Some ideas will have to be deferred. But doesn't agree with Bob Blakley on SSO and sessions. The assertion part isn't as compelling as connecting together multiple applications. Shibboleth federated administration is an example. The user may be surfing many sites.
Attribute authorities are still useful all on their own.
Interoperation of components that do rich sessions and those that don't could be a problem. One piece of input is the subject. Another is the action. We don't have user-specific context as part of our model. This is part of the session state.