just remembered one more thing

[Karsten Riemer <Karsten.Riemer@east.sun.com>]

Still hacking at examples,
and seeing the response from Marty Sachs,
we need the isSecureTransportRequired to be a three way flag
no/persistent/transient
persistent means app to app confidential/tamperproof/authenticated, i.e.
responsibility of app transient means only while on the wire, i.e.
responsibility of messaging service

Also, the semantics of isSecureTransportRequired will be a default from which
document level security can override. Strongest requirement wins. E.g. if
document requires to be tamperproof but isSecureTransportRequired is NO, then
that document still needs to be tamperproof, during transport as well. If a
document security is NO, and isSecureTransportRequired is persistent, then
that document will still be treated as confidential/tamperproof/authenticated

Please let me know if anyone disagrees with the three way flag, or the
interprestation of default/override.

-karsten