The legal reform process in South Africa has led to increasingly complex legislative requirements for new developments in the form of various authorization processes. Currently different organs of state, at different spheres of government exercise a range of powers and functions in respect of the approval of development applications. These authorisations typically relate to planning, water management, heritage resources, environmental management, air quality, etc. In order to improve the efficiency and alignment of authorisation processes there is a serious need to gain a better understanding of the interaction between the different authorisation processes as well as the challenges experienced. This research presents the results of a critical analysis of planning and environmental impact assessment (EIA) authorisation processes in the Mpumalanga Province and examines how authorisation processes are implemented and aligned, how efficient the processes are, why process inefficiencies occur and how the efficiency of processes can be improved. The outcome of the research suggests that there are three main success factors for efficiency, namely the legislative framework that provides for administrative and environmental justice, co-operative governance that provides the basis for good communication, and information and competence that injects expertise into the authorisation process. The so-called 'efficiency triangle' is conceptualised, which clearly illustrates the interaction between these success factors. / Thesis (M. Environmental Management)--North-West University, Potchefstroom Campus, 2010.

The legal reform process in South Africa has led to increasingly complex legislative requirements for new developments in the form of various authorization processes. Currently different organs of state, at different spheres of government exercise a range of powers and functions in respect of the approval of development applications. These authorisations typically relate to planning, water management, heritage resources, environmental management, air quality, etc. In order to improve the efficiency and alignment of authorisation processes there is a serious need to gain a better understanding of the interaction between the different authorisation processes as well as the challenges experienced. This research presents the results of a critical analysis of planning and environmental impact assessment (EIA) authorisation processes in the Mpumalanga Province and examines how authorisation processes are implemented and aligned, how efficient the processes are, why process inefficiencies occur and how the efficiency of processes can be improved. The outcome of the research suggests that there are three main success factors for efficiency, namely the legislative framework that provides for administrative and environmental justice, co-operative governance that provides the basis for good communication, and information and competence that injects expertise into the authorisation process. The so-called 'efficiency triangle' is conceptualised, which clearly illustrates the interaction between these success factors. / Thesis (M. Environmental Management)--North-West University, Potchefstroom Campus, 2010.

This thesis reports an investigation into authorisation models, as used in identity and access management. It proposes new versions of an authorisation model, the Tees Confidentiality Model (TCM), and presents formal specifications in B, and verifications and implementations of the key concepts using Spec Explorer, Spec# and LinQ. After introducing the concepts of authorisation and formal models, a formal methods specification in B of Role Based Access Control (RBAC) is presented. The concepts in RBAC have heavily influenced authorisation over the last two decades, and most of the research has been with their continued development. A complete re-working of the ANSI RBAC Standard is developed in B, which highlights errors and deficiencies in the ANSI Standard and confirms that B is a suitable method for the specification of access control. A formal specification of the TCM in B is then developed. The TCM supports authorisation by multiple concepts, with no extra emphasis given to Role (as in RBAC). The conceptual framework of Reference Model and Functional Specification used in the ANSI RBAC Standard is used to structure the TCM formal model. Several improvements to the original TCM are present in the formal specification, notably a simplified treatment of collections. This new variation is called TCM2, to distinguish it from the original model. Following this, a further B formal specification of a TCM reduced to its essential fundamental components (referred to as TCM3) was produced. Spec Explorer was used to animate this specification, and as a step towards implementation An implementation of TCM3 using LinQ and SQL is then presented, and the original motivating healthcare scenario is used as an illustration. Finally, classes to implement the versions of the TCM models developed in the thesis are designed and implemented. These classes enable the TCM to be implemented in any authorisation scenario. Throughout the thesis, model explorations, animations, and implementations are illustrated by SQL, C# and Spec# code fragments. These illustrate the correspondence of the B specification to the model design and implementation, and the effectiveness of using formal specification to provide robust code.

