!
#"$
 
%'&)(*(,+.-/&)021 53 46&)7'891;:=<51;7?>@&BA9C 3D&5EGFIHJ&5ELK
M NPOQNR 1BS1B&)TUEWV
%IAXTYTG&;K[Z,:\-\-^]?_`3baDcBdDc;e
f;ghji.k*lDm.kGnh?ojp9qjrts9uXvtuDhjs9ojwPxyhjzz!xYo?{;g
~| })X5
=Y)*Y,BLQYB\\ YB \LB\^B.?\.BLL)B*YBL!Y!B.Y*B5**.D;YB=*6LGyBYY.=@L;
=W29L*\.Y!=BL?*B;Y)\*BGBL*y=YLB.QYY2y=YYLLYY;;
=)WBLL\\ yJB@ =*YLL.B)YBG=Y *X)LBPL\Y9 *;\=.9\
BL*y\@ LL;.,Bj^=L;;y@Y!By ;LBLP *YLWLPX\B!@#. LB YLGy
6!,YBL6t66L\!^)\**`;L;YLPBP`LB6y=Y*QL^5L=,==QB`,D!.BLBB*)B**B .YYBB6J#GYBj
L=` 9yj=;LBL 5;*^GLP\B^Y YGLP\6\L!\L\*\ ;5LBy
?!*;YBy\\L\LGLL\2yXBQB9Y@@\GL.LY!L=!=B* )*B .YLY=Y@BY.Y6.=YYY *B @^yG 

=yL!B*B*.YByL6,5L)*.;PDG5BBL ) LL;G~JWW59B
GBBB9`2GjyWL,j;jyGW@yB* W Y; jGW W GWLBBL2BW
G B B`yP;Q*YG`@B) / B;)QWP`2G9B;BBB
BByB  jW,!)BLPBBBB; BLy25DB.B;) jy WjWG,Ly;;
B^W ?B5GL5B! GB``)B;B=QBPBL B , W;B*9QBGL;PGDBW
jjWB B yGj ).By;L,G)JG;B,yB5GL.GBBBG2WG^BB*PWL2BL
;9yLW BByB`GjWL;?BY*BWLB5L`
BB`L5B/.LByyBB^,WW=^W,B` jLGPBjWGP*W;5!LW B B`j`YL
G^;G,PB;B G BB`!G);BB;LGL?G B;,G)BBBBJB9Q.` WB
/=;Y.j W6B2/;*5JjByYG5`WGJY. \**!tB*BY!GBYB!W#Y^
B;LLDW!GB) )WBLByB2,;/@W@*L2y B ByL,PW)PB*2GWjL
@ BB5B
,;Gj WB X`WLPyyB;jG) ,y 2BQ*ByG=*GByy#WB
B)?B^G),L5LG;,GP)By j GWIB; B;2yL)^WLBQB^WBBB;yQL^y)PB^WB2)IWy'LPW BBBBBG.B);2Wy PBG5GLy,;@jWQ`B
,B;j@GBWBB/PB)W ;BG*BL)WBPG@)ByJ*5BJB/GjBBBYY =L BL)^W?B)B*
BGB!,`BWj,WBBQLQGGjLW)W jG*BG;!Bj;WBW,PB!W
jWBGJGBLLB^GBB^ GP y2)LY= `Y[B@GL^BBGL;,^WGBY.!GGBL;
BPBByP5WGBBB,GL@jG2)WQB?W,6)BGLL )LL )LG9LPj=GjBPyYGy
L5BGLB 9;jWB^W,2; )WG;=BLB.y,L,*WL.BG;
j PyLBB@;yyjGBG )BjWWB PQ.WBB5G= \BP!`BY ;WBjWBB
L5QGLW=LL`j,5LYB@Q=B,;ByW *JW[BGB)G*WBL))P)*

jWBBB/,B BBLLPyLB;Y
/)!;.GLB!P\ BBPjG,GBLB)jy;;yjW=^W,
G)WLyP^WBjW;G)B*
/ `,)By;BG`*\LGBQ) BB B`yWG9L))BB/`Yj Y=BL;
B B;Ly B B;BWLL BBB


5G*G`;BBLy,WL *G) `G;

L

M

9N

PO

Q

RTSVUXWZY)[\^]_[`baXcUXW#d]fe

hg

Pj

)k

RTlnm[po/WqXWmWZr>s)e


 !#"%$'&)(*+*,*.-/"0
1
2%2'03$2"0
432$%56'798;:=<>03?@!'7BA><$':
C+DE6GF6H+I)F3J=>
K

i

B,*GB,@B)GyB2 ,5GBBj WB jL5?Y.J)B;GG,*

GLByB jyYWBGBLyB P)BB;By,*/WLI)j5.G;2BBWGByY,y;B jB *WyW)BL )X.! WB5
B^WBLB\^G LD
*BG.ByyB); G*WB^Pyy2BQG;^PWBj G / LB)yB5BG/ BPW *;LGB
B jWGBBL;BLW B^P jB*WPLj W/PP@)BBjLBP)P ;=*W
=BLL;^WBL;GW,BW,B)PL=G;GDBL,LBGBBjBBG*L  ;QB* Y L?;YB,QBB`BLBBGy
2ByB `BL YBG^PbjyLBLP)*W)5L` B jLByP~B)BBL)BG
L5G =L B) ?
,jyBQjWLB B =Ly.LBy2=;G)QBy,B;LG.LB;BP B!WBB;
PXW`#G;BQ)G BD)*;WWLB)B!*jGGPBBQ) bB BL,WG
LB jj*GyL,;;B\^GB;9)L jW )L@ j*W

