Domains and Policies
Impractical to specify policy for individual objects in large systems with many objects
? specify policy for domains
Can change domain membership without changing policy
Notes:
Domains provide scope for policy
Domains give the flexibility to add and remove objects from the domains without changing the policy specification.
Policy defines a relationship between managers (subjects) and the target managed objects.