Proposed approach to conformance; structuring of requirements

This is further follow-up on ACTION-218 and ACTION-223.

I suggest that we try to structure our recommendations into
requirements (normative, MUST), good practices (normative, SHOULD,
related to a requirement), and implementation techniques.
Implementation techniques could be either informative or normative
(I sense that we'll need to have some discussion about that), and
would describe concrete techniques that are *sufficient* to fulfill
a requirement or a good practice.

Every requirement, good practice, and implementation technique 
comes with an applicability section that outlines (a) what product
would fulfill the requirement (user agent? web page? assistive
technology?), and (b) what assumptions are made about the product
(visual renderer that supports colour? keyboard present?).

To claim conformance with the spec, a product would have to show
that it fulfills all requirements whose assumptions it matches; we
might want to invent another label for products that also implement
the good practices.

In terms of restructuring the template, this means that there might
be some re-structuring into:

- Requirement
- Good Practice
- Implementation Techniques

... with a clearly visible "assumptions" clause for each one.  In
terms of discussion, it's of course valuable to have more material
explaining the background, discussing the threats countered, and
attacks still possible.

However, in terms of getting to the first public workig draft, I'd
suggest that we focus on initial drafts for the three sections
suggested above, plus the assumptions clauses.

Comments? Refinements?

Regards,
-- 
Thomas Roessler, W3C  <tlr@w3.org>

Received on Sunday, 27 May 2007 10:39:56 UTC