The enormous growth of the Internet and the World Wide Web has provided the opportunity for an enterprise to extend its boundaries in the global business environment. While commercial functions can be shared among a variety of strategic allies - including business partners and customers, extranets appear to be the cost-effective solution to providing global connectivity for different user groups. Because extranets allow third-party users into corporate networks, they need to be extremely secure and external access needs to be highly controllable. Access control and authorisation mechanisms must be in place to regulate user access to information/resources in a manner that is consistent with the current set of policies and practices both at intra-organisational and cross-organisational levels. In the business-to-customer (B2C) e-commerce setting, a service provider faces a wide spectrum of new customers, who may not have pre-existing relationships established. Thus the authorisation problem is particularly complex. In this thesis, a new authorisation scheme is proposed to facilitate the service provider to establish trust with potential customers, grant access privileges to legitimate users and enforce access control in a diversified commercial environment. Four modules with a number of innovative components and mechanisms suitable for distributed authorisation on extranets are developed: * One-shot Authorisation Module - One-shot authorisation token is designed as a flexible and secure credential for access control enforcement in client/server systems; * Token-Based Trust Establishment Module - Trust token is proposed for server-centric trust establishment in virtual enterprise environment. * User-Centric Anonymous Authorisation Module - One-task authorisation key and anonymous attribute certificate are developed for anonymous authorisation in a multi-organisational setting; * Agent-Based Privilege Negotiation Module - Privilege negotiation agents are proposed to provide dynamic authorisation services with secure client agent environment for hosting these agents on user's platform

Compliance monitoring is a continuous process used to ensure that conditions stipulated in an environmental authorisation are adhered to. Compliance monitoring is a key component of Environmental Impact Assessment (EIA) and EIA follow-up. The aim of this research was to critically assess EIA follow-up conditions formulated for Environmental Authorisations in Mpumalanga Province. The practicability of conditions set out in the authorisation for EIA follow-up are of particular concern. Forty-two (42) environmental authorisations (EAs) issued under the 2010 NEMA EIA regulations were reviewed and assessed to analyse information relating to follow-up practice. In order to synthesise the data effectively and create a comprehensive analysis, the EAs were divided into project type categories rather than listed activity categories. The assessment results on the strengths and weaknesses related to compliance monitoring and enforcement of the authorisation conditions revealed that the EIA follow-up conditions in Mpumalanga do make provision of EIA follow-up. The EAs fulfils the requirements of regulation 37 of the NEMA EIA regulations 2010 by promoting compliance monitoring of impacts. However, some conditions raises difficulty in monitoring due to their impracticability. Another weakness is that conditions focus mainly on the construction phase and very little attention is paid to operational and decommissioning impacts. The analyses results show that the practicability of the authorised conditions for environmental compliance monitoring had the following challenges: conditions intended to mitigate the adverse environmental impacts are generic and do not apply to specific projects or activities being authorised and there are no clearly defined timeframes for conditions requiring repetitive monitoring. Moreover, the study revealed gaps in monitoring of the authorised conditions that included poor clarity of roles of environmental control officers (ECOs) and auditors and a lack of reference to sections to be complied with pertaining to other relevant legislation. The critical assessment of the EIA follow-up conditions formulated for Environmental Authorisations in Mpumalanga Province indicate that the formulation of conditions have implications in ensuring that compliance is effectively implemented. Clearly defined conditions will ensure proper interpretation and correct implementation for compliance purposes. / M (Environmental Management), North-West University, Potchefstroom Campus, 2015

