Question: should KAS Grants to Attribute Definitions or to Values be singular (1 : 1) or multiple?

[jakedoublev]

The current policy protos and db allow for multiple grants of a KAS to a single Attribute Definition or to a single Value. The db logic also allows this behavior.

I am wondering if this is intended or if we should only support a singular grant to each individual part of an attribute?

[jakedoublev]

Curious to hear your thoughts @dmihalcik-virtru, @strantalis, @jp-ayyappan.

[dmihalcik-virtru]

We support multiple grants to allow a single attribute or value to indicate a shared key, e.g. to allow two organizations to independently control access to a document. This could indicate a shared project or topic of interest.

[jrschumacher]

Does this denote an AND or OR split?

[jp-ayyappan]

The need is to be able to drive encryption keys used based on attribute values in TDF. I have tried to map out the full set of applications below.

Case 1 - 1:1 mapping

Where an attribute value has one key mapped to it

Case 1 - 1:many OR mapping

Where an attribute value has more than one key mapped to it; but only one key is needed to decrypt

Case 1 - 1:many AND mapping

Where an attribute value has more than one key mapped to it; and all the keys are needed to decrypt