Policy-management infrastructure

1. One or more processor-readable memory having processor-executable instructions that, when executed by a processor, perform a method comprising:

generating multiple meta-policies that are organized into a meta-policy layered hierarchy such that an application of a higher layered meta-policy to one or more objects limits corresponding effects of one or more lower layered meta-policies that are subordinate to the higher layered meta-policy on the one or more objects, wherein each meta-policy controls an application of policies to one or more target computing nodes;

utilizing common namespaces to provide a common context shared by the policies and meta-policies, each of the common namespaces being defined by a corresponding file extension;

analyzing the policies in the context of the meta-policies for the common namespaces to determine one or more overlaps of the policies without knowledge of domain-specific details of each policy, each overlapping occurring when a plurality of policies within a policy domain are in effect at a same time for one or more identical objects on an identical computer system;

analyzing the policies in the context of the meta-policies for the common namespaces without knowledge of the domain specific details of each policy to determine a completeness of the policies in covering a plurality of objects using the common namespaces;

determining one or more conflicts in the one or more overlaps of the policies based on domain-specific details of each policy, each conflict occurring when a plurality of overlapping policies make conflicting policy statements regarding the one or more identical objects; and

computing a resultant set of policies (RSOP) for at least one of the one or more overlaps or one or more conflicts by applying the multiple meta-policies to the policies.

2. One or more memory as recited in claim 1 , further comprises distributing the RSOP for the one or more target computing nodes to a policy consumer.

3. One or more memory as recited in claim 1 , wherein the generating comprises producing a multi-layered data model representing the multiple meta-policies.

4. One or more memory as recited in claim 1 , wherein the computing includes determining an effect of the multiple meta-policies on the policies.

5. One or more memory as recited in claim 1 , wherein the computing comprises transmitting the policies to a policy consumer, thereby enabling the policy consumer to calculate, at least in part, the RSOP.

6. One or more memory as recited in claim 1 , wherein the plurality of objects include files in a file system that use the common namespaces.

7. One or more memory as recited in claim 1 , wherein the multiple meta-policies and the policies utilize a common namespace for scheduling, directory services, system definition model, or a combination thereof.

8. One or more memory as recited in claim 1 , wherein the multiple meta-policies and the policies utilize a common namespace which is used by one or more resource managers.

9. One or more memory as recited in claim 1 , wherein the generating comprises producing a data model representing the multiple meta-policies, the data model having at least two multiple data layers comprising a management layer and a merge and conflict layer.

10. One or more processor-readable memory having processor-executable instructions that, when executed by a processor, perform a method comprising:

generating multiple meta-policies, wherein a meta-policy controls an application of policies to one or more target computing nodes, the generating comprising producing a data model representing the multiple meta-policies, the data model having the following multiple data layers arranged in a hierarchy of highest to lowest layers, in which a higher layer limits effect of a lower layer on the one or more target computing nodes:

an applicability and adaptation meta-policy layer to store data regarding applicability and adaptation of policies, the applicability and adaptation meta-policy layer at least activates a previous inactive policy of the policies to adapt to an installation of a new hardware device on a target computing node;

a consistency meta-policy layer that is directly under the applicability and adaption meta-policy layer to store data regarding consistency of policies;

a targeting and distribution meta-policy layer that is directly under the consistency meta-policy layer to store data regarding targeting and distribution policies;

a release and enactment meta-policy layer that is directly under the targeting and distribution meta-policy layer to store data regarding delivery of policies, the release and enactment meta-policy layer at least specifies a time window for prompting a user to apply a policy to a target computing node, and that the policy is to be applied without input from the user upon expiration of the time window;

a change and approval workflow meta-policy layer that is directly under the release and enactment meta-policy layer to store data regarding life cycles of policies;

utilizing common namespaces to provide a common context shared by the policies and meta-policies;

analyzing policies in the context of the meta-policies and the common namespaces to determine one or more overlaps of the policies, each overlapping occurring when a plurality of policies within a policy domain are in effect at a same time for one or more identical objects on an identical computer system;

determining one or more conflicts in the one or more overlaps of the policies, each conflict occurring when a plurality of overlapping policies make conflicting policy statements regarding the one or more identical objects;

and computing a resultant set of policies (RSOP) for at least one of the one or more overlaps or one or more conflicts by applying the multiple meta-policies to the policies.

11. One or more processor-readable memory of claim 10 , wherein the consistency meta-policy layer at least specifies that at least two of the policies are to be simultaneously deployed as an atomic unit on a target computing node to prevent an generation of an inconsistent state on the target computing node.

12. One or more processor-readable memory of claim 10 , wherein the targeting and distribution meta-policy layer at least prohibits a target computing node from downloading a software package over a network when the target computing node is roaming away from a designated location.

13. One or more processor-readable memory of claim 10 , wherein the change and approval workflow meta-policy layer at least identifies a primary approver and a secondary approver for a change to at least one of the policies.

14. A computer-implemented policy-management method comprising:

generating, by one or more computing devices configured to implement policy management, multiple meta-policies, wherein a meta-policy controls an application of policies to one or more target computing nodes;

organizing the multiple meta-policies into a meta-policy hierarchy such that an application of a higher meta-policy to one or more objects limits corresponding effects of one or more lower meta-policies that are subordinate to the higher meta-policy on the one or more objects, wherein each meta-policy controls the application of policies to one or more target computing nodes;

utilizing a common namespace to provide a common context shared by the policies and meta-policies, the common namespace being defined by a file extension of files that are affected by the meta-policies and the policies;

analyzing, by the one or more computing devices, the meta-policies for the common namespace to determine one or more overlaps of the policies without knowledge of domain-specific details of each policy, each overlapping occurring when a plurality of policies within a policy domain are in effect at a same time for one or more identical objects on an identical computer system;

determining, by one or more computing devices one or more conflicts in the one or more overlaps of the policies based on domain-specific details of each policy, each conflict occurring when a plurality of overlapping policies make conflicting policy statements regarding the one or more identical objects;

computing, by the one or more computing devices, a resultant set of policies (RSOP) for at least one of the one or more overlaps or one or more conflicts by applying the multiple meta-policies to the policies; and

distributing, by the one or more computing devices, the RSOP for the one or more target computing nodes to a policy consumer.

15. A method as recited in claim 14 , wherein the computing includes determining the effect of the multiple meta-policies on the policies.

16. A method as recited in claim 14 , wherein the computing comprises transmitting the policies to a policy consumer, thereby enabling the policy consumer to calculate, at least in part, the RSOP.

17. A method as recited in claim 14 , wherein the common namespace is used by one or more resource managers.

18. A method as recited in claim 14 , wherein the multiple meta-policies and the policies utilize the common namespace for scheduling, directory services, system definition model, or a combination thereof.

19. A method as recited in claim 14 , further comprising providing installation services to analyze the common namespace for overlap and coverage.

20. A method as recited in claim 14 , wherein the data model has at least two of the following multiple data layers:

a policy management meta-policy layer to store data regarding policy management;

a merge and conflict-resolution meta-policy layer to store data concerning policy merging and conflict resolution;

an effective schedule and conditions meta-policy layer to store data defining effective schedule and conditions for policies;

an applicability and adaptation meta-policy layer to store data regarding applicability and adaptation of policies;

a consistency meta-policy layer to store data regarding consistency of policies;

a targeting and distribution meta-policy layer to store data regarding targeting and distribution policies;

a release and enactment meta-policy layer to store data regarding delivery of policies;

a change and approval workflow meta-policy layer to store data regarding life cycles of policies.