  Virtual organizations (VOs) are communities of resource providers and users
distributed over multiple policy domains. These VOs often wish to define and
enforce consistent policies in addition to the policies of their underlying
domains. This is challenging, not only because of the problems in distributing
the policy to the domains, but also because of the fact that those domains may
each have different capabilities for enforcing the policy. The Community
Authorization Service (CAS) solves this problem by allowing resource providers
to delegate some policy authority to the VO while maintaining ultimate control
over their resources. In this paper we describe CAS and our past and current
implementations of CAS, and we discuss our plans for CAS-related research.
