The policy rules can now be defined. For example, only guests and employees have access to the pool, exercise room and spa. Only the guest registered to a particular room and employees have access to that room. Guests have access to printers and vending machines, with services charged to the room account number.
Visitors have access to printers and vending machines when a credit card number is provided.
Each device has to implement the part of the policy that governs the use of the object the device manages. The access control and auditing occur within the device and are not visible to Bluetooth. Authentication is, however, an interaction that occurs between a subject and the device and as such, Bluetooth will be involved. Bluetooth could be just the transport of an authentication protocol. That is, an authentication protocol is implemented that has nothing specifically to do with Bluetooth other than to establish a communications link between the subject's PDA and the device.