Policy-Discussion

[Jac Kersing <j.kersing AT the-box.com>]

Hi Jens,

On Tue, 20 Feb 2007, Jens Paul wrote:

> I think such decission made by an event organisator / officer / senior 
> assurer should always be based on a policy. And if we allow such a person to 
> be an event organisator / officer / senior assurer (we have to define 
> first!), we should be able to trust him that he acts only according to the 
> policy. If not, he won't keep his "job" very long, right?

Ok, assume next Cebit a senior assurer is present. One of the assurers 
decides to ignore policies. Now the senior assurer asks him/her to mend 
his/her ways. Do you think anyone ignoring the policies will change into a 
model citizen from that moment on? If someone does not want to work within 
the rules no senior assurer will be able to change that. In the situation 
you described earlier the wayward assurer would ignore the senior assurer 
just like the event organiser.
If the 'wayward' assurer is not violating any policies a senior assurer 
has no case at all (as every decission should be policy based.)
Should an assurer be drunk, abusive or otherwise disruptive at any event, 
the organiser (or the other assurers) has every right to ask him to leave. 
There is no need to grant anyone additional privileges for this imho.

Having a senior assurer on-site for advice when questions arise that are 
not (yet) addressed by the policy would make sense to me. But for advice 
only as the person assuring is the person accountable for the assurance.

> Well, if someone does it all in private people will see him "as a 
> person" and not "as CAcert". If it is at an offical booth, thinks are 
> seen diffrent I guess.

In my experience whenever I'm assuring for CAcerts (or Thawtes) Web of 
Trust the person being assured assumes I'm acting as an agent for CAcert 
(or Thawte), not as a private person, at least that goes for the fast 
majority of them.

Best regards,

Jac

---
 Jac Kersing            Technical Consultant   The-Box Development
 
j.kersing AT the-box.com
         CISSP           http://www.the-box.com