> For the complete documentation index, see [llms.txt](https://dev.ishare.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev.ishare.eu/version-3.0/introduction/specific-technical-standards/xacml-3.0.md).
# XACML 3.0
Within iSHARE, it is essential to provide fine-grained authorisation. Besides rules on the authorisation, it is important to have varying options to describe the resources and their attributes to which the rules apply.
XACML 3.0 is a specification for describing such authorisation rules, but it is XML-based. For iSHARE, a JSON port was created for expressing the XACML specifications regarding authorisation. This 'delegation evidence structure' is discussed in more detail in the chapter on [delegation evidence structure](/version-3.0/authorisation-registry-role/delegation-endpoint.md#response-model).
On this page, a brief description of XACML is provided. For the most recent version of the specification, click on [this link](http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html).
### Description
XACML (eXtensible Access Control Markup Language) is an XML-based specification that is designed to control access to applications. One of the main advantages of this specification is that applications and systems with their own and different authorisation structure can be integrated into one authorisation scheme. authorisation and the rules surrounding it can be managed centrally, regardless of the authorisation mechanism of the applications themselves. This phenomenon is called externalisation. XACML is derived from SAML and provides the underlying specification for ABAC (Attribute-Based Access Control). XACML is also suitable to be used in combination with RBAC (Role-Based Access Control).
Moreover, with the help of XACML, authorisation can be arranged and managed in detail. This is called fine-grained authorisation. XACML supports the use of security labels, rules with arbitrary attributes, rules with a certain duration and dynamic rules.
In XACML, two main functions can be distinguished. One function defines the criteria with which authorisations are assigned, such as 'only an experienced user from department X is allowed to modify documents’. The other function compares the criteria with the rules or policies to determine whether a person is allowed to perform the operation on the object or not.
The architecture of XACML is fairly complex. This is partly due to the fact that it is difficult to fit the various components of XACML in the application landscape. These components should be positioned in such a way that the owner of the data can somehow control the authorisation to his or her data, but at the same time, the components should be positioned in such a way that the performance is not negatively influenced. This is extra important when independent parties need to cooperate with each other and want to jointly organise access to their applications. Finally, applications need to be compatible with XACML.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://dev.ishare.eu/version-3.0/introduction/specific-technical-standards/xacml-3.0.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.