Contents of Evaluation Responses

[baboulebou]

I don't think we need an exp value: we can't "predict" how long an access rule would be true for: that's a business decision. Besides, in the spirit of Zero Trust, a decision is just made at one point in time, the next access request may yield a completely different response. Up to the PDP to do caching or whatever to speed-up processing.