Adding/removing a Dimension from the Policy will deprecate all previously issued keys and ciphers

[ackRow]

Modifying the number of dimensions inside a Policy will change how we compute the subkeys coordinates (previously named Partitions) so that there is no way to match previous subkeys with the new ones.

One will need to re-generate all keys and re-encrypt all documents...

[ackRow]

Attribute additions or deletions inside existing Dimension also have their own edge-cases:

• Removing an Attribute will make user keys decrypting for this Attribute useless => should we delete the keys automatically in the KMS?

• Removing the last Attribute from a Dimension will lead to the problem of Dimension removal

• Should we add new Attribute access to an old User Key if its initial AccessPolicy would have matched it (e.g. *)