6.2.3.1.1 Passive Metapolicy as an Invariant

Characteristic for a passive policy is the fact, that before and after execution of an operation the policy is valid. Thus it is an invariant of every operation in the management system. This high-level description states in particular an invariant of the policy structure. Transformed into constraints, the metapolicy would be noted as shown in table .

Table 6.3: Metapolicy invariant and constraints on policy operations

Definition of ischild:	ischild(X)	$\Longleftrightarrow$	$\exists$ Y: child(Y) = X
Invariant:	$\forall$ Policy X: ischild(X)	$\Longleftrightarrow$	parent(X) $\neq$ null

Operation	Operation compliant if
delete (PolicyID Y)	child (PolicyID Y) = null
Y.addChildID (PolicyID X)	parent (PolicyID X) = Y
removeChildID (PolicyID X)	parent (PolicyID X) = null

In table , some operations and the constraints they must fulfil after their execution are listed. A management system must be able to make a decision whether an operation is permitted or not. Therefore, the operations must be specified in a way which allows the system to make such a decision.