By.L) PYG [L=YW*P\ @;B=LY; ;GB\ L `LL @G

BByPBB J9Wy95;);B B yJ;WB! P) BDPB=.B;BBj;G9;BB)L
GLY5YB2#BBB/LY5B =. B`.LB/L =LjW;@B`L5G
;~LLY)GL@;;;B;=ByBLy\G G.L=BBB;WBjW=JyL`\YL55LQPBLLjj*W\
L=\y.L\L) L,PGG)Y[GBQBy)  Lj*yW BbQ.j)WL P;,=WB,`GG)B,,BL*WBBW
LB,,BW5,GBL j*LW).L*BGPBX`B`Y.;JBB yBL\BB?
LBL;L^jWWBBLG?BG.)B B.B/LLByL*GBB BLYPB
;BB@QBL)*B =BBPjGB@9 GLjW
GjW/B@BByB,LJ5L j5GG.;B)B`5LBLB `B59LGjLW,@GBG?J jBYG / b!jW?yBB
G' WXB)QW BBy*GW [.)`GbLB y[2B,B GB`jBIy
G)B) *LY)GP.\ L9. 9BBjWB BBLjyGX j5*LGP
BG;;B=L))!BQ2`WBG=^LW.BLB.BG;BjyBGYPDBByB P .)2;Py
B 5BPjWB.LB LGjBW`B,B Py2 ?) BB [L
1.1. Review of Existing Approaches
jByBjGB.!;5,;/y!BB2,;*WBj^WW!L'`B^W By
9
;

BB,BBL9BB; = B)@`WjGGjWL,y2;;GJ ,BGLBB' .WB jW 5LjWBBBBB.G );/PB

, ;G;!*5 GBBjG22tQWBBB*GBLB*B`G GB j`GGjWLL LBb)BL`y^WLB[! ,B*/[G)BjBW,I=BLPBL),5G
BBLBBLj yG j=L*W, .P, y ^)WL,=B;B`BBP)5;G// GJWWP*G2.;BBBy,GW;B;.BjBW, bWj=BB. BBbB. GBJ)GBG
GW;yGQyB 5 L?)B B)yLBYjLy2 = P BBPG)B jYG)?9;B/  ` jW, [jBBG/2By;^Wy
G B` 5! P B; B   j*W`;,.GBG 5 LBIBG!Q=B W;jBG`BB?B BB@W/ LBB;B jj*WW`B
/ B ;B .5GP jWPB,G ;LBGy^yG  BBB)y,PGBBL=!PGBL))=L) L;,,WGLB5*PWQBBB,;;BjGG
B BB;B 'BjYG G;G G  B = L* PBBBBL*yG2!BB ^W@,25G GWBBBB;GyP, jGBB B
G`L .Wj P) BBBB)?5?yLy^;jLWB.yL'LG;^W,BG GB?BW,;)jGG?!Y\G= BGLBLL;P)GLL=By.jG@=;LP)BBW)B)L;JyW^
L.B6`;yBLLY!yjGLW GGBP*W ;BJBQ*;*DW*.LLWy LGB;.Y );PG@W BX \L9BBGDB
@G\#`)By`PB5JGQLL!;G;)[,2WjGW#)jGW `XLBy),BB * B B! ^G QWBjW)`;GP*GBL=B^W, GL5G LyW,;,.BB`;
*WL?5@YjWL6BLLj;`y5GGBj.  j,By2BPy =L BjGGLy

Y;;BBy!QG'y*!GW`#W~`BB=*;^2Y`GGB `'jW DL`PBB L

L

9N

i

ft

fg

Gi

}g

iTj

)L

u 3v

9N

}g

RTw)x
`KcmWrsyxz{`Kx,UDr6x+m|e

9N

)L

9N

i~k

g

9N

i_

i

>N

L

Ry/[pXccr6Wx,Uxz]_[`baXcUXW#d]z
x+])x+mW'`s)e

pi

9N

M

)L

9N

9N

9N

.g

Vi

)k

i

_g

9N

i

9N

9N

)k

)L

)L

i

9N

u 3v

)L



+>b+|Xb>|6

M

G}G>VpZ=pGb6

M

M

i

_t

i

u 3v

GN

Pk

' Xh

 X=6>= 
;
 
 
E   
n %; n3

  ' n> )
    '
/
 
X>
E
=b; >PD,|n 
  
/D 
 

yL LjjWG   Bb2B;'BBy jB jGBB^ WBW[,BBL

L;B yLW;2'PG,BLBP)BBBb*WLLI G,PL L B 9 . `By/
j*W BQyG;BLBLLIGBy)LPBQ; 5G! WL ,2yyW 5B*GYP L
^G`,=LGLP5GQ y 5*G*@YBB
jGBG!BPW,B.Q;jGLGB@` BBy,^PBB[G,LG*WQ B
=)L@)W^WB`BB@LBy2YJ 5G B)*5 L. @ B B6yPB5BGB);
=[B ! G;LB`.Y,yLLG@BB;BG/L*GQLQW BP;G\LB`GGy#W?
jGW'G9;j*;WB\ )GL L'2B B 9\D,LB ) G!` L[ B yj\,^*GGB =[LL *jGGQW
G BBy2)yQ.;B=`GBB! Bj`yG* jBy jQ*j;WG,@LJ)WBP,G)W y,GG
BBy L ;DBL.\L@B'GBG yW; jYGP.L\L PIBB\L*W B
G) j`);PLB^W, Y.;\B BG) L,jYyLLyj*bW jBy
)B B @BBy) 5L*GGDB!@  B,*GL L.G\ \?[@GLBW B/5YBL
BBL5LQB;yy!`PB jQYG;Q,.L*\ ,@ =..BBL)=B
9 BP6P !? WB)y, \L  9@P
 `j*G. yG 5*G!W5 G Bj/G5L)`,BB` ; BjGBWB
LBG5 B jBB BGB BL25/,PQB) 2j)G ?B.;BBYBjBB .Q G
=B^W,, ;L LjW, )G=;BB!BG)BPj/W!  WWBPj;WY
Gj@WXBB5YL  5jG5B,LL B.L; PBB/ WP2Ly, L 5YWLB,L;

