sanity checksecurity-efficiency compromise
more expressive QoS control policy has to include buying policy
customer can’t trust provider to execute buying policy
- to audit seems to require complete duplication of the function
- may have implications for guaranteed service provider function