We continue the relationship manager work. Some things I think we need to figure out (ideally from proposals or lists of options):

- One API (AS only) or two (also RS)?

- (Each) API protection model?

- Topological and trust assumptions or lack thereof? What can be co-located? How many of each thing can there be?

- Any rules needed for policy (“policy condition”) priority between RM and AS (the “cascading” scenario)

- A clean way to model or illustrate the scenario when the RS is hosting claims (the “turtles” scenario)

What else?

Eve Maler (sent from my iPad) | cell +1 425 345 6756