BBBB)L=LBBB5L 2y
QB)BL;LBBB,G`@BP.;BGyBBP!jWWjGG@b) !BL LY` G QBPb B@,,^GB.j*=WBLL
G B;),@G;GJ@yjByy^ G@LBPBB ;  ;B@BjBLBj,)W=@LB,`  `G;9 ,jYLyB/y= *LW,j@y
BB
L *WB^WJWB.yLP 5G*BGB**W`L = ;BLj*;WBBBJ)BB B
Ly,G9LjG5L)*^
B @=PjW j*W GBByLL?
BPy,) 5?*G j)G9BBB)@jLW =;B'LB?,y jy
j 9;GjG= j*WY
B D);#2W)~5BG,jyWPByj W^WWjGQBjWQPPWjBP =LjG .
B LyB,Bj G B )y29^W;B =,W  D jy*2WG/YjWGB
BWBBB@BB, jG*WLB,@WGBy)LL))y W;j*WyB,5L2
B92y9Ly;BB,WB5*GLG?
,BBBLj;jGBW@)=L@B*5Gj PGjB*GWB BL*W\^BGL?GyBLyLB,W)BjyPBBLDBy52@^BW
PBBB BBLBG9jWGBy. jWYBGBy#BWj GBB@5L!B PGBL
ByyB,G/,BWJ`B 5B/\BL*WGXPWBBByB;BBW)@PBLP;GX
jGWPj*G;JB, GyL BjYYGy)PBLByB!WBB*GL
L,G ,5LB G;~ B BBBBB;G ^BWBB``B`L;jy
j
*

1.2. The PolicyMaker Approach

B`BGQBLB=  BP;W yPB )QQ5B. =LyB!G5jGGL.*L B

B jyG*BGXW/j)G,B!B;D,,)GYBGBB?D)WB P ! BYj G9BGDLB^GWBLBBBY jBBy

BBP5BL?,/P5GB@WBGBYLBy;BJ/ /jGB JPG)BY jG*WBDyjW L *WB^WJWB.yLP 5G*BGB**W`L = ;BLj*;WBBBJ)BB B
Ly,G9LjG5L)Y
GPGGLW5G5,*G9YL jWB BB G) 5 `)QB;PB;=L/
LB.jG,B )LyBBWWXBB)*G )BLBPB ! G2B. GBy`Q BY G; B B @=PjW j*W GBByLL?
B *;WB?)5,L9P;B.2*Y)G  jB*G`*DGjWWBL,By;Xy)BLLBLG ?G

j92y@GB)GLy?

)L

6bi

TN


)L

Xt

u 3v

9N

M

6t

u v

)L

nt

)L

9N

BN

BN

u v

u 3v

BN

9N

)L

)L

_t

u v

9N

9N

i

9N

9N

BN

+>b+|Xb>|6

9N

9N

9N

k

~k

9N

Vk

BN

9N

9N

9N

_k

6

9N

bb @= nb

)=Z

6

nb n=

}=

BN

b

nN

9N

=N

u 3v

9N

g

i

fg

i

9N

9N

BN

9N

9N

BN

9N

bi

g

, =; 
) = n >bD @

3 6n X
>,
FGn ;n X6
 

/ D G++ 3/3/ >X  Z

9N

9N

 ?);/@yP;jGLWyy,@ JBGy52G 9 y~5;GB)BP=BLW 6BBBB` Wj*WB;/;jW

BBGJB`B! BLjGPB2ByL*,.L)B;QGWL@jBG@BGB)BBBB
LG;)By[)YbGyL bj=W*@BGyBj`PjBWPG)BQjjGWPBG
yBLGL;yB )GB!jWG!L5= BB;GPB;LD * ^WBQ;/=) GL
BQG#B=LBLB L;LB;L^WBBPLLyQBQ` LBL)jBGPLB
^LWBB^W)^W LXByLBB;QyGjBy.2j G5WBBL;B@/,GBWBBPLL2G.)LYY;
^GLjPW@yyLLyG;G,)) G);BBGLYQ BBWBBG*,GL)L,BB;B
j.GLB Q GBLB)P*GBy#BW`BQ/B)`jG;B`L.)^yyJBYG/
L);QGWjWGBQ5`L`GB ) )B5B ;B5BPLjBW!G))B;Y/Y
G)BBWBBP)GLB2/;/,5W!WQyByL;/L )y;2ByQ,;;*.,BjW
2,G,)L);@2,BW,5,^GWBLB ^LjPG.B*.BG`Q;B ,;BL;y9Yy 2 L)jy!P.)jBG
);/2
B?.yBG@G;BLByyyBWB/LQjBWL .BjWB ',BL=yBBBB^)W;/!BI)L/5 G,PBGyG2 GBB
*BG `5;,B ^;Y\ P!;;yB;B)YyP`jLGGL*WYj;YG,B)J5BL!W
LjGB !By y! B.;y 2GLj@**BWWQ!G5Jj G^W, PB,BB2B;`WBGLG.y,2;;BPjBYG Y BG*

)X* B LBGyBLQB)W BLBL!GBjG,yG`BGj,WLG!B B ;G/G/B); 5;

GBB/ .B!;B,,y9LB=X`BG ; !G LB )Y/*W/;LP)?5G=;9B ;BW;
BBQ,)BG QW,;BGL9^,G)BjWB ;*'=L/[*BG) j 9G;2BB5
2LGBB L. BjLGLBBBPL)G;BPY@ j**GjW)*?W L) *BjGJWPBW,y2BBL2PyWB)BP?XW\L ;BLL
BB@);BDBGj B;B,y!^WL@L)2y=?BBD@jYLLjJWBLWLG)L!;BG
;Lj;WBBBy L;B9PBj;LGy )jPyB; 5)*GBLBBBB;y@,*W Lj;BPBG
B`2GL` !G;B. ,y^B5GB) jGL jWWB BBP5 BGBy.BG/
GGBB. Q`Y,;B,;.YP= B5L5=LG@GD,P;B;) BYBG?;BB ;
jPGBB?;,B,;)LLLWLBjW9=L.=L;),GBLBL/BLB)W
9N

i

)L

u 3v

9N

M

jB` P) G.)LD GGB,B;B*,WL;=^\WL,  LL,6WB!L`55G

*BGB)*QG L.jWGB=Pb=)L.PG,L5BBBB,=;Wj P5Ly2BQ,B;B
LjyWLBP9 BJB^QBQ;WBLP;B'BBGB2 BByB ) ,))GG;
BBBL;))!jBG)@ B W~)WBbB)/,`!YQB5QB=yW y ?[ G;.BY;
B`yG*^YWB^WBL )yX) jBYDGyYBB?,B;5 LyG jBY Gy9==L
,B9yG )jY Gy9\LLB?`WBL^WB^W2 B* BBBJB)9BY
BLy)@`Y2,WBB)L yj *GB LByP2BY BWBLBB
B5,L  ;B, Gy;L 5B*.GL *j*jWGB;Y,@,`GBY,BGQB)LG)B,jG)Y,LQBWB
LL/5[G5GBBy )B`GG; BBjQY B.y,LGB,jLPGGP)=PLY
BLyBBQGB,L*GGBBjBWBBY@5LB 5*LG;BbGyBj;.GGBY
=GL ,W; BB/B;GP= ;G,B;P;9/)P=).B G)
BL)/`G, BB  ;)`\ GL) BY)GBByP =G.jW B B@Q#L
/!LGBWy B,B B;L^5G^WLBBQW ;^yWBjW=W `y BWL/
jP5yy#BWB BLB;WY .BL5= LB,WBB*GL
Pt

9N

)L

u v

)L

9N

9N

9N

BN

fO

n=

}

9N

}=

_=

9N

XO

9N

9N

BN

)L



}.

