May, M.J., Gunter, C.A., Lee, I., and Zdancewic, S. (2009) Strong and Weak
Policy Relations. IEEE International Symposium on Policies for Distributed
Systems and Networks (POLICY). London, July 20-22, 2009.


Abstract: Access control and privacy policy relations tend to focus on
decision outcomes and are very sensitive to defined terms and state. 
Small changes or updates to a policy language or vocabulary may make two
similar policies incomparable. To address this we develop two flexible policy
relations derived from bisimulation in process calculi. Strong licensing
compares the outcome of two policies strictly, similar to strong bisimulation.
Weak licensing compares the outcome of policies more flexibly by ignoring
irrelevant (non-conflicting) differences between outcomes, similar to weak 
bisimulation. We illustrate the relations using examples from P3P.