Ian Glazer, Senior Director of Identity at salesforce.com discusses relationships in a Breakout Session at the 2014 IRM Summit in Phoenix, Arizona.

1. The Laws of Relationships
(A Work In Progress)
Ian Glazer
Senior Director, Identity
salesforce.com
@iglazer

2. What’s the problem?

4. firstName
lastName
email
mobile
ou
nickname
title
…
firstName
lastName
email
mobile
ou
nickname
title
…
firstName
lastName
email
mobile
ou
nickname
title
…
firstName
lastName
email
mobile
ou
nickname
title
…

7. Reasonably large
number of identities
with a reasonable
number of attributes

9. deviceID
firmware
deviceID
firmware
deviceID
firmware
deviceID
firmware

12. Unreasonably large
number of identities
with a few attributes?

14. Reports To
Reports To
Reports To
Works with

15. Reports To
Reports To
Reports To
Owns
Owns
Owns
Works with

16. Reports To
Reports To
Reports To
Owns
Owns
Owns
Paired
Owns
Gets data
from
Sends
data to
Uses
Controls
Works with

17. Reports To
Reports To
Reports To
Owns
Owns
Owns
Paired
Owns
Gets data
from
Sends
data to
Uses
Controls
Works with
Drives
Uses
Constrains
Choice Of
Uses

18. Reports To
Reports To
Reports To
Owns
Owns
Owns
Paired
Owns
Gets data
from
Sends
data to
Uses
Controls
Works with
Drives
Uses
Constrains
Choice Of
Uses
Can send
data to
Riden In
Riden In

19. Unreasonably large number
of relationships between
unreasonably large numbers
of people and things, each
with attributes?

20. Why build laws in
the first place?

21. • Inform our designs
• Test existing solutions
• Identify gaps

22. Laws of Identity (2004)
1. User Control and Consent
2. Minimal Disclosure for a
Constrained Use
3. Justifiable Parties
4. Directed Identity
5. Pluralism of Operators and
Technologies
6. Human Integration
7. Consistent Experience Across
Contexts

23. The Laws* Of
Relationships

24. (A Work In Progress)

25. • Axioms
• Types
• Laws

26. Axioms
Attributes in support of
pre-existing natural state or
requirements

27. 1. Scalable
2. Actionable

28. Scalable

30. • Number of actors
• Number of relationships
• Number of attributes

31. • Number of actors
• Number of relationships
• Number of attributes
• Administration

32. Actionable

33. Relationships must be able
to carry authorization data

35. Can perform
actions X, Y,
and Z
Can perform
actions Q, W,
and E

36. Can perform
actions X, Y,
and Z
Can perform
actions Q, W,
and E

37. Can perform
actions X, Y,
and Z
Can perform
actions Q, W,
and E

41. ?
?

42. But relationships do not
have to carry authZ data

43. Types
Informs the greater context

44. 1. Immutable
2. Contextual
3. Transferrable

45. Immutable

46. Built by
Built by

47. Contextual

48. Relationship is active
when conditions are met

49. Inactive relationships
• None of the parties “use” the
relationship until a condition is
satisfied.
• The set of driver, car, insurer
relationships isn’t “used” until there is
a claim.
• Inert, inactive relationships are
still important because they
provide context
• This widget was made by Yoyodyne.

50. Inactive relationships
• None of the parties “use” the
relationship until a condition is
satisfied.
• The set of driver, car, insurer
relationships isn’t “used” until there is
a claim.
• Inert, inactive relationships are
still important because they
provide context
• This widget was made by Yoyodyne.
Drives

51. Inactive relationships
• None of the parties “use” the
relationship until a condition is
satisfied.
• The set of driver, car, insurer
relationships isn’t “used” until there is
a claim.
• Inert, inactive relationships are
still important because they
provide context
• This widget was made by Yoyodyne.
Drives Insures

52. Inactive relationships
• None of the parties “use” the
relationship until a condition is
satisfied.
• The set of driver, car, insurer
relationships isn’t “used” until there is
a claim.
• Inert, inactive relationships are
still important because they
provide context
• This widget was made by Yoyodyne.
Drives Insures
Manufactured by

