Given that Access Control Policies have been accepted into the specification ecosystem and there are multiple implementations available, the question now becomes whether and how ACP is cited in the protocol specification itself, likely under the Authorization section.

Assuming that it is included in the Protocol's Authorization section, the next question becomes what is required for a server implementation to be conformant?

• A server MUST implement both ACP and WAC?
• A server MUST implement at least one of ACP or WAC?