XACML Deontic Profile

Standard XACML evaluates to Permit or Deny. The Deontic Profile introduces a third dimension: normative state. A decision is not just about access, but about what the subject is now obligated to do.

• Obligation Enforcement: The PEP is instructed to execute a mandatory action (e.g., 'log access', 'encrypt data').
• Advice: The PEP receives discretionary guidance (e.g., 'consider anonymizing the record').
• Stateful Compliance: The system tracks whether the obligation was fulfilled, not just whether access was granted.

The profile maps XACML elements to Standard Deontic Logic (SDL) operators, providing a mathematically rigorous foundation for policy analysis.

• Permit maps to the permission operator (P).
• Deny maps to the prohibition operator (F), which is logically equivalent to ~P.
• Obligation maps to the duty operator (O).
• Conflict Detection: Formal semantics enable static analysis of policies to detect normative conflicts where a subject is simultaneously obligated and prohibited from the same action.

A critical feature for real-world compliance is managing Contrary-to-Duty (CTD) obligations—the rules that activate when a primary duty is violated.

• Primary Obligation: 'A user must delete a record within 30 days.'
• CTD Obligation: 'If the record is not deleted, the user must notify the Data Protection Officer.'
• XACML Mechanism: The profile uses advice and obligation combinations in the policy to chain these fallback norms, avoiding the logical paradoxes that plague simpler deontic systems.

Deontic decisions often depend on the dynamic state of the world. The profile tightly couples with the Policy Information Point (PIP) to evaluate normative preconditions.

• State Queries: Before issuing an obligation, the PDP queries the PIP: 'Has the subject already completed mandatory training?'
• Contextual Permissions: A permission might be granted only if a specific constitutive norm is active (e.g., 'a state of emergency has been declared').
• Attribute-Based Norms: Obligations can be targeted based on subject attributes like role, clearance, or location.

Unlike simple access logs, the Deontic Profile enables tracking the full lifecycle of a normative duty from creation to discharge.

• Activation: The obligation is created by a Permit decision with an associated ObligationExpression.
• Fulfillment: The Policy Enforcement Point (PEP) reports back that the mandated action was completed.
• Violation: The system detects non-fulfillment within a deadline, triggering a CTD obligation or a sanctioning policy.
• Expiration: The duty is discharged by a subsequent event or a temporal constraint.

The XACML Deontic Profile serves as an enforcement endpoint for rules modeled in LegalRuleML, creating a bridge from legal knowledge representation to runtime access control.

• Semantic Alignment: Both standards share a common deontic vocabulary, allowing for direct translation of legal norms into executable policies.
• Separation of Concerns: LegalRuleML handles the formal modeling of the law, while XACML handles the real-time, attribute-based enforcement of those modeled norms.
• Auditability: The mapping provides a clear lineage from a statute to a specific access control decision.