AP draws the definitions more widely than normally, but they include the general rubic of identity. Point of concern: there can be many "subsidiary policies". To date, those that have been put through PoP framework have been serious, thoughful and appropriate. However, implementation of OAP has been poor. Point of concern: there are many Assurers. AP, the Assurer Challenge, and the ATE programme improve this immensely. The control, supervision and broader training of Assurers was only begun 200902xx after CeBIT by German initiative. Old points are still active. This is an acceptable risk. Challenge was only made mandatory by system patch 200904xx. Software development lags. No implementation of agreed changes to Naming practice.