6.2.1 Restrictions on Metapolicies in a Management System

Metapolicies support the management needs of a policy-based management system. Therefore, it is clear that various management systems, which work with various concepts and implement different (management) features, have different problems and management concerns.

The metapolicy concept must be able to cope with these different requirements on the one hand. On the other hand, not all management systems allow the formulation of enforcement of useful metapolicies, as the following example shows: A management system which is not able to distinguish between roles like security expert, performance expert, etc. does not need metapolicies which have these roles as subject. General considerations regarding the restrictions of metapolicies in an existing management system are presented here:

• Usually, the flexibility and expressiveness for stating policies and metapolicies is given by the policy-based management system and/or the actual practice how policies are handled in the various stages, i.e. the policy life cycle. The first one implies a technical restriction, the latter does not. Despite this fact, changing a well-tried and established practice usually causes some trouble and therefore is often not wanted. For this reason, metapolicies should only be stated in a way which is compliant with the management system or the common practice of handling policies. Otherwise, as in the first case, the stating of metapolicies would not be possible or their enforcement would fail. In the second case, a well-tried and established practice would be destroyed in the long run.

• In addition to this, metapolicies, as policies in general, dependent on the usage of objects, their attributes, and relationships between them. If a management system is, for instance, not able to distinguish between a policy which is tested and a non-tested policy, it is not possible to state a metapolicy which handles these cases differently. This is a matter of the information model the policy-based management system supports and this model and the containing objects must be defined before a metapolicy uses them. Otherwise, it is not possible to reference such objects in the metapolicy. During the development of various metapolicies it became clear that the ability of a management system to add objects, attributes, and relations while specifying a metapolicy helps the metapolicy writer, because it is very hard to predict in advance which information and which objects are needed.

• A similar dependency of metapolicies exists in connection with events. Most management systems listen to events, correlate them, and take actions according to the changed situation. Known events are used with policies to trigger or restrict actions according to a policy. Metapolicies are no exception to this. The difference is, that in case of using metapolicies for managing the management system, it must change its role from consumer to producer of events. This enables metapolicies to govern the policy life cycle, because they can state constraints and actions on changes within the management system, i.e., its supporting processes or policies which are created, altered, distributed, etc. An example of a metapolicy which uses such events could be: Mark all child policies of policy X as ``must be checked'', if policy X is altered. The event which must be produced is the alteration of policy X. The metapolicy states in the example how the management system must react with receiving this event.

• What can also be seen from the former example is that especially active metapolicies use actions which somehow must be transformed into procedures or methods of the management system. In the example, this is the marking of the child policies. These methods must be provided by the management system. Otherwise, the metapolicies cannot be enforced. Thus, the expressiveness of metapolicies directly depend on the available methods provided by the management system.

In this section, it was shown that metapolicies are dependent on the policy-based management system, and that the management system restricts the application of metapolicies. The more information and methods are provided by the management system the greater the expressiveness of metapolicies is.