Taming policy complexity: Model to execution

Abstract

Since the 1970's it has been acknowledged that a complex system can be broken into (a) its invariant functional parts (mechanism), and (b) the externalized choices for how the system should behave (policy). Policy-based management's main objective is to separate and externalize the decisions required by a system from the mechanisms provided by the system, and provide a way to define and evaluate these decisions. A few decades later, we have today a plethora of different policy models and even more policy languages - plus tooling - offering policy-based solutions for virtually any use case and scenario. However, policy-based management as a standalone domain has never been evaluated in terms of which parts are variant / invariant, i.e. which parts of policy-based management can be domain-, model-, language-, usecase-independent. In this paper, we introduce and define a formal universal policy model that does exactly that. The result is a model that can be used to design, implement, and deploy immutable policy infrastructure (engine and executor) being able to execute (virtually) any policy model.