SOAP Message Security only, does
not cover other aspects of security for web services
Issuance and exchange of
security tokens not establishment and validation
of trust
Policy definition framework,
does not describe how policies are managed
How security information is
passed, not how security policy is distributed or enforced