Axiomatics APS

Dynamic Authorization Management (also called Entitlement Management) extends Policy-Based Access Control (PBAC) and Attribute-Based Access Control (ABAC) to help organizations manage access to restricted resources and data with finer granularity than role-based models can provide. It addresses modern demands such as GDPR-driven data authorization, the need to secure digital services exposed via APIs, and centralized control across multiple platforms. In a standard architecture, Policy Enforcement Points (PEPs) send access requests to a Policy Decision Point (PDP), which evaluates requests against policies stored in a Policy Retrieval Point (PRP) and attribute data from Policy Information Points (PIPs), while a Policy Administration Point (PAP) supports authoring and modification. Benefits include real-time decisions based on subject, resource, action, and environment attributes, externalized authorization, centralized policy control, simplified development, improved business management, and reduced costs—provided the authorization engine is fast, flexible, and integrates consistently with IAM, GRC, and related tools.

Axiomatics Policy Server (APS), founded in 2006 and headquartered in Stockholm, delivers a purpose-built dynamic authorization platform for fine-grained control over APIs, microservices, and data. APS fully implements OASIS XACML 3.0 and offers multiple PDP integration protocols (SOAP, REST/JSON, native Java embedding), plus support for the XACML REST profile v1.1. A notable capability is reverse query, including ARQ Raw (XML filter constraints) and ARQ SQL (returns SQL SELECT statements from policy). APS includes centralized administration through the Axiomatics Service Manager (ASM), multiple policy authoring options (graphical editor and ALFA Eclipse plugin), attribute dictionary management, validation tools (Policy Auditor, Review Manager), broad PIP connectors (LDAP v3 and SQL out-of-the-box), and extensive deployment choices spanning on-prem, containers, Kubernetes-orchestrated cloud-native ADS, and major cloud platforms. Strengths include maturity, standards compliance with extensions, and ecosystem integrations; challenges include sales-cycle length, required expertise, and complex governance.

• Dynamic Authorization Management is described as a superset of PBAC and ABAC.
• A typical dynamic authorization deployment includes PDP, PAP, PRP, PIP, and PEP components.
• A PDP can respond with Permit, Deny, Not applicable, or Indeterminate.
• Axiomatics was founded in 2006 and is headquartered in Stockholm, Sweden with offices in the U.S.
• Axiomatics customers include Global Fortune 1000 companies and federal government agencies and ministries.
• Axiomatics Policy Server fully implements the OASIS XACML Version 3.0 specification and profiles.
• APS supports SOAP-based XACML request/response, REST with JSON, and native Java embedding for PDP clients.
• APS provides two reverse query services: ARQ Raw (native XML with filter constraints) and ARQ SQL (returns an SQL SELECT statement).
• ASM supports popular databases including Oracle, SQL Server, PostgreSQL, and IBM DB2 for storing policies and policy-management information.
• APS can be deployed on Red Hat JBoss, Tomcat, and WebSphere, and can also run in containers such as Docker.

• “Dynamic Authorization Management, sometimes called Entitlement Management, is a superset of the Policy-Based Access Control (PBAC) and Attribute-Based Access Control (ABAC) sectors which is a much needed area of Identity and Access Management (IAM) today.”
• “When role-based models of access controls are no longer sufficient to model the dynamic nature of user access, an ABAC model can be used, which is more flexible than RBAC and can even be used to emulate (and extend) RBAC.”
• “Using this Dynamic Authorization Management model, access controls to APIs, microservices, and other application resources can now be made in real-time by policies in a centrally-managed ‘decision point’ or PDP…”
• “The benefits are significant: authorization is externalized, access policies become centralized, and software development is simplified.”
• “A reverse query allows an authorization request to be asked in a different way from the direct request.”
• “For example, instead of asking if a user can access a given resource, you can ask under what conditions the user would be permitted to access a resource or ask what resources a user has access to.”
• “Axiomatics provides an intuitive graphical web interface that makes policy creation and editing intuitive and straightforward to use.”
• “Axiomatics also has an Abbreviated Language for Authorization (ALFA) Eclipse IDE plugin allowing developers to write authorization policies without having to know the XACML syntax.”
• “PDPs can be deployed as a centralized service or in cases where availability is an issue, PDPs can be distributed, and policies pushed to the PDP when updated.”
• “Organizations that have dynamic authorization management in their strategic roadmap would do well to consider Axiomatics APS in their evaluation and selection process.”