Suggest:
OBIX does not define security protocols or security methods. Security is dependent upon the business process, the value of the data, the encoding used, and other issues that are out of scope for this specification. OBIX supports composition with any number of security approaches and technologies. User authentication and authorization are left to the implementer. The type and depth of encryption are dependent upon the bindings and transport protocols used. Although it is possible to define contracts for user management through OBIX, this committee does not define any standard Contracts for user management.
OBIX does define the messages used to report errors in security or in authentication. OBIX further defines how security is inherited within the hierarchy of a system. OBIX further makes a number of statements throughout this specification of areas or conditions wherein practitioners should consider carefully the security effects of their decisions.
Improvement
Major