PKIs will cross-certify, so that identity assignment costs can be contained and the number of certificates required for business can be controlled. However, there are many approaches to cross-certification. One of the more enticing is to map policy rules in the cross-certification. To applications that are performing policy validity checking, policy mapping means that the mapped policy is as valid as the original policy. However, there has been little real-world policy mapping.
Many lawyers advise that policy mapping can only be done when the policies are legally equivalent.
Purchasing agents have countered that they need only be significantly equivalent, and that a policy board consisting of the current members of the PKI can vote on admission of new members and the appropriate policy mapping. The downside of policy mapping as described here is that, in the end, most policies are mapped into a handful of policy groupings, and little if anything is gained compared with the more basic Canadian plan. Another eventuality is the proliferation of expectable policy OID lists that administrators will have to configure in their users' systems. This approach moves the liability away from the certificate issuer to the local administrator. It also puts the local administrator on call to enable any new business by updating the excepted list.