An diagram that depicts all three branches (like http://www.oasis-open.org/committees/download.php/40066/ICOM%20High-Level%20Core%20Concepts.jpg ) can be included in Section 3. The three branches support the separation of concerns for user administration and content management. i) Subject branch includes the actor, grouping of actors, and role assignment of actors that are typically the "subjects" of (subject, privilege, object) triples in access control policies. ii) Artifact branch includes the contents and metadata produced by the actors. iii) Scope branch includes the community and space that defines the scope of role assignments. The scopes join the subjects and artifacts, providing a scheme for property chaining. The Subject and Artifact branches separate the concerns for administration of users and contents. The subjects and artifacts are joined together by the scopes from the Scope branch through the axiom schemes as described in the following example. Let's take a model of OASIS TC's in ICOM. In this model Eric is a subject from the Subject branch. The specification documents icom-ics-v1.0-csprd01.doc and bpel4people-1.1-spec-cs-01.doc are two instances from the Artifact branch. The ICOM-TC space is a scope from the Scope branch. Martin has administrative privileges to authorize Eric to participate in ICOM-TC space as a member. Patrick is a contributor of icom-ics-v1.0-csprd01.doc in ICOM-TC space. Martin's action to authorize Eric to participate ICOM-TC space and Patrick's action to contribute icom-ics-v1.0-csprd01.doc in ICOM-TC space are joined by the an axiom scheme that entails "Eric has read write privilege for icom-ics-v1.0-csprd01.doc" from "Eric is a member of ICOM-TC space", "a member of a TC has read write privilege for artifacts in the TC space", and "ICOM-TC space contains icom-ics-v1.0-csprd01.doc." "Eric is a member of ICOM-TC" is in turn derived from "Eric is assigned to a TC-Member role which is assigned to ICOM-TC space."