Compliance monitoring is a continuous process used to ensure that conditions stipulated in an environmental authorisation are adhered to. Compliance monitoring is a key component of Environmental Impact Assessment (EIA) and EIA follow-up. The aim of this research was to critically assess EIA follow-up conditions formulated for Environmental Authorisations in Mpumalanga Province. The practicability of conditions set out in the authorisation for EIA follow-up are of particular concern. Forty-two (42) environmental authorisations (EAs) issued under the 2010 NEMA EIA regulations were reviewed and assessed to analyse information relating to follow-up practice. In order to synthesise the data effectively and create a comprehensive analysis, the EAs were divided into project type categories rather than listed activity categories. The assessment results on the strengths and weaknesses related to compliance monitoring and enforcement of the authorisation conditions revealed that the EIA follow-up conditions in Mpumalanga do make provision of EIA follow-up. The EAs fulfils the requirements of regulation 37 of the NEMA EIA regulations 2010 by promoting compliance monitoring of impacts. However, some conditions raises difficulty in monitoring due to their impracticability. Another weakness is that conditions focus mainly on the construction phase and very little attention is paid to operational and decommissioning impacts. The analyses results show that the practicability of the authorised conditions for environmental compliance monitoring had the following challenges: conditions intended to mitigate the adverse environmental impacts are generic and do not apply to specific projects or activities being authorised and there are no clearly defined timeframes for conditions requiring repetitive monitoring. Moreover, the study revealed gaps in monitoring of the authorised conditions that included poor clarity of roles of environmental control officers (ECOs) and auditors and a lack of reference to sections to be complied with pertaining to other relevant legislation. The critical assessment of the EIA follow-up conditions formulated for Environmental Authorisations in Mpumalanga Province indicate that the formulation of conditions have implications in ensuring that compliance is effectively implemented. Clearly defined conditions will ensure proper interpretation and correct implementation for compliance purposes. / M (Environmental Management), North-West University, Potchefstroom Campus, 2015

Marketing authorisation in the Czech Republic The purpose of the thesis is to provide an overview of essential principles of a process of medicinal products' marketing authorisation in the Czech Republic. Every medicinal product produced on a large-scale must be registered by responsible authority before launching on the market, this process guarantees its effectiveness and safety. Even though the topic is a subject of quickly evolving legislation, in the Czech Republic has not been elaborated any coherent monograph on the issue yet. The diploma thesis is composed of seven chapters, starting with the overview of the historical legislation of medicinal products' marketing authorisation and ending with today's legislation affected by European Union legislation. The second chapter is dealing with the history of the marketing authorisation of medicinal products, which has its beginnings in 1920s, such dating argues that this is not a new field of a legislation. Following a brief outline of the history the third chapter of the diploma thesis explains today's legislation and gives an overview of European legislation and jurisdiction of Court of Justice of the European Union that have important impact on the Czech legislation. In the fourth chapter the thesis focuses on State Institute for Drug Control...

Les systèmes de gestion de workflow font maintenant partie de l'environnement classique des grandes organisations. Ces systèmes sont cependant aujourd'hui considérés comme trop rigides et de nombreux travaux ont pour but d'introduire de la flexibilité dans la modélisation et l'exécution de leurs procédés. Dans cette problématique, la prise en compte de la flexibilité organisationnelle est une étape importante. C'est à cette dernière que nous allons nous intéresser à travers un mécanisme particulier : la délégation de tâches. En effet, la délégation est un mécanisme qui permet d'obtenir une certaine flexibilité organisationnelle dans un système de gestion de workflow. Elle permet également d'assurer une forme de délégation des autorisations dans un système de contrôle d'accès. Dans ce contexte, une délégation sécurisée de tâches implique la présence d'un ensemble d'évènements de délégation et de règles définissant les possibles délégations d'autorisation ainsi que les moyens de contrôler les politiques associées.Dans ce mémoire, nous définissons une approche sécurisée pour la délégation dynamique de tâches dans les systèmes de gestion de workflow. Pour ce faire, nous identifions les évènements spécifiques du modèle de tâches correspondant à la délégation qui entrainent des changements dynamiques de la politique d'autorisation. Puis, nous montrons comment notre approche permet de contrôler dynamiquement les autorisations liées à la délégation et comment elle peut être intégrée dans les systèmes de contrôle d'accès existants. Afin de contrôler le comportement de délégation et de spécifier ses politiques d'autorisation, nous recueillons les événements pertinents qui définissent le chemin d'exécution des tâches ainsi que les politiques générées pour la délégation. Finalement, nous proposons une technique qui automatise les politiques de délégation et qui permet d'accroître la conformité des changements dus à la délégation dans la politique d'autorisation existante / Task delegation presents one of the business process security leitmotifs. We currently observe a move away from predefined strict workflow modelling towards dynamic approaches supporting flexibility on the organisational level and dynamic authorisation on the security level. One specific approach is that of task delegation. Delegation defines a mechanism that bridges the gap between both workflow and access control systems. There are two important issues relating to delegation, namely allowing task delegation to complete, and having a secure delegation within a workflow. Delegation completion and authorisation enforcement are specified under specific constraints. Constraints are defined from the delegation context implying the presence of a fixed set of delegation events to control the delegation execution. In this dissertation, we aim to reason about delegation events to model task delegation and to specify delegation policies dynamically. To that end, we present an event-based task delegation model to monitor the delegation process. We then identify relevant events for authorisation enforcement to specify delegation policies. Subsequently, we propose a task-oriented access control model to address these requirements. Using our access control model, we analyse and specify delegation constraints into authorisation policies. Moreover, we propose a technique that automates delegation policies using event calculus to control the delegation execution and to increase the compliance of all delegation changes in the existing policy of the workflow

