
No one component taken out of context makes the Personal Cloud.
I’ve been following the Role Based Access Control thread on the Personal Clouds List and just sort of biting my tongue so as not to sidetrack any productive discussion there. However, I cringe every time a new email comes out comparing Clique Space to RBAC. One is a model, one is an implementation. To compare them is like saying “China is not capitalism.”
I have issues on several levels with the whole discussion. First, I believe that Role Based Access Control will be essential to the Personal Cloud architecture. With all of the different functions proposed for Personal Cloud, it doesn’t seem scalable with the other types of access control. Furthermore, there is no “personal cloud” if all the parts of it are developed in a vacuum. Even though your component of the Personal Cloud may be simple enough to not require RBAC, how will it fit into the greater architecture? For example, a smart light switch may have one role – either you can access it or not. That’s a use case that screams out for simple Access Control Lists right up until you try to integrate it into a larger home automation system. It isn’t so much that the switch now needs roles, but rather that the ability to manipulate or inquire on the switch from within the home automation system is itself a role of that larger system. So as a designer the question becomes: In a larger cloud context where the owner manages using RBAC, do you want your device or component to be the only thing that requires the homeowner to program specific Access Control Lists? How user friendly is that?
My answer to this is that as designers we need to recognize up front that the complexity of the Personal Cloud requires something more manageable than individual access control lists and then design our components to live in that greater context.