> I suppose that chain of SP instances is built for each
> database from config cascade (from db to server to engine
> built-in default etc.), so each database can have slightly
> different chain. So far, so good, but your spec deliberately
> omits other SP types like db or wire comm. encryption or
> whatever and defer their spec to later date.

I wondered about this as well.

It seems to me that the chaining means that it is possible to
install various mixes of security plugin, some that provide
both authentication and encyrption, some that provide only
one or the other. With chaining, intelligent installation
lets you mix and match - with no special definition required
by the plugin.

Some combinatations may fail, but without chaining you may
lose the mix-n-match capability (it becomes dependent on the
particular plugin whether it supports it or not).

Even with chaining a plugin has the option of stopping the
chain by defining the interface and doing something else.

Chaining also means that the base interface can be extended
without all plugins having to be updated - and this is
probably its most important feature.

--
Geoff Worboys
Telesis Computing