Checking contextual integrity

[Rod Widdowson]

More status.

The upshot of the discussion on Friday was that we actually do need to
tristate in these situations (yes/no/failure), either explicitly or via
throwing an exception.  

This means that our use of Predicate (from Guava) becomes problematic since
they do not understand tristate and making them throw a (checked) Exception
would change the signature so they wouldn't be Predicate any more.

Tom and I discussed this yesterday.  There are 3 ways to do this all of
which have down sides.  I have no particular favourite from any of them

1) Keep the current code but arrange for the Predicates to throw an
unchecked Exception.  Then in the upper layers we can either convert this to
a FilteringException or "do the right thing" - which is to say log the
error, deny *all* attribute release (we have to do this since we cannot know
the scope of the operation). This worries me somewhat (but then so do all
the options)
http://docs.oracle.com/javase/tutorial/essential/exceptions/runtime.html .

  Since it causes least entropy at this stage and allows us to move forward
it's Tom's preferred ("least unfavorite") option.

2) Invent our own TristatedPredicate class (with a static method to generate
one from a Guava Predicate)

3)  Invent our own PredicateThatThrows class (with a similar static method).
Unfortunately due to the oddness of java's type mechanism it cannot be a 

 class ThrowablePredicate<I, T extends Exception> { 
   abstract boolean Apply(I in) throws T;
}

Comments welcome...