Organizational policy enables use of a service by people identified by a business process reflected in the organization's Identity Management system. This set of people tracked by a given business process is, by definition, accurate and authoritative for its original purpose. However, the original business process is often not fully accurate, giving rise to the need to interpret high-level policy and accordingly "tweak" the official roster by effectively adding or removing people. For this purpose, additional policies give limited authority to others to grant or deny access to the service.
Reflect the official source in the membership of a group. Create two other groups for the include and exclude and assign Updater or Admin privilege to those with authority to grant or deny access to the service (if there is more than one such authority for either the include or the exclude, follow the "Application Access Roles- Multiple Registrars for a Service" solution pattern). Using Grouper, form a group of people authorized to use the service for its run-time access control by
Naming these groups should follow the site's naming plan.