ACLs (2.5)
n Provisionally (subject to list discussion),
can eliminate the authentication-id
property. The AlternateURL property can
cover many of the use cases envisioned
for authentication-id.
n Or, make sure that the use of each principal
property (Displayname, authentication-id,
etc.) is known, agreed to, and considered
important enough to justify the property.