• Name: Comply

The Service Genre describes compliance by a party, the process where a party is presented with a policy statement and given the opportunity to acknowledge acceptance of the policy. The policy contains information around the terms and conditions of use that the party is signing on to. The compliance process normally involves an individual agreeing to abide by certain rules when using a system.

• e-Framework Service Genre Version: v1.1

The Service Genre describes compliance by a party, the process where a party is presented with a policy statement and given the opportunity to acknowledge acceptance of the policy. The policy contains information around the terms and conditions of use that the party is signing on to. The compliance process normally involves an individual agreeing to abide by certain rules when using a system. This is normally tracked so that any breaches of use by an individual can be enforced e.g., remove access, legal proceedings.

Terms:

• Policy – set of human readable enforceable rules.
• Party – an individual agreeing to the policy

Compliance presents a set of rules to a party and expects to receive with an acceptance or rejection statement from the party. The decision by the party is tracked and recorded for audit purposes, with the decision being returned by the service. The tracking of the party would be expected to be against a unique identifier for the party.

Compliance services are normally used during a registration process where parties are signing up to use a service. The compliance service would be choreographed into the process at an appropriate point.

Compliance services also provide the ability to recall previous compliances for a specific party. This is used in audit tracking to determine if parties have complied with the required policy.

Two examples of service expressions for this genre are shown below. These are the simplest examples available, but it should be possible to identify more complicated processes around the generation of an acceptable use policy requiring lawyers and other actors to be involved e.g. the applicant may take the acceptable use policy to a third party before returning it.

This is an example of a process that could be automated e.g. in a self provisioning SUM this could be a form with tick box.

However, it is also part of a business process represented in ESAA within red circled part of following diagram:

Any Service Expression that conforms to the Comply genre:

• MUST return a response indicating acceptance or not of the policy
• MUST track the parties response
• MUST provide an interface to find a parties response to the policy

Other requests and behaviours MAY exist.

The following is the typical processes for comply:

• A request for compliance is made
• The user is presented with a compliance statement
• The user’s response to the compliance statement is supplied to the service
• The user’s response is recorded and returned from the service

A comply service MUST link to a suitable storage engine for storage of the policy and to provide the ability to record a new policy.

A comply service MAY link to an alert service to provide ability for new or updated policy to be notified to individuals

A comply service MAY link to an audit service to provide the tracking of parties responses.

Used as a business process within the New Zealand Education Sector Authentication Authorisation (ESAA) system.

• Identity and Access Management v1.0

None

© Copyright, e-Framework Partners 2007

Attribute this work as:
Comply Genre, The e-Framework Partners, 2007. Derived from...

Attribution History:

1. Derived from Comply Genre Submission authored and submitted by Julian Downs on behalf of New Zealand Ministry of Education / ESAA (e-Framework Partner), 2007

Last updated 14 October 2008