OASIS-xacml@ConnectedCommunity.org
Contacts
Chair: Bill Parducci
bill@parducci.net
TC Administrator: Jess Dickson
jess.dickson@oasis-open.org
Charter and intellectual property
The TC operates under its charter and the OASIS intellectual property rights mode.
Description
Portable, attribute-centric authorization policy and decision processing.
On this page
Authorization policy for a multi-format world
For more than two decades, XACML has provided a rigorous, interoperable way to answer a central security question: may this subject perform this action on this resource in this context? Its attribute-based model has supported authorization systems deployed around the world.
The XACML Technical Committee is now carrying that foundation forward as the Attribute-Centric Authorization Language (ACAL), the successor to XACML 3.0. ACAL defines authorization policy semantics, decision requests and responses, processing rules, and conformance independently of any one data format. A single model can therefore be represented in XML, JSON, or YAML without creating separate policy languages.
ACAL is the common model. XACML, JACAL, and YACAL are its XML, JSON, and YAML representations.
Why ACAL
XACML 3.0 remains a powerful and mature authorization standard. ACAL preserves that foundation while addressing the XML dependency and structural complexity that made XACML harder to adopt and maintain than necessary.
- One semantic foundation, multiple formats. Implementers can use the representation that fits their platform while sharing the same authorization model and processing rules.
- A simpler policy structure. ACAL replaces the separate Policy and PolicySet hierarchy with one nestable Policy construct and uses the same expression model for targets and conditions.
- Less repetition, easier reuse. Bundles, shared variable definitions, and short identifiers make policies more portable and less verbose.
- Modern expression and data support. Quantified expressions and separate XPath and JSONPath profiles support contemporary structured-data use cases without coupling the core model to either technology.
Specification family and current status
The immutable OASIS publications below are stable review milestones. The linked editor's drafts in the TC's public GitHub repository show the most current work and may change as the committee resolves issues and prepares the next milestone.
The repository also contains schemas, examples, representation-specific artifacts, and profiles. The ACAL Adoption and Implementation Guide explains the changes from XACML 3.0 with migration guidance and examples across XML, JSON, and YAML.
XACML 3.0 and the standards lineage
XACML 1.0 became an OASIS Standard in 2003, followed by XACML 2.0 in 2005. XACML 3.0 arrived in 2013, and its approved errata were incorporated in 2017. The resulting XACML 3.0 Plus Errata 01 remains the latest approved core OASIS Standard while the ACAL family advances through the standards process.
XACML 3.0 also established an active family of work products, including the JSON Profile of XACML 3.0 Version 1.1, the XACML REST Profile Version 1.1, the Time Extensions Profile, the Related and Nested Entities Profile, and the Dynamic Attribute Authority Profile.
Earlier versions remain available for historical and compatibility needs in the complete OASIS XACML publication library, but the committee's current focus is XACML 3.0 and the ACAL specification family.
Follow the work and participate
Questions may be sent to OASIS-xacml@ConnectedCommunity.org.