Title: Access control policy management.

Abstract: It is challenging to design and maintain access control 
policy. For one thing, policy is subject to constant changes, as a 
result of, for example, personnel turnover. For another, it is likely 
that policy contains mis-configurations. These two issues call for a 
continuous effort to manage the policy. In this talk, I will introduce 
recent works on (role-based) access control policy design and update. 
When it comes to distributed access control, more than one agent 
influences (and is thus responsible for) an authorization. I will also 
give a brief introduction to a logic for authorization provenance.