[Zope3-dev] Rename security:allow?

[Guido van Rossum]

I finally figured out why the <security:allow ...> directive feels so
weird to me.  If you renamed it to <security:require ...> the problem
goes away.  While intellectually I understand that the "allow"
directive comes from the fairly standard pair of security directive
(allow, deny), intuitively the "allow" has always felt strange,
perhaps because in regular (English) usage, allowing usually has an
association of "extra lenience".  E.g. "core hours are 9:30 - 6, but
we occasionally allow you to come in late if your family demands it."

I think the security directive context isn't strong enough to convey
the proper semantics for "allow".  OTOH, "require" is strong enough --
a requirement is something without which we can't do.  (I see nothing
wrong with deny BTW.)

So I propose to rename security:allow to security:require.  (I'd be
happy to turn this into a Wiki proposal if Jim agrees.)


--Guido van Rossum (home page: http://www.python.org/~guido/)