Axiomatics APS

Dynamic Authorization Management (also called Entitlement Management) extends Attribute-Based Access Control (ABAC) and is positioned as a highly compelling direction in Identity and Access Management because it externalizes authorization from applications into centrally managed policy services. Compared to Role-Based Access Control (RBAC), ABAC is more flexible, can emulate and extend RBAC, and supports tighter application integration, but it requires organizations to rethink how they design and govern authorizations. A typical dynamic authorization architecture includes five components: Policy Decision Point (PDP) for evaluating requests, Policy Administration Point (PAP) for authoring and modifying policies, Policy Retrieval Point (PRP) for storing policies, Policy Information Point (PIP) for attribute data, and Policy Enforcement Point (PEP) for sending requests and enforcing decisions. This model enables real-time access decisions for APIs, microservices, and other resources using attributes about subjects, resources, actions, and context (e.g., time of day), reducing development complexity and improving business control.

Axiomatics Policy Server (APS) is presented as a comprehensive solution implementing OASIS XACML 3.0, managed through the Axiomatics Service Manager (ASM) for centralized administration, configuration, and monitoring. APS supports multiple PDP client protocols (SOAP/XACML, REST/JSON, and embedded native Java) and offers reverse query services (ARQ Raw and ARQ SQL) to answer “what access is possible” questions, including generating SQL SELECT statements derived from policy. Policy authoring is supported via a graphical web editor and an ALFA Eclipse plugin that compiles to XACML. APS 6.2 adds multi-project segregation to support multiple business lines or customers with privacy boundaries. APS integrates attribute connectors to directories and databases, supports common PRP databases, provides PEP SDKs for Java and .NET, and offers broad deployment options including app servers, Docker, and major cloud/IaaS platforms. Strengths center on maturity, standards leadership, sophisticated policy capability, and an expanding partner ecosystem, while challenges include early-adopter sales cycles, required expertise, and ongoing complexity in policy governance.

• Dynamic Authorization Management is described as a superset of the ABAC sector.
• A dynamic authorization architecture includes PDP, PAP, PRP, PIP, and PEP components.
• A PDP can return Permit, Deny, Not Applicable, or Indeterminate decisions.
• Axiomatics was founded in 2006 and is headquartered in Stockholm, Sweden, with offices in the U.S.
• APS fully implements the OASIS XACML Version 3.0 specification.
• APS PDP clients can use SOAP-based XACML, REST/JSON, or embedded native Java options.
• APS offers ARQ Raw (XML filter constraints) and ARQ SQL (returns an SQL SELECT statement) reverse query services.
• APS 6.2 introduces multiple project capability to segregate policies and attribute definitions.
• Out-of-the-box connectors support LDAP v3 directories and SQL databases.
• APS supports PRP storage in databases including Oracle, SQL Server, PostgreSQL, and IBM DB2.

• “Dynamic Authorization Management, sometimes called Entitlement Management, is a superset of the Attribute-Based Access Control (ABAC) sector and is arguably the most exciting area of Identity and Access Management (IAM) today.”
• “The ABAC model is more flexible than RBAC and can even be used to emulate (and extend) RBAC.”
• “Using this Dynamic Authorization Management model, access control to APIs, microservices, and other application resources can now be made in real-time by policies in a centrally-managed ‘decision point’…”
• “The benefits are significant: authorization is externalized, access policies become centralized, and software development is simplified.”
• “A reverse query allows an authorization request to be asked in a different way from the direct request.”
• “Axiomatics introduced a new graphical web interface in version 6 of APS that makes policy creation and editing intuitive and straightforward to use.”
• “In APS 6.2, Axiomatics has introduced multiple project capability.”
• “PDPs can be deployed as a centralized service or in cases where availability is an issue, PDPs can be distributed, and policies pushed to the PDP when updated.”
• “As we see with the PSD2 regulation in the EU, open API connections between banks and their third parties has become more of a condition than a choice.”
• “Organizations that have dynamic authorization management in their strategic roadmap would do well to consider Axiomatics APS in their evaluation and selection process.”