The security policies of mobile devices that describe how we should use these devices are often informally specified. Users have preferences for some apps over others. Some users may avoid apps which can access large amounts of their personal data, whilst others may not care. A user is unlikely to write down these policies or describe them using a formal policy language. This is unfortunate as without a formal description of the policy we cannot precisely reason about them. We cannot help users to pick the apps they want if we cannot describe their policies. Companies have mobile security policies that definehowan employee should use smart phone devices and tablet computers from home at work. A company might describe the policy in a natural language document for employees to read and agree to. They might also use some software installed on employee's devices to enforce the company rules. Without a link between the specification of the policy in the natural language document and the implementation of the policy with the tool, understanding how they are related can be hard. This thesis looks at developing an authorisation logic, called AppPAL, to capture the informal security policies of the mobile ecosystem, which we define as the interactions surrounding the use of mobile devices in a particular setting. This includes the policies of the users, the devices, the app stores, and the environments the users bring the devices into. Whilst earlier work has looked on checking and enforcing policies with low-level controls, this work aims to capture these informal policy's intents and the trust relationships within them separating the policy specification from its enforcement. This allows us to analyse the informal policies precisely, and reason about how they are used. We show how AppPAL instantiates SecPAL, a policy language designed for access control in distributed environments. We describe AppPAL's implementation as an authorisation logic for mobile ecosystems. We show how we can check AppPAL policies for common errors. Using AppPAL we show that policies describing users privacy preferences do not seem to match the apps users install. We explore the differences between app stores and how to create new ones based on policy. We look at five BYOD policies and discover previously unexamined idioms within them. This suggests aspects of BYOD policies not managed by current BYOD tools.

The main legislation governing environmental authorisation in South Africa is the National Environmental Management Act, 107 of 1998 (NEMA). This legislation is administered by the environmental affairs departments at national, provincial and local spheres of government. Besides NEMA, there are other pieces of legislation which govern environmental authorisation and, in some instances, are administered by other organs of state. They, like NEMA, require submission of reports to authorities for decision-making. This may result in cumbersome and duplication of processes; which in turn, may delay the initiation of development activities. NEMA provides for co-operative governance, coordination of activities and alignment of processes to counter the above problems. Section 24L states that activities regulated in another law may be regarded as sufficient for authorisation in terms of NEMA, and vice versa. Furthermore, section 24K provides for consultation and coordination of legislative requirements to avoid duplication. Flowing from these provisions is that competent authorities may exercise their powers by issuing separate or integrated authorisations. All these provisions aim to promote smooth and seamless interactions between all key role-players involved in authorisation processes. However, there are widespread concerns amongst key role-players and the public at large about the lack of application and/or implementation of the foregoing legislative provisions. This study investigates these concerns through a literature review, case study analysis and administration of a questionnaire. The results show that the fruits of these provisions (i.e. coordinated activities, aligned processes and/or integrated authorisations) in the province of KwaZulu-Natal have yet to be realised. This study recommends, therefore, that clear guidance be provided to provinces on how to implement the legislative provisions described above. / Thesis (M. Environmental Management)--North-West University, Potchefstroom Campus, 2013.