Index: doc/ABAC.hh
===================================================================
--- doc/ABAC.hh	(revision bc12f3d4f8058f3cc802b4b2947143a0a5e33e10)
+++ doc/ABAC.hh	(revision b7e77dfa7e38d121dc6bbbab89456e4af6479d04)
@@ -16,133 +16,6 @@
     class Attribute;
     class ID;
-
-/***
-ABAC::Role
-   A Role, most calls are rarely used outside the library 
-***/
-    class Role {
-        public:
-/***
-f  Role()
-     default constructor, do not use, for swig only
-f  Role(abac_role_t*)
-     copy constructor, used for cloning an Role
-     (C:abac_role_dup)
-f  Role(char *)
-     instantiate a role from a string
-     (C:abac_role_from_string)
-f  Role(const Role &)
-     copy constructor, used for cloning an Role
-     (C:abac_role_dup)
-f  ~Role()
-     default destructor
-     (C:abac_role_free)
-***/
-            Role() : m_role(NULL) { } // do not use: here for swig
-            Role(abac_role_t *role) { m_role = abac_role_dup(role); }
-            Role(char *role_name) { m_role = abac_role_from_string(role_name); }
-            Role(const Role &role) { m_role = abac_role_dup(role.m_role); }
-            ~Role() { abac_role_free(m_role); }
-/***
-f  bool is_principal()
-     (C:abac_role_is_principal)
-f  bool is_role()
-     (C:abac_role_is_role)
-f  bool is_linking()
-     (C:abac_role_is_linking)
-     indicates the type of role encoded
-***/
-            bool is_principal() const { return abac_role_is_principal(m_role); }
-            bool is_role() const { return abac_role_is_role(m_role); }
-            bool is_linking() const { return abac_role_is_linking(m_role); }
-
-/***
-f  char* string()
-     string representation of the role
-     (C:abac_role_string)
-***/
-            char *string() const { return abac_role_string(m_role); }
-/***
-f  char* linked_role()
-     the linked role of a linking role
-     i.e., A.r1.r2, linked_role() returns A.r1
-     (C:abac_role_linked_role)
-f  char* role_name()
-     the role name of any role (the part after the last dot)
-     (C:abac_role_role_name)
-f  char* principal()
-     the principal part of any role
-     (C:abac_role_principal)
-***/
-            char *linked_role() const { return abac_role_linked_role(m_role); }
-            char *role_name() const { return abac_role_role_name(m_role); }
-            char *principal() const { return abac_role_principal(m_role); }
-
-        private:
-            abac_role_t *m_role;
-    };
-
-/***
-ABAC::Credential
-   This is never instantiated directly. These will only ever be
-   returned as a result of calls to Context::query or
-   Context::credentials.
-***/
-    class Credential {
-        public:
-/***
-f  Credential()
-     default constructor, do not use, for swig only
-f  Credential(abac_credential_t*)
-     copy constructor, used for cloning a credential
-     (C:abac_credential_head)
-     (C:abac_credential_tail)
-     (C:abac_credential_dup)
-f  Credential(const Credential&)
-     copy constructor, used for cloning a credential
-     (C:abac_credential_head)
-     (C:abac_credential_tail)
-     (C:abac_credential_dup)
-f  ~Credential()
-     default destructor
-     (C:abac_credential_free)
-***/
-            Credential() : m_cred(NULL) { } // do not use: here for swig
-            Credential(abac_credential_t *cred) :
-                m_head(abac_credential_head(cred)),
-                m_tail(abac_credential_tail(cred)),
-                m_cred(abac_credential_dup(cred))
-                    { }
-            Credential(const Credential &cred) :
-                m_head(cred.m_head),
-                m_tail(cred.m_tail),
-                m_cred(abac_credential_dup(cred.m_cred))
-                    { }
-            ~Credential() { abac_credential_free(m_cred); }
-/***
-f  Role &head()
-     returns the head of the credential
-f  Role &tail()
-     returns the tail of the credential
-***/
-            const Role &head() { return m_head; }
-            const Role &tail() { return m_tail; }
-/***
-f  abac_chunk_t attribute_cert()
-     returns the attribute certificate in chunk, suitable for
-     transmission over the network or storage in a file
-     (C:abac_credential_attribute_cert)
-f  abac_chunk_t issuer_cert()
-     returns the issuer certificate in chunk, again suitable for
-     network transmission or file storage
-     (C:abac_credential_issuer_cert)
-***/
-            abac_chunk_t attribute_cert() { return abac_credential_attribute_cert(m_cred); }
-            abac_chunk_t issuer_cert() { return abac_credential_issuer_cert(m_cred); }
-        
-        private:
-            abac_credential_t *m_cred;
-            Role m_head, m_tail;
-    };
+    class Role;
+    class Credential;
 
 /***
@@ -246,8 +119,146 @@
                 return credentials;
             }
-
         private:
             abac_context_t *m_ctx;
+	friend class Role;
     };
+
+/***
+ABAC::Role
+   A Role, most calls are rarely used outside the library 
+***/
+    class Role {
+        public:
+/***
+f  Role()
+     default constructor, do not use, for swig only
+f  Role(abac_role_t*)
+     copy constructor, used for cloning an Role
+     (C:abac_role_dup)
+f  Role(char *)
+     instantiate a role from a string
+     (C:abac_role_from_string)
+f  Role(const Role &)
+     copy constructor, used for cloning an Role
+     (C:abac_role_dup)
+f  ~Role()
+     default destructor
+     (C:abac_role_free)
+***/
+            Role() : m_role(NULL) { } // do not use: here for swig
+            Role(abac_role_t *role) { m_role = abac_role_dup(role); }