9N

u 3v

+

i

BL
X

D D

2.1. Architectural Framework

G= G BB@G.B;L)yB* WGy LJ jjLGy)5B Q5GL)DG'; BjB`;@ILB`LLB;GjBLBQWjGIy;;^

* GG')BGBY)G*WBDLL5I PBB ?LJyjGGLGyj,Wy;;BWBB5L*BG
,BL;B*B;Q LG5LXyyWLBPBWJ?G9yWBBB);LXG!Yj9LGG)jB;Q*WG25BL.yLBGjGG;
BGBjB`;GWL*B ;P5;BBBBB.B@)5BL;!W ^WWB=L;
GLB?W)B@B;BL5;GYGDy*G L))?.5GB9L)BW?L?B W@BBLW5BL 
GGB)LP*WGLy)B@^WB)LL@)L!LBBQG ?)*^WG!By5LB?@B5PGBXBW ?;y;
GG/ PjG,BL! WBB2*G ?By 5*G,=WB j*G
B*;G*Gj 95*PLLB GBGG)WQ;WjGyQ;BQ),BBG;y

BN

)M

i

BN

9N

GXB,GLG,,L;^) BBBBBWBBLyB;BWWBB j**GG

`LB,QjG,BBWBB*G LLB BQLG;` GjWQL.*W2 j)*GB
)P!G. j;*Gy!jW)j2))BBLL BGB`5yLj;Y*;GLLLW jBGBjy=
,/QL;BD5jG55*t jBy ,yPLY ,9G=;?)L`BQBG.@ByB j,YGWyB*
WBL5GLG9B! BQ WL;By
GB BB;ByJBB*/;G *@j**yWyXJyGG)9 y\BYyBL@;j WGJWWWBG !j;)By!Gy ) LB
jLG;PQGL BjWBBBL5B ;G)@)/ jLyyj!BGBBbByB;
,GL !)BBB!!W;Q*QBB))5*G 5 [ jPGB`LGB,/
G D;9;B)yB,BGBj,GyJ;BWB;W BYGBQ5 B!B y5^G5L5jY
GBL yP2L  5B*GB))QjL=JBBW;,BWL; j@WyB B;Q;jG
L.X=BXW;=B`yy!2YBW9).LjB^BG\ ,)?  jB;BPQ@YyBLBGG/`BB9;=2YjGGU2
j@ B`GY;QBB\WBPBL5BG;5yBG/P ;=BGW`LBj[;*W
B)B@)y2;;G? \LBL^)BY6WJB`B jYW.B9 G5@BjW?
BBBDjBYLGjLGWB`Y!LWB2yBLy/ B;\=`BG?@^WBB
LB)`Y;BPB5  jWy*, yt 2YGB.5LYQP5,)Y=,?5 LB)B
BB`;GGBB.B.BLBYy!W ,ByL;^[W Qj5/=jGQ9,B
LBLBByL*)W QB*BWQ^*W5jLGB`GP,^G;;[LBB;y*W JYG
GyBQ5`LBPL).#BB jDGW^ )B^;GB)jBPbGByP L);B#ByWPL,); *W?=B5L
GBjB5BL jL,WBB.PBGB`jG`,GBPG Bj?GBB, B;BBY
G jGD 5
GL?yL5ByG/)bPGjLyQBy,QLLBLBG.; =5 GWW; BWjG!WWByBB)yG;QB)*GLLLB
B*LW!.LLyYBB=Q^ WWL\WBL;WPDy2 DB)?B@^B/B)BQ J;PGBLB.!2B)G.) B YBY
jB;J)L!QGyB,LL=[)Byj G;B, GLGLBBQ WLG
BLGP2BjW W,WG2`;GBGB?;LW*W L`B^G)B), L*WLQ)GD)ByYPY
LPBQ*WGBLByBQ,GBY=B,JWBj)G;yL*,G5LL,)G;` GjYL^
9N

9N

9N

9N

9N

>N

BN

)L

>N

=N

i

=N

%N

9N

BYLG L jGBB?)B9?.LPyj;,G\LLy @[ByG)y)L)B).,yB2) )Q)~2BWYyG

yB/`jy,GB`B;WY
L

2.2. The PolicyMaker Language

BB;yBBQ j*W;jYWy=BB)y WLJ[2))BWB#[bL?QyQbyL;BGyLyyQ2P)~;B).

G?,BP)B;
`;^.Pjy,5 =L jGBG,W
GyL))PP;*GD5L;
B WG9B\L
T

   
     
!#"%$'&)(!+*,"-& .

BBBB 5L..D^yBBL@BG.WW`BBG;*G;BLG;/W5;Lj`,B;^LBW LBGy9!!5)WG

By,?B) 2GB BWP@GBB)?j*WWDLW)^YLD5GL ;)B^ W,G5)U;
*QGGB*GBBB.*GWLB`?WBB,LLG;5L;=?BBy BLLByP;*`GjBU
Bj=?GD5GBBBG9BBB;JB`jGG/Y*;yGB.D;jW?yL;WG
L;Q5jW; WWGBLB2PG).YjGY5?B L; LBP,G;;`L ,yL,)B
WLL`BQ2GGBB;yGy Y;=BL; j GQB B;=.;=G;/
*BG[/G`LLL;YBBB,BB))yYGQ)*!GB; L9B\*yy@L
B; ByB,BWJ BBj)y W; *D;YGyBGbLB;L)LLG==yj2WY\2*G*
BGyB)BLPY9yL,G y*G,LYBGG ,WGLGL9yBBB^W*\L GBLB^WLLBB !jWY
9N

