanisms into policy languages. In this paper, we propose an extensible security DSL that composes multiple mechanisms-namely inheritance, scoping, aspects, and different paradigms-into one composite policy language.