Concepts

Typically the entities that a Mechanism cares about can be split into three groups:

(TODO: mention that libpolkit represents the Subject as either a Caller (e.g. a process) or a Session (e.g. a group of processes in a desktop session) and what the implications are here; e.g. for granting/removing ACL's on device nodes. etc. etc. etc.)

One way to think about a Mechanism is that the Mechanism is split into an enforcer and a decider component. When an application attempts to access the Mechanism, the enforcer component will only carry out the Action if the decider component (supplied with the appropriate input parameters about the Subject, Object and Action) says it's OK.