SOA Policy - enabling true SOA governance

Speakers: John Falki - Chief Software architect, SOA Governance & Maryann Hondo - Software architect, SOA Policy (shares a new blog)

Policy enforces consumability and adoption of SOA.
Each policy has its own lifecycle - author , transform , enforce and monitor (generally, each has a separate product and serves different roles).

IBM has a federated approach for policy management - there are federated policy repositories (like SOA Policy manager, Tivoli Security Policy Manager and WSRR).

Two recognized standards for policies - WS-Policy and XACML.

The Policy lifecycle -
- Author - Apply language syntax and semantic.
- Transform - Different programming models may have internal policy representations though they want to use a canonical form for broader coverage.
- Enforce - PEP - Policy enforcement point, for example DataPower.
- Monitor

There are still not enough best practices to where to place PEP in the architecture. Certainly it will be in the ESB and applications, but potentially in more points.