The need for management is almost always a consequence of a decision taken in the management level of an organisation. Policies can be used to specify a management objective in a high-level fashion. The refinement process tries to narrow the objective down to concrete low level policies achieving the initial principle. Failure due to ambiguity as a result of different reasons are not investigated here.
An example which is part of the delegation process follows: The customer relationship officer creates a high-level policy governing transmission of customer data, because he wants to offer this kind of quality of service for customer privacy reasons. He delegates the refinement of the high-level policy to the system security officer, who creates additional policy objects needed for the actual enforcement. After the system security officer has completed his refinement work, the created policies derived from the initial one go back to the customer relationship officer. He reviews them to ensure that they fulfil his demands.
The additional data of the delegation process should be stored within the policy repository for clarity, if not in the policy itself. The delegation process therefore updates and modifies policy descriptions, and uses them, for instance for approval purposes. This can be done in all steps of the refinement phase as different subjects may be responsible for various refinement levels. Even policies, only resulting from technical aspects, have at least one default subject, e.g., the IT officer, as the responsible subject.
For all these reasons, in this thesis the delegation process is considered as part of the processes involved in the policy-based management. It covers the organisational aspects which are necessary in a company.