+            Role(char *role_name) { m_role = abac_role_from_string(role_name); }
+            Role(const Role &role) { m_role = abac_role_dup(role.m_role); }
+            ~Role() { abac_role_free(m_role); }
+/***
+f  bool is_principal()
+     (C:abac_role_is_principal)
+f  bool is_role()
+     (C:abac_role_is_role)
+f  bool is_linking()
+     (C:abac_role_is_linking)
+     indicates the type of role encoded
+***/
+            bool is_principal() const { return abac_role_is_principal(m_role); }
+            bool is_role() const { return abac_role_is_role(m_role); }
+            bool is_linking() const { return abac_role_is_linking(m_role); }
+
+/***
+f  char* string()
+     string representation of the role
+     (C:abac_role_string)
+***/
+            char *string() const { return abac_role_string(m_role); }
+/***
+f  char* short_string()
+     string representation of the role
+     (C:abac_role_string)
+***/
+            char *short_string(Context& c) const { 
+		return abac_role_short_string(m_role, c.m_ctx);
+	    }
+/***
+f  char* linked_role()
+     the linked role of a linking role
+     i.e., A.r1.r2, linked_role() returns A.r1
+     (C:abac_role_linked_role)
+f  char* role_name()
+     the role name of any role (the part after the last dot)
+     (C:abac_role_role_name)
+f  char* principal()
+     the principal part of any role
+     (C:abac_role_principal)
+***/
+            char *linked_role() const { return abac_role_linked_role(m_role); }
+            char *role_name() const { return abac_role_role_name(m_role); }
+            char *principal() const { return abac_role_principal(m_role); }
+
+        private:
+            abac_role_t *m_role;
+    };
+
+/***
+ABAC::Credential
+   This is never instantiated directly. These will only ever be
+   returned as a result of calls to Context::query or
+   Context::credentials.
+***/
+    class Credential {
+        public:
+/***
+f  Credential()
+     default constructor, do not use, for swig only
+f  Credential(abac_credential_t*)
+     copy constructor, used for cloning a credential
+     (C:abac_credential_head)
+     (C:abac_credential_tail)
+     (C:abac_credential_dup)
+f  Credential(const Credential&)
+     copy constructor, used for cloning a credential
+     (C:abac_credential_head)
+     (C:abac_credential_tail)
+     (C:abac_credential_dup)
+f  ~Credential()
+     default destructor
+     (C:abac_credential_free)
+***/
+            Credential() : m_cred(NULL) { } // do not use: here for swig
+            Credential(abac_credential_t *cred) :
+                m_head(abac_credential_head(cred)),
+                m_tail(abac_credential_tail(cred)),
+                m_cred(abac_credential_dup(cred))
+                    { }
+            Credential(const Credential &cred) :
+                m_head(cred.m_head),
+                m_tail(cred.m_tail),
+                m_cred(abac_credential_dup(cred.m_cred))
+                    { }
+            ~Credential() { abac_credential_free(m_cred); }
+/***
+f  Role &head()
+     returns the head of the credential
+f  Role &tail()
+     returns the tail of the credential
+***/
+            const Role &head() { return m_head; }
+            const Role &tail() { return m_tail; }
+/***
+f  abac_chunk_t attribute_cert()
+     returns the attribute certificate in chunk, suitable for
+     transmission over the network or storage in a file
+     (C:abac_credential_attribute_cert)
+f  abac_chunk_t issuer_cert()
+     returns the issuer certificate in chunk, again suitable for
+     network transmission or file storage
+     (C:abac_credential_issuer_cert)
+***/
+            abac_chunk_t attribute_cert() { return abac_credential_attribute_cert(m_cred); }
+            abac_chunk_t issuer_cert() { return abac_credential_issuer_cert(m_cred); }
+        
+        private:
+            abac_credential_t *m_cred;
+            Role m_head, m_tail;
+    };
+
 
 /***
Index: doc/API
===================================================================
--- doc/API	(revision bc12f3d4f8058f3cc802b4b2947143a0a5e33e10)
+++ doc/API	(revision b7e77dfa7e38d121dc6bbbab89456e4af6479d04)
@@ -8,93 +8,4 @@
      -unsigned char *data
      -int len
-
-ABAC::Role
-   A Role, most calls are rarely used outside the library 
-
-   Role()
-     default constructor, do not use, for swig only
-
-   Role(abac_role_t*)
-     copy constructor, used for cloning an Role
-     (C:abac_role_dup)
-
-   Role(char *)
-     instantiate a role from a string
-     (C:abac_role_from_string)
-
-   Role(const Role &)
-     copy constructor, used for cloning an Role
-     (C:abac_role_dup)
-
-   ~Role()
-     default destructor
-     (C:abac_role_free)
-
-   bool is_principal()
-     (C:abac_role_is_principal)
-
-   bool is_role()
-     (C:abac_role_is_role)
-
-   bool is_linking()
-     (C:abac_role_is_linking)
-     indicates the type of role encoded
-
-   char* string()
-     string representation of the role
-     (C:abac_role_string)
-
-   char* linked_role()
-     the linked role of a linking role
-     i.e., A.r1.r2, linked_role() returns A.r1
-     (C:abac_role_linked_role)
-
-   char* role_name()
-     the role name of any role (the part after the last dot)
-     (C:abac_role_role_name)
-
-   char* principal()
-     the principal part of any role
-     (C:abac_role_principal)
-
-ABAC::Credential
-   This is never instantiated directly. These will only ever be
-   returned as a result of calls to Context::query or
-   Context::credentials.
