I am speculating on the design of a system that allows trusted information exchange between two parties.
- Is a large corporation.
- Wants to offer access to their employees via a single-sign-on arrangement to materials held by Party B.
- Employees will have access to only parts of what is made available by Party B.
- Wants to share proprietary information with Party A.
- Does not entirely trust Party A to not disseminate information beyond authorized users.
- Does not want to give Party A complete access to all their data.
- The data in question include a variety of web-resources, files, etc. What Party A does with all this stuff is beyond the scope of the question.
A go-between system (man in the middle, clearing house type of arrangement) needs to audit what Party A does with the information, keep logs of who logged in when, what they looked at, for how long, etc.
What kind of systems arrangement would make sense to ensure that access to Party B's information by Party A only happens when specifically allowed?