Consideration of values in the design of access control systems

Since access control systems codify many of the power structures that govern everyday life, the design of such systems has direct rami®cations w.r.t. moral values held by the system’s designers, users, or operators. As an alternative to a design process based solely on functional or economical requirements, avalue-sensitive design” has been proposed as a structured approach to produce systems that are congruent with given sets of moral values. However, the literature has pointed out the lack of methods for handling tradeoffs between values that may limit the practical utility of the approach. In this position paper, we explore the value-sensitive design of an access control system in a data sharing scenario. To this end, we step through the analysis and evaluation of design alternatives from a purely qualitative consideration to a simple formalization that enables discussion and comparison of designs with respect to tradeoffs between values. While any ®nal design decision depends on value judgments by the stakeholders, we believe that by making value judgments explicit, the formalization can substantiate design discussions and lead to more satisfying designs.