Re: VCs - zCaps / OCap a Discussion

Adrian Gropper <agropper@healthurl.com> wrote:

> I have no idea what
>
> “ The PEP may know that the token is valid, perhaps because it has cached
> the validation result, but it doesn't know if the request is included in
> the permissions specified in the token.”
>
> My bad.  I meant PDP.


> means. I try to use ‘request’ consistently to refer to interaction at the
> PDP. I use ‘token’ in relation to the capability presented by a ‘client’ to
> Company A as the PEP.
>

Sorry.  That comes from the SPKI spec and allows you to memoize the
validation of a certificate.  That means the PDP only needs to check the
delegation chain once for a given zcap no matter how many times it sees
it.  The PDP still needs to verify that the zcap authorizes the request
being made every time.

--------------
Alan Karp

>