@@ -47,6 +47,59 @@ PaC policy engine characteristics:
---------
```
+Selection Criteria:
+
+* Alignment
+ - Technical Capabilities of team.
+ - Internal strategy for how tools and applications are adopted/managed.
+ - Fits the need and internal standards driving the decision
+ - Primary use cases match our use cases
+* Analytics
+ - logging
+ - metrics
+ - auditing
+* Automation
+ - CI/CD Pipelines
+ - Automated Deployments
+* Documentation
+ - Examples
+ - Patterns
+ - Understandable
+* Adoption
+ - Who is using this?
+ - How much adoption has this project seen?
+ - Active?
+ - Project Maturity
+ - Support Model
+ - Intuitive
+* Complexity
+ - Installation
+ - Deployment
+ - Configuration
+ - Operation Modes (server, library, CLI)
+* Reporting
+ * Standard reporting tools e.g. [OSCAL](https://pages.nist.gov/OSCAL/)
+* Security
+ * Risks, vulnerabilities
+ * Tools and processes for security issue discovery
+* Extensibility
+ * Can custom code be written to extend the language.
+
+Scorecard
+
+| Selection Criteria | Casbin | Cedar | Rego |
+| ------------------ | ------ | ----- | ---- |
+| Alignment | | | |
+| Analytics | | | |
+| Adoption | | | |
+| Automation | | | |
+| Documentation | | | |
+| Complexity | | | |
+| Reporting | | | |
+| Security | | | |
+| Extensibility | | | |
+| Total | | | |
+
## Security Context/Scope
1. Single resource