-
-   Credential()
-     default constructor, do not use, for swig only
-
-   Credential(abac_credential_t*)
-     copy constructor, used for cloning a credential
-     (C:abac_credential_head)
-     (C:abac_credential_tail)
-     (C:abac_credential_dup)
-
-   Credential(const Credential&)
-     copy constructor, used for cloning a credential
-     (C:abac_credential_head)
-     (C:abac_credential_tail)
-     (C:abac_credential_dup)
-
-   ~Credential()
-     default destructor
-     (C:abac_credential_free)
-
-   Role &head()
-     returns the head of the credential
-
-   Role &tail()
-     returns the tail of the credential
-
-   abac_chunk_t attribute_cert()
-     returns the attribute certificate in chunk, suitable for
-     transmission over the network or storage in a file
-     (C:abac_credential_attribute_cert)
-
-   abac_chunk_t issuer_cert()
-     returns the issuer certificate in chunk, again suitable for
-     network transmission or file storage
-     (C:abac_credential_issuer_cert)
 
 ABAC::Context
@@ -155,4 +66,97 @@
      (C:abac_context_credentials)
      (C::abac_context_credentials_free)
+
+ABAC::Role
+   A Role, most calls are rarely used outside the library 
+
+   Role()
+     default constructor, do not use, for swig only
+
+   Role(abac_role_t*)
+     copy constructor, used for cloning an Role
+     (C:abac_role_dup)
+
+   Role(char *)
+     instantiate a role from a string
+     (C:abac_role_from_string)
+
+   Role(const Role &)
+     copy constructor, used for cloning an Role
+     (C:abac_role_dup)
+
+   ~Role()
+     default destructor
+     (C:abac_role_free)
+
+   bool is_principal()
+     (C:abac_role_is_principal)
+
+   bool is_role()
+     (C:abac_role_is_role)
+
+   bool is_linking()
+     (C:abac_role_is_linking)
+     indicates the type of role encoded
+
+   char* string()
+     string representation of the role
+     (C:abac_role_string)
+
+   char* short_string()
+     string representation of the role
+     (C:abac_role_string)
+
+   char* linked_role()
+     the linked role of a linking role
+     i.e., A.r1.r2, linked_role() returns A.r1
+     (C:abac_role_linked_role)
+
+   char* role_name()
+     the role name of any role (the part after the last dot)
+     (C:abac_role_role_name)
+
+   char* principal()
+     the principal part of any role
+     (C:abac_role_principal)
+
+ABAC::Credential
+   This is never instantiated directly. These will only ever be
+   returned as a result of calls to Context::query or
+   Context::credentials.
+
+   Credential()
+     default constructor, do not use, for swig only
+
+   Credential(abac_credential_t*)
+     copy constructor, used for cloning a credential
+     (C:abac_credential_head)
+     (C:abac_credential_tail)
+     (C:abac_credential_dup)
+
+   Credential(const Credential&)
+     copy constructor, used for cloning a credential
+     (C:abac_credential_head)
+     (C:abac_credential_tail)
+     (C:abac_credential_dup)
+
+   ~Credential()
+     default destructor
+     (C:abac_credential_free)
+
+   Role &head()
+     returns the head of the credential
+
+   Role &tail()
+     returns the tail of the credential
+
+   abac_chunk_t attribute_cert()
+     returns the attribute certificate in chunk, suitable for
+     transmission over the network or storage in a file
+     (C:abac_credential_attribute_cert)
+
+   abac_chunk_t issuer_cert()
+     returns the issuer certificate in chunk, again suitable for
+     network transmission or file storage
+     (C:abac_credential_issuer_cert)
 
 ABAC::ID