N

(/$102*43502!-62$'*"-!#'(!+*0 !87:9;=<5"?>?!@

*

L BBLBBBBAj L;;*G,jBWB y*,GB`,`BBj QWY/GLB.G9BjW *yWB GWGXBLL)

LBGL;*LG`BLBG ,BWLB; )BLB/= AjG\;)YLB'jGy) 5BBQy*)/[BBBBB)QBBLy
Lj;)BB`,)^G L^WB*~GWBBB./GBB\L) )G!G2
LY;; jWBB) L/)PBBLBB`.PyBLPyBP)B 55L! QB/BB
WjG,;2 jW ,G`BLBP
;=Y @^GyBBBB*WB y j`GG.Ly,)jLGBP,B@^)^W,/L=CB=L
BG`yG jWLbBQWB?`/LBBP BL) *9)*W!^B)GBLL;
,)G)B/PBB.j G;G W

BN

Vg

i,

_g

i

BBL jBG.^WW/\)B jYWBB; W5 . 5G!BWBBB

2)`G;,)^WD`));y L
=G ^*B=\y@ LGPWB W Y/Ly2)5[I,GXy^L WjL*QGBQ,jGG=WB GB*BW`y,LjPBW B*
WjGGBBLBG/,WBB)L)/bP`B jB* 5LjQY GP))BY
BjGyL;*YWJG;G`)BLQ.GL)B) LBB)*GL?jW5P*GWByQByBQb2LYG2
5BGW*LG5PyGG;Y Gj*WG)YQ;;^WW;Q*LWLy;B*2GB?B
^) )W,JG;B*G9B5jL)!B=PL,2B; BB)B ;)LWGJ9);BPY

GLWjG?
GBPyB BL /PW~ GBy!)LbW!LWBBjL5., BjLy!)W,B BBj,!LGy)25PBGGG/W
BB`B`LBWBB jBW,jLGBPP,)2tyB,B ;L!GB`5L
2),y2*;B W/LB W BBQB*
',LBy.;;^GJ`,) B5B)D
N

9N

9N

.g

i

>N

9N

nN

VN

^jWLWB B5BG?, .Gy=BL* j*W BQyG!BWB5LL=GBLY#LBB.;LB^WY

XL;BGPB G` jjG,j BBBLGBG.LG!B ; jB!GGyB.LB)
GL,)j
LGBLB``yWBLLBBB5BGB.YW=,GL,BGPB5BLBBjWWXBBBB)=Y`=GL.;! ,yG
;BL) WLy;=LBWWL PBB B;By2;),QGBBB!*WLLjWDP;BLy;;
^WBBBB))B, WB LB5Q ,BL`*BGQjGWB PQG!jyL jy
;BYB,BW,BL GLB W;y
,'LG;. jLL* G)P^W=) LGG LBL;G2BWBL*BW*bGL5G ?By WB\Q2*GB)Q'5WB BBWBB;/*
;LB\*[ GBL5BPjYyLLy;!^WBW Gj BP BjL^G P5 Y6L,G
G*WBQLBByj5W@?@L;WBGW~WBBBB^GL\LL\L yW BLWjy G!;!L.; B
BGjWGY)@)BL,GPGIjyLjBYBL =B=L[LjGB.B,*GGB5B))BW
jBG.GP,YG B5WB@B/`^G)L 5WBj.GB*).Bj!GW?=, 5BLP
GB);LB^W;9J5WLBG Gj;?B BB,L#,GB)BL`^WjGL )*P\GB
=BB!jG)GB?LGyBPGByBL*GPB *W)L)BL,PGBy)B.BL* Wy
BG;B*WGB)BBLLGGB.B\BBBPGB)B;LLGB B)*jGBG@,BGByyB^W5BG
PjGB@y) jGYBG)yL^W,BGjLW?\@)Gj).By*BWB[W^GB
GB)*WL
N

9N

%N

TN

hg

i

9N

9N

ei

N

2.3. Query semantics

LjDW[J*;WB,5P?JB#Gy;BGLy=jL;G=LBPGBGyL2j!)YWjB!G.B@G*)9GBBBBB
j*G2WBW[B55=yLLQG! jY;G[Bj;P`G;BL*)WJB;,B
GLjWB? QG LBy WyB 5GBB,,BP;B
GGBDBLQ*W/BBjWBJW;BBBQy2jWGB!!LW;^5WP*LB9B )LL@';^GLLyW2;LBG9)jL,9GG;
G!BW;B, )@@Wt,W)yD*BW@5?Lj.G5DLWj2J)G) ! y Lj)Y@GLy^
B @B*W^.L G2WBBY;/BBBByWW )9BBG BL;*y/
Lj^WB=bEB y BG^BBBPLyGQyG,GPG5Wj[; ;jL; 
PF;BBGIL.#H jWQBWW) LWG/. J BE B jB.WLJQBWBjG5DP;GL BK`D;GG)B5 WBB F
jPB j )K? 9 ^)BL; y;B2;BBQJH WE L ;B
F GIF GNMM
M)GOFP

F PQ;*WjLBQGB FP;Q D\#B`;B

LL;;^^WWB!PP,BBB..GBLB;L, / B B~GY5)~BSBQRPG+EP PLBB
G)BBBLBB;B,GBjGBLW/ PG5BB2Y?LG);YB5BLjPGBy*
F G
F GTMMMUGVF P PB5,)^jG F P Wjyy2G
GBBL/BBjWJGyB))BB\ y
+N

%N

9N

'N

nN

9N

hN

nN

6b

6b6>

2.4. Signature Schemes and Filter Languages

jLG)L~LWBBQyyG,BP^BW;LL.Y;
BBLb/BP*G `LL=jBW;BLj,[WGBB,[LLG
j  9@; L,9  y;jBG`bB;LjGGB[L=G) BjG G;Yy
jWQLy2) )LjWBBBB WQILGjG='Q[)B); jB'QBW)L;
X2W2Y2W)Z\[ ])[Q^_a` Bb)c2;d2 eajf ygih1j)Bk l)fB[ g
L^mLhm_mGj) `ak Wb Bln[c2f2d )gae 2y Y
BLBW;XyLBjWBBJ^L)jW,BL=y@W*Y?)y)PGLLyQ?.WjLG
X;BLPYG;.B B;\^PG;BX)yL jBYGJBW,G)BLBG@/ @55LG
G B. L 5YyL.^ 55*GGB~WJ2B)jW'y;L BBGLG,;5BG
L;!B ;QLBQG y jYGy^PG)/
9N

