🛡️XACML

NEW

Also known as: eXtensible Access Control Markup Language

An XML-based standard providing a policy language and decision protocol for fine-grained, attribute-based access control.

DESCRIPTION

XACML defines an XML policy language to express fine-grained access rules and a request/response protocol for evaluating authorization decisions. It supports Attribute-Based Access Control (ABAC) through rich policy combinators and obligations. Typical deployments include a Policy Decision Point (PDP) and Policy Enforcement Point (PEP) integrating with enterprise IAM. XACML enables centralized governance and auditable decisions across diverse applications. JSON profiles and REST bindings evolved to ease modern integration.

ALTERNATIVE DEFINITIONS

OASIS

XACML defines a declarative access control policy language implemented in XML and a processing model describing how to evaluate access requests against policies.

Emphasizes declarative policy language and processing model.

Source

IBM

The eXtensible Access Control Markup Language (XACML) is a standard for access control policies, including a language for writing access control policies and a protocol for requesting and responding to authorization decisions.

Clarifies both policy language and decision protocol aspects.

Source

NIST

XACML is a language for expressing access control policies and a request/response language for obtaining authorization decisions.

Positions XACML within NIST guidance for access control standards.

Source

RELATED TERMS

Attribute-Based Access Control Policy Decision Point Policy Enforcement Point IAM OAuth 2.0 SAML JSON Policy Access Control Zero Trust Architecture

COMPETING TERMS

Open Policy Agent RBAC

RELATIONS

• Implemented by: Attribute-Based Access Control

KNOWLEDGE AREAS

Data Security Data Governance Data Privacy & Compliance AI Governance Software Engineering

TARGET AUDIENCE

Chief Information Security Officer Security Architect Cybersecurity Engineer DevOps Engineer Data Privacy Officer IT Manager

EXTERNAL SOURCES

• Wikipedia - XACML
• OASIS - XACML 3.0 core specification
• IBM - Vendor overview and guidance
• NIST - NIST report on access control

TOP QUESTIONS

How does XACML enable fine-grained access control?

It uses attributes (subject, resource, action, environment) with policies, combining algorithms, and obligations to produce context-aware authorization decisions.

Category: Example

What components are central to an XACML deployment?

A Policy Decision Point evaluates requests against policies, while Policy Enforcement Points intercept requests and enforce the returned decisions.

Category: Requirements

What is a common mistake when writing XACML policies?

Overly complex policies and unclear combining algorithms can cause unintended access results; start with minimal, testable rules.

Category: Mistakes

What risks arise from misconfigured XACML policies?

Misconfigurations can grant excessive access or block critical operations. Audit trails and policy testing reduce these risks.

Category: Risks

How does XACML compare to Open Policy Agent (OPA)?

XACML is an XML standard with ABAC roots; OPA uses Rego and integrates natively with cloud-native stacks. Choice depends on ecosystem and skill sets.

Category: Alternatives

Is XACML still relevant in Zero Trust Architecture?

Yes, XACML’s attribute-based decisions and centralized governance align with continuous verification and least-privilege enforcement.

Category: Relevancy

How are XACML policies tested and validated?

Use unit tests against PDPs, simulate access requests, verify obligations, and maintain versioned policy repositories with peer reviews.

Category: Management

What is the origin of XACML?

XACML was developed by the OASIS consortium to standardize policy expression and decision protocols for authorization.

Category: Origin

Can XACML be used with JSON and REST?

Yes, JSON profiles and RESTful interfaces exist to modernize integration beyond XML-only protocols.

Category: Topic