Plans for service composition

We study how to compose services in the presence of security constraints. By analysing the abstract behaviour of a set of services, we are able to determine the plans that drive safe program executions. These plans can be of different kinds, and we study here three of them, with different expressive power. Simple plans choose a single service for each request; multi-choice plans instead can choose among a set of services; dependent plans exploit the knowledge of past choices to decide for the future ones.