)L

)j

9N

9N

9N

u 3v

BN

9N

 jB*WL^GL))^Q)W!W ? 9, B;,^WLL)
L^W;,,j jGG^2WGBj.Ly*)  BQ BGBBj ,^yU2= GGP;BWBBQy;y L)BBW
j B  WJj BLGB!j)G BLBy?W G;;ByjW`B;
LQoLD5!QDWYB= `GQ,G@GB jG! j GBB B 2yYG?, ;
^BYY\=  P BBG YGY= ,.G)GBBQjGG*By)^G p2YL ?
BLB/)L)y*BG='*^GW5/BW);W WLBGBL`5G;Lj jWPG*BGjjWG5QjL^U= WB;G;
 ^WX)L)`^W=,B* ,BL);)/,GGBBQ;BB,;LyB)#^GU = Lj
L ByW^GBL/BjBWLj.!GPBBjGQ=,L9)yy,LGJGjG;BLqBp2YBLQLy
BB yLjGY)?L5*LWBB j;y .L*GBy*^GQj)YPB,QBBbyB[
L?5 yjGLLy ;^Gy)^Gy ) j B PWBBLyj WL DD;\LyBBGBQL
jLB?/\L' y,LBBB,DB5GBBJy2;YBXY  !jBL`; LjB
G2XYYGG.jP*GG`B5 , ;B5J* ,BLyB9yL)
GBB /B)WBBy2;;5L;LBy2;BY LGj;GG^@GLB)!B,L)G;W\yBL2B `W*GGL~ jWWj,BBL
L;y5@G jLByG*W;.) B~B W!;y;2)L)G,;P,y;*\L y jL
^jG5GjBW. W`)BL!P;5= jB`*GG.LGjjGWW5L?B,P BBB.~B`GG!P!B
B^`BBBL`GBB BL;/PB*G`5 =B= yjy?G)LjWL
.LjG,~LWBQGBWB^P;)B j5G`2)G9B;WBG;LL5GBL
GBBB!yQ)*GBQPWBByBB!?WD)yG;?BQj GGGB?jGB*;W5G
B j*GB@BBLB@BBQ G GBLjBG Wy@yL j YjGByy!;
BB;B `L)BB)jy jWBLjWLY
| s4s D v uxw s 
r t
)BPJGYLGBLJ,B5JL)L^WP52Ly)yLBB;)/^=WyL LB j));)GBW^ GBB;By*GBLL?/
GB QGBP 2WBLGj)WBLYGjWB !*W.BBB;.=;BBPW;~BG)BB;
B/ By!5G;By*P, G)jBW@YG9*G?P 5W*G!LBBy^GWBL5WGBL
9N

)L

VN

i

3O

O

Vg

i

V 

hub

hN

VN

nM

=N

VN

fg

i

.N

=N

N

DN

i

9N

*/GQG.L5QyBJB*^5WWL/j2BBBLB.^WQG,BjB.*5WL;L`B5GLB=`LPX5WjBW!LyL 5BB*,G);*
BGB.^BWBB)B ^BGP) GBBjG*9W9LB`;`JG)B!W,B BGGWBJG QLB)
GBBBBByB@GBjG9 \LjWJ;BBLWXLG;L=B`^WGB/y=PW,BB?9/W
QBG W,BLj2WLj W;BG ^G QL;B.LjGW BB GBBB *WLBY
BN

3.1. Email system

/;GBBL* 5 B  )BBL5;QL,BGJQWyX)jyW/`LyBjJP!WD;G;BLy* 9I=jWj G B;

^WB .?B,j y jW.9G,BGLG GBjGB@~\`LB;yyB)B.LBy
=^WL =B `GyBjB)`yBYBGB;*[B)LPPBGLBB!L9BB *WB/
L;GBB.BB

y2z){m| Zx})~ hk

z2 f U)f  { Z { g)f g/

jBGB*G @5Gy? B,B.^GU,@LWL jG =J W GBBBY ;BjBG

B*yWBB/.BjBY ,BPBB;WG B, DyB*GBQjW9GB
GB LQGyB*5BjLGQ*9/yJ* W5*G =LW LB; *WWBPLjBWL5W
GL,)L\LB.2
_g

GN

9N

_g

>N

i

_gk

BN

y2zn{m| Z/'2q/8
za f nf  { Z'/2C
''ia) '

jPy!L,PjGBBGLByB@GBjWjyLGGLL@PBGBBL*jGWP !.!,LBBWBB /

)L

a'2S'''
'' 
''a2'
''''a'
)
' '''''2''''1,
)-'52'2'
',a,
5,=',a2'

9N

i

B;BJbyy*2GB` =,L)B .jBjGjyPY@LyBW,B;,BBB5 GL)BYyG, `Bj.BBL;GW

jBW ;)j,y;5;=y `5GB!?G@,By2,;JWBjY LG;^W,WBLBB
BGQL BGBGj9W@ B 5L D ,jLG;P !j5WG* B;j^GBBB*.;`)jB,y 2)5.))?P, )GL;
jBG//BB=[[By2y/L~  B[L`,ByP\j)'BI[BB
=/P,) j?YGyy2* LB.B\jW6B)?
BBW,BL , 2BB!)BB`jyBLB
k

~N

PO

O

)N

N

B BBJ L;B5BLBB.;,BWJ LB GL?WyB*^ .LB;*BG 55 LB

^)B2~GL);Gj`GQBPB BBB z2, f U)f  [{ Z ByjBy*'GQB)jW
^BY ; ,X ){ gG)f g/ 55G LB*GPBLP!B5G,By*GLB jyjG?ZG
jB?yB jYGLy)PGJByBB *!G LPW2LB B!LGjWLyaLz))B{m|?y
BG/X) ,,BB j@G*LGYWJB)jLy/ .BB)B L Q `BL5J

