Quiz Entry - updated: 2026.07.14
What are the four components of the XACML architecture model and how do they interact?
PEP enforces (guards the door), PDP decides (permit/deny), PAP stores the policy rules, and PIP supplies extra attributes the PDP needs.
* XACML — the PEP enforces, the PDP decides, the PAP stores the rules, the PIP supplies attributes. *
XACML (eXtensible Access Control Markup Language) is a standard for policy-based authorization; it splits the job into four cooperating parts:
| Component | Full Name | Role |
|---|---|---|
| PEP | Policy Enforcement Point | Guards the door - intercepts requests, enforces decisions |
| PDP | Policy Decision Point | The brain - evaluates policies, decides permit/deny |
| PAP | Policy Administration Point | The librarian - stores and manages policy rules |
| PIP | Policy Information Point | The lookup service - provides extra attributes |
Mnemonic: "PEP guards, PDP decides, PAP stores, PIP provides"
Flow example ("Can Alice view record #123?"):
- Request hits PEP (gatekeeper)
- PEP asks PDP "Allow or deny?"
- PDP checks rules from PAP and attributes from PIP
- PDP returns Permit/Deny to PEP
- PEP enforces the decision
Go deeper:
XACML (Wikipedia) — the OASIS policy language and its PEP/PDP/PAP/PIP reference architecture.