Annotations should be defined for the policy intents that are standardized within SCA. These annotations should equate to policy intents declared in the component type file (which will be supported after Policy WG issue 21 is resolved).
The following is some text that may be useful as a starting point:
SCA Quality of Service (QoS) policy may be defined either by declaring policy statements in policy files or annotating in Java code. Annotated policy is useful in prototyping SCA services.
There are two ways to annotate interaction security policy: In the late binding case annotated Quality of Service (QoS) intents are mapped to concrete security policy set at deployment time. Alternatively annotated policy set reference explicitly define a specific policy set.

Example 1. Annotated QoS intents in this color

package services.hello;

@Remotable

@Integrity
@Confidentiality
@Authentication

public interface HelloService {

String hello(String message);

}


Example 2. Annotated policy set reference

package services.hello;

@Remotable

@UsePolicySet("<policySetName>")

public interface HelloService {

String hello(String message);
}


One MUST NOT declare both QoS annotation and Policy Set Reference annotation. When both a QoS annotation and a Policy Set Reference annotation are declared, the annotated policy set reference takes precedency over any annotated QoS
intent statements. The policy set SHOULD provide the QOS intents that are also specified. QoS Intent element (profile element) in a SCDL file takes precedence over annotated QoS intents in Java code when both are declared.

TBD: We need to say that when you inherit policy intents, you can add to them (i.e. strengthen security) but not remove them in the child class.

PROVENANCE: SCA-114 by mrowley on 2006-08-31 12:14:50
-- Ashok Malhotra