XACML (eXtensible Access Control Markup Language) is an OASIS standard for externalizing authorization: policies are written separately from application code, evaluated centrally, and enforced where requests enter a system. It defines both a declarative policy language and a reference architecture for access decisions. Its XML syntax is expressive but verbose, which has limited modern adoption. section 8.1 section 8.5.1
Figure 4.2 Authorization reference architecture showing how access decisions are made. The Policy Enforcement Point (PEP) intercepts Alice’s request to ACMEProject and sends it to the Policy Decision Point (PDP). The PDP evaluates the request using policies from the Policy Administration Point (PAP), managed by Carol, and retrieves context from the Policy Information Point (PIP), which sources attributes from systems such as identity providers, time servers, and network telemetry. The PDP returns a decision, which the PEP enforces in real time.
An access request is intercepted by a Policy Enforcement Point (PEP), evaluated by a Policy Decision Point (PDP), informed by policies from a Policy Administration Point (PAP) and attributes from a Policy Information Point (PIP), then enforced in real time. section 4.4
This separation of enforcement, decision-making, policy administration, and information retrieval is XACML’s durable contribution. A PEP asks the PDP for a decision rather than embedding authorization logic in the application; the PDP evaluates policies and request context, then returns a result for the PEP to enforce. section 4.4 section 8.1.3
XACML models an authorization request mainly as attributes:
- Subject: the principal, described by attributes such as username, department, or clearance rather than a first-class identity object. section 8.1.2
- Action: a string-valued attribute such as read, write, or delete, matched in a policy target or condition. section 8.1.2
- Resource: attributes such as resource ID, type, and owner department; native typed resources and relationship graphs are limited. section 8.1.2
- Environment: contextual attributes including time, IP address, device posture, or other metadata used in policy conditions. section 8.1.2
Confidential-document access
A policy can permit access to a confidential document when the requester’s department equals the owner’s department. Its Target identifies the policy’s scope, its Rule supplies conditional permit logic, and a combining algorithm determines how multiple rules are resolved. The PEP sends subject, resource, action, and environment attributes to the PDP for evaluation. section 8.1.1 section 8.1.1
This attribute-based approach is useful where compliance or risk-sensitive context matters, but it shifts modeling discipline to policy authors. Naming conventions, profiles, and flattened resource facts often carry complexity that typed object models or relationship systems represent more directly. XACML policies can therefore be powerful yet difficult to write, read, test, and maintain. section 8.1.2 section 8.1
ALFA (Abbreviated Language for Authorization) offers a compact, code-like syntax that compiles to standard XACML while retaining policies, policy sets, rules, and combining algorithms. It addresses XML verbosity without changing XACML semantics. section 8.1.1
XACML remains most relevant as a standards-based, attribute-rich approach for regulated or legacy environments and as a reference point for modern policy engines. Its influence appears in centralized policy evaluation and the separation of decision logic from enforcement, even where newer tools use different languages and models. section 8.0 section 8.1.3
