The burning question is when should a policy assertion author leverage nested policy expression?
When we talk about nested policy expression there is always two or more policy assertions involved. I would use the following two design questions to determine the possible use of nested policy expression:
- Are they designed for the same policy subject?
- Are they dependent?
If the answers are yes then leveraging nested policy expression is a good idea. However, there is one caveat: nested policy expression participates in the policy intersection algorithm.
Comments