What is the relationship to XACML?
The eXtensible Access Control Markup Language (XACML) is an OASIS access control standard defining policy and request/response concepts. Speedle+ uses its own Speedle Policy Definition Language (SPDL) and APIs. The OASIS XACML 3.0 specification is the reference for XACML behavior; this page explains architectural correspondences, not XACML conformance.
Map the responsibilities
| XACML concept | Responsibility | Speedle+ correspondence |
|---|---|---|
| PAP: Policy Administration Point | Manage authorization policy | Policy Management Service (PMS) |
| PDP: Policy Decision Point | Evaluate authorization requests | Authorization Decision Service (ADS) or embedded evaluator |
| PEP: Policy Enforcement Point | Enforce a decision on an operation | Application, gateway or integration calling Speedle |
| PIP: Policy Information Point | Supply attributes used by a decision | Trusted application data and configured identity/attribute integrations; no claim of a built-in XACML PIP interface |
Speedle’s architecture page already describes the PAP/PDP correspondence. The enforcement point must still prevent an operation when the decision denies access or evaluation fails.
Policy syntax and decision semantics
An SPDL authorization statement names its effect, principal, action and resource, with an optional condition:
grant user alice read book if clearance >= 3For user alice, action read, resource book and numeric attribute clearance = 4, this statement grants access in the Playground. A value of 2 does not satisfy the condition.
XACML policies can specify combining algorithms and include other standard constructs. Speedle’s applicable explicit deny takes precedence over a grant. Do not assume an arbitrary XACML combining algorithm, obligation, advice or attribute-category mapping survives translation unchanged. Likewise, a Speedle evaluation error should not be silently treated as a successful grant or as an exact XACML response-code mapping.
Assess translation before migration
Identify the policy constructs and profiles actually used. Map principal names and domains, actions, resources, attribute names and types, and decision/error handling. Recreate representative requests and compare expected results, including denials and missing attributes. Keep unsupported constructs explicit rather than dropping them during translation.
This guide does not provide a XACML XML policy importer, a XACML protocol endpoint or a conformance certification. Read the SPDL reference, decision API, PBAC guide and OES comparison before designing an integration.