A Policy Administration Point (PAP) is the authorization component where policies or policy-relevant relationships are created, managed, reviewed, and deployed. It keeps authorization logic explicit instead of scattering permission checks through application code. section 4.4 section 4.4.2
A PAP supports different administration patterns depending on the authorization model:
- Centralized policy management stores declarative rules, supports version control, testing, review, deployment, and auditing. section 4.4.2
- ACL-based administration is often local to each resource, such as filesystem metadata, an in-resource access list, or an administrative interface. section 5.1.2
- Relationship-based administration may be a contextual user interface, such as a sharing dialog or team-assignment control, because changing relationships changes future decisions. section 6.1.2
- Attribute-based administration commonly treats policies as versioned code or centralized policy-store artifacts managed through development tools. section 6.2.2
Project-report access
A security administrator defines a rule allowing members of the Project Managers group to view Team Reports only between 07:00 and 20:00. The rule is committed, reviewed, tested against known scenarios, deployed, and later audited when an access request is denied. section 4.4.2
Figure 4.2 Authorization reference architecture showing how access decisions are made. The Policy Enforcement Point (PEP) intercepts Alice’s request to ACMEProject and sends it to the Policy Decision Point (PDP). The PDP evaluates the request using policies from the Policy Administration Point (PAP), managed by Carol, and retrieves context from the Policy Information Point (PIP), which sources attributes from systems such as identity providers, time servers, and network telemetry. The PDP returns a decision, which the PEP enforces in real time.
Shows how the PAP supplies policies to the Policy Decision Point while enforcement and contextual data remain separate architectural responsibilities. section 4.4
