A policy validation framework for enterprise authorization specification

The validation of enterprise authorization specification for conformance to enterprise security policies requires an out-of-band framework in many situations since the enforcing access control mechanism does not provide this feature. We describe one such framework. The framework uses XML to encode the enterprise authorization specification, XML schema to specify the underlying access control model (which in our case is the role-based access control model (RBAC)) and Schematron language to encode the policy constraints. The conformance of the XML-encoded enterprise authorization specification to the structure of the RBAC model (specified through XML schema) as well as the policy constraints (specified through Schematron) are verified through a Schematron validator tool.