[kephasp]

One typical way to resolve this is to use Voluntary Oblivious Compliance (VOC). In this capability-based pattern, every storage service could provide an opaque handler to a user that represents their authorization and it can be used to restrict on which documents indexing is done.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Compu...

http://www.skyhunter.com/marcs/ewalnut.html#proofOfPurchase

If the opaque handle is part of the Membrane pattern, you can even avoid most race conditions, because even during the indexing, the capabilities can be used to access documents and that removes the possibility of a TOCTOU race.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Compu...