Z'[])[^_2`b)c2d2e2f'g/h'jnk l2fa[ g
^mh1_ j)`2kb l)caf2d gae/G~B

L
.k

Pk

^g

'i

ByL BjBYBGQGPQ2BYG;2YG B~ ;),B,B;*I;B`By;W j`*`GB

 BLy*?WLBBGQQWL *jG*Wj,.BL;*WL5DB=BB2y?
G@Bj =)B)=LPBBG^BWL;Y!=GJPBB j*W; `BBPj.y25./
=PWB)jLB/P) jBB)j!WJB,ByB))BBPBLLBG.BB) B;
*;Gy,LB;*.W=L;B;2)G2 WB *W/.'BQj*GL;,*WjGL.[;/
^LW;Y BBB*yGP LBjG GG;P*LBB`^WG 5B,;Q;BBL /L\L;
BGB WYB`B5@PjLG;*WL WBBj**GGL*;/*jWG!G5@yjy Y5
BGLB;/LGBGByjW^G)B^ GyyLB 5P*G;B G,BLPyL;j )
^WBGBL.\LB;/;
9N

i
k

~g

'i

.g

3.2. A Certificate Revocation Server

9N

i

9N

u v

.
k

Gi

)k

a'2S'''
2'''a1,n','1''a
' ''
'''2'''
',,X'2,4,',a2)
)

i

9N

9N

9N

9N

9N

'N

)L

9N

i

B BQG5L )W, y ^WLBLB)  ` jB*W  b\LL y L

9N

21'','''','
',2
'''
'
2''a2'
''''a
'2
' '''''2''''
''',52'2)

jLYLLX`LGB5BGLYLG9,B),;*BG)y )j *WWWBB )BL;/BB==yBBI55LL

9N

'' 
'',a2'',
''''a
'''
)
',',2'
',)5,',a2

B,)DBB

9N

BN

BN

3.3. X.509/PGP Certificates as PolicyMaker Assertions

BB/!)W5LWBB BQPWBL;`YB'L)B5P;LBGB,P)5@jj**WWBLL` ;=^jW/Y/

j*QG` ,B; y$W[QG WB B!*GL LQ;/,5  j
=GBLLWG*
y j*W;~

QGBPWBBBBL*)B) BjWyJB*BGy^ =BBGB )W*WGL@WL

LBPGBjG=*DY;BLB;/;
9N

9N

9N

ht

u v

9N

9N

3.4. A Simple Workflow System

'' 
'',a2'',
''''a
'''
)
',',2'
',a,
5'J',a2

GB

GB ;j*B,)Bj)W*;B,)jBLjW=L ;BGBB*BL)jLG;j,;G9BL;yB9Xy 2L))2!^PWjYLBY

LBj.GB)B;*W 6LW)B!GG)QLL`jGBBWB `;BjG j\L!B.BLGG
BLL5GG)GQLB,;*) WGB/LB/ ; W Lb;BLL/D2yL*/[./B.L/B;B**GG9W*
jyyQjWBBB,..y/GLLB WG,/,y)  B`LQ,^)j,GLj5G5LjQWBG
G/ )BB= BbBGBL B,jW;[jy
BjBW*^.5G\LIL)B~)B=j~WG/LLBB;BjW5,G;I;BjG2y
BBB LB))W ~Lj)GG!'/BL*BW)I!GB)BLY)GG,BP)B,jjY;WB;[BBIjGyLjBY*
GLB;*),L2WB*G?@G)),BY9jG.j
@

9N

9N

'' 
'',a2'',
''''a
'''
)
',',
,'
',a,
5,=',a2=

BB,!5)Ly BWB QByBB B `B,L

QjGWX9*GPBG)jB)GjBB@;BLG/ WGj D,yWL^ W,LyY^ WL Y; B
B)BGLLBQ G9 jGB^PL?!GyByB;BB*G.L)^GGL.2WB W;
BG@BByQ;=PLBWj WL G B5 L)L@)LBB ,By;^*W LL yB/P5L 
X

)L

BBB;G5P=L) BBL?y=P5GGLBjWJ5W;
*BG jBWG B)``LG!y/LBL9Q5bL,,jWW2^ G; jWB*BG.2yyBy` /5`G*!G*`G B
GB2kih1/Q 2 B` } !BW,,)BWG5@G)=#LW 5 G?),BBB,LGy52! L
z
9N

BN

^^GWPBBjW;yXLyGB; */W B LGDBBGB9^*5GG*?W)LIBI#=L jGG*G9,'LBjj;WW

BL;yBB;LL)LL)

9N

u v

)L

9N

','a' x'''
',  ' ''
'''2'''
',,X2m-;,a
',)
','a' x'''
',  ' ''
'''2'''
',,X2m-;,a
',)
','a' x''''  ' ''
'''2'''
',,X2m-;,a'))

BN

','a' x'''2'  ' ''

'''2'''
',,X2m-;,a2'2)

GX[BB=`))BjW/LBWBB*GL,P

)O

9N

BN

' '
a,'
'''''
2a'

',
','

', 

', 
4' 
',J,a,'S'''''
',a,
5,=',a
2a+;,a
',
2a+;,a
',
2a+;,a'))

)L

)L

2GDB2!pL;G?5LQBG)* BWyBQ`L)LL;;\L=;B)P=)L)BjG L*

B9GB;G@BL,BL^)W ;Lj WBBJ,WB@!;BBGJGPBQG)WBLW

9N

'',)'
S'''
, '' '';',)J'''
aS)'S''));','a' 2
' '''''2''''a,S '' ''x',
a,a',axaa,'2)'''' )

M

' 'S'''S'',)'

' ''
'''2''''
','',n,),5,',a2)