53. Active Relationships
• Context toggles a relationship
into a usable state

54. Active Relationships
• Context toggles a relationship
into a usable state

55. Active Relationships
• Context toggles a relationship
into a usable state
Customer

56. Active Relationships
• Context toggles a relationship
into a usable state
Customer
Possesses

57. Active Relationships
• Context toggles a relationship
into a usable state
Customer
Owns
Possesses

58. Active Relationships
• Context toggles a relationship
into a usable state
Customer
Owns
Owns
Possesses

59. Active Relationships
• Context toggles a relationship
into a usable state
Customer
Owns
Owns
Possesses

60. Active Relationships
• Context toggles a relationship
into a usable state
Customer
Owns
Owns
Possesses

61. Context is a requirement
• Related Research:
– Death of authentication and rise of recognition
– Relationship context metadata and the need for durable metadata

62. Transferable

63. Client
Temporary Transference

64. Client
Temporary Transference
Delegate

65. Client
Temporary Transference
Delegate
Acts on behalf
of client

66. Client
Temporary Transference
Delegate
Acts on behalf
of client

67. Client
Temporary Transference
Acts on behalf
of client

68. Client
Temporary Transference

69. Permanent Transference
Owns

70. Permanent Transference
Owns
Customer Of

71. Permanent Transference
Owns
Customer Of

72. State of transference
• Do we need a system of record for transference state?
• Who would maintain such a system of record?
• Can/should the relationship carry history?

73. Laws
If a thing cannot be X,
then it is not a relationship

74. 1. Provable
2. Acknowledgeable
3. Revocable
4. Constrainable

75. Provable

76. Mechanism to prove
that a relationship
exists between parties

77. • Single-party asserted
• Multi-party asserted
• 3rd-party asserted

78. Single Party Asserted:
X relates to Y because X says so
I work
for her

79. Multi-Party Asserted:
X relates to Y because X and Y say so
I work
for her
She
works
for me

80. 3rd-Party Asserted:
X relates to Y because Z says so
Sally
works
for Mary
HR

81. 3rd-Party Asserted:
Does this require other relationships?
HR

82. Acknowledgeable

83. All parties must be able
to acknowledge they are
in a relationship

86. I acknowledge
my relationship
with Twitter

87. I acknowledge
my relationship
with Twitter

88. I acknowledge
my relationship
with Twitter Do I
acknowledge
my followers?

91. They will
acknowledge
their relationship
with me

92. They will
acknowledge
their relationship
with me
But can I
acknowledge my
relationship with
them?

94. Is this really a Law or a
feature request from the
VRM/PDE/Privacy-types?

95. Revocable

96. Real-world revocation

97. Real-world revocation

98. Real-world revocation
Owns
Owns

99. Real-world revocation
Owns
Owns
Built By

100. Real-world revocation
Owns
Owns
Paired
Built By
Acts on behalf
of

101. Real-world revocation
Owns
Owns
Paired
Built By
Acts on behalf
of

102. Real-world revocation
Owns
Owns
Paired
Built By
Acts on behalf
of

103. Real-world revocation
Owns
Paired
Built By
Acts on behalf
of

104. Real-world revocation
Owns
Paired
Built By
Acts on behalf
of

105. Questions that need answers
• Can either party revoke a relationship?
• If I sever a relationship should any party who was part of the
relationship still have access and use of what was shared in the
course of the relationship?
• Does this imply the idea of cascading delete?

106. Constrainable

108. With my
permission,
it can report
its location

109. With my
permission,
it can report
its location
It can
constantly
report energy
use to my
power
company

110. With my
permission,
it can report
its location
It can
constantly
report energy
use to my
power
company
It can only
used by
customers
with active
licenses

111. Consent
It can
constantly
report energy
use to my
power
company
It can only
used by
customers
with active
licenses

112. Consent
Consent
It can only
used by
customers
with active
licenses

113. Consent
Consent
DRM

114. Now what?

115. Laws, Types, and Axioms
Laws Types Axioms
• Provable
• Acknowledgeable
• Revocable
• Constrainable
• Immutable
• Contextual
• Transferrable
• Scalable
• Actionable

116. Join the Kantara WG!

117. Send me comments :
https://www.tuesdaynight.org/
2014/05/28/the-laws-of-
relationships-a-work-in-
progress.html

118. Go test this!

119. Where should we try and test relationship
management?
• IoT is a natural case
– Industrial settings (factories, planes, etc)
– Citizen (smart homes, sensors in public)
• Familial Relationships
– Insurance
– Healthcare
• Finance
– Complex authorization models
– Regulatory influence

120. Where else can we test this?
• Product architecture
• User stories
• Random strangers on the bus

123. Reports To
Reports To
Reports To
Owns
Owns
Owns
Paired
Owns
Gets data
from
Sends
data to
Uses
Controls
Works with
Drives
Uses
Constrains
Choice Of
Uses
Can send
data to
Riden In
Riden In

124. The Laws Of
Relationships