M=

Gi

  B ? JBB vB 5 
? By Qj@YD j G,2BBB)B;9*`B)P9;B yLjW/D;BjBPGDL^LW;,BB9QyGLLPBGB;
LB;;Q GG BPQ!G L ` GLBBLB =QL.IQLBQ BjW*!LG/;W=LByy!G`BG;WJBW`B*BLG
*BG;BL@??By/=LWjWGB! P*W)^jGyB@L 9`jWj!G9B;B^W
P=PB jGB`B j*WY
^GWL,@B y;L ,LG5)GBByQ; GGB.G=BL))2^WWB;QjLGB5G./;;L;BPB5Y@!WBG G.)L LGG ;
jGGBGB[jQ G,L9GBX)B**G)j@ y*G G)BLjWL`y= L @5.*GGPBGQ)BGGBYbBGjL!^WB,,WWB
*jGGBjBW,BBB,`GG5GLLy,B;.G; ;B ! `BLBB
2jG//GLyQ=* jW;BGB?P;BB,By,B!)G)LBB`Y*GW[,5QGB
*G.5^5GB BB@GBBB@WjG,;
^;WLB*W/B,G.B`y*G;/,;;GB=.@,L;BB LBGB,@WWB6BG/
BB,G,;B^W;?YW?BB/25,9LG;B;5L)BB BWJY9BB?BG)WBYBG*BY
,L);?5GY?P)5 ?,yG)LyLDDB.BB, ;B;BG9B.G5=GL
LGBBBLyL/9DG@WBB,jG?`5?GBjBWB;.Gy5)LB;)/,?By;
=GGLGBLyByjWB,B`5G))^yGL y YW2BBBB!BG*)GLBL^YBW ; G) !W jB*BW5LLB)GWBB
jjy y=,LG `G5LBLBGB`=BLPB)BB B)  BBLP)*BB
=LBB9.@5)L`BGj)W LWjBW@;yBD; 5*5G Q\ ?GBBLyBB@yGGyLyj)^WL XGyLj;5G=L),)B;
B^WBQB
jBW@BWBj GL!,B5y2BBQBBWLL@ `BLBB;L*jGWB^LG`B;@P LB5@GB) 5;B;yW,
LyB)/yB GL;yG)WLjWBL.WBjBW*GWLB?.GBB j)YGBy
~5LQ!WB jBj *G;;WBGB9`BP B5L.5;Q *G*=WBB
ByW= yLBPByB*G*jB
jyBLBByQ;jBByyy*P j W,yjLYYB5);*G=L)!B5GLBLQ,W)LBY
=B@`,G5jLWBL;;5B=BByL Bj*GG*)yBj*G)yBy*G;GB,,.WBLBB!*Y
BL * 9GGy@L LyB= ` GWj9WLYG9B;yBB=B) BBB^y/.G?B9L5BjyY

>N

9N

>

9N

u 3v

GD);`,Gj@WLjGP;@99PBYGGBQGjLGBG))B ;G;B2 B
G )? WL,;B;B5L,?W B ) B;jjWYBLG;WB* \L,B ,LJBW@L `D52G\BY/
AjY=Y )*
BL)BjG j
^`G;=P)`@GB,9*5,WL/;/BBy2*G BG.B=PLJBWL=jLG;B*Q, G ;`@BjGW@B B,5LL;/
9GP5B,BLL5 YB5B @?*! ,;LY?`/9*
LGBB22WW^.)j` G)GB.W*G^GLLBDLW)6X`BGB)L* B;QPWLB
^G)BLB,y22 G L`BGWBQ,;LjyB,QW;L  ;LyB .BB/25 t| ss   w#" B w
GBBB`*WGLB`;2;.\^;GY L #=WL@yjy 5*G~)LB)QBWLL
YL@Qy jYG~ ,yLB)G;BWBBBW B ByjG=LGY?9GD,GyjGBJW,;L B, $)WaW&B%(Q'W L}n(9%D;
=L jG*;GGB.5;G5yQ,Ly2BGGB;B)`5 L2,GBBBLBBy LJL fiak z  { vZ { z hkt})2(%('*))
f2&+/' z /h',.-/%('/%
,;G?\BB LyBG9B ; y
lU'~ )k z ~/ '%&021 43
/B~yLBG5BGLyL,?;LYBQ QGGPj;G!;WBB)5*`G BQL5,By^BG
5 { z hmk})2(%'/))
f2&+/' z /h'%&021 43
2`L;?;5LB)W 6GBBG `G?jWL. ;jJ;Gy;/? W5LBD 5@X;BjGY
B BLG)BB,.BBP;`G@jWGL9); ;B;;G`B`/!; 6 nk z ' Z8z 7k ) ~/h{'29jU'/%/:4 $/{ %n (())%& 021 43
LBB~GWB,BBLB)WG BBBL;YGy2yY[JWBBLLB G= Ly,BB/ { z hk Z;7k 
j
B^WQ;BjWL`G@B BLQW 5L;;yB;
5 W 21<
G*BWB,BGBBBY
7kj Z'/')k | 43 ' z 
 B
J | 
f a&+/' z /h'vZxl'~)k z zn{
5 7k j
)# W Qo^WD =)?WB W` LxDByLjWP`G=B=DLBD,Ly2
l1~ )k z ~ 'vZxl'~)k z )f | k%/:4$n}2)
=LByB;=)DL,;L`*GyB^U=Y
l'~)k z zn{
5 l'~ )k z )f | k=%/:4$)}2n
l'~ )k z z){ 0&02}l'~ )k z ~/ '

 
! 2!5'LBYj DB'.  yBLLL5.G!?LWB? L92 YLpjY l1~ )5 k W(z '/n%(f >| k1m }&Zx)&}% 3&3i )2}&) '
5 0&0&% 3 )2}('/<
BBL;/;) DYGBB5j )
5 }2W2W221m }&)21 3
pj B,G) .?` ?DB
/BBLYj`B!B;Y^BWX ! )D\ ) Y ;B 2 *y L?;LLy;,YL* l1~ )k z z){ ZL~2 f 43)f 'k z 

.^B*\L. L\
LQDB5^)BG*Y=
B;*)*A5)Y=\Y = ^BB\YL.L;y ~2f 5 )'/f %2 Y&k %&@aZSW }(,.?&,)}('&>
@L) DyL,B5G . )L W G B 7k)~/ ' Z 7k Uj
/2L 5GL,jGXyy L^WB/WB,QD9)  BB^BY \LB
BY
5 7k )~/' 0.02}97k j
)*B \)jLj\W=L B?L.*LW^!.YBL=~L h { 2j { vZBA 2)~a~i' z 
/C
5 ,&-/%('/%l1~ )k z z){
pLL) P BBLBYQ
BBL;/;) DYGBB 5j LB5[ B[  jYGL=
bj

k

fO

e b

6v3vK

b

6vv

BN

9N

9N

k

i

>N

>

bv

b

6L

bv3v3u

b

u 3v

6v3v

ub

O=
j)vu3vK

O

bv3v

+

X h@