For twenty years, standards have shaped how we build technology, run our business, and work with customers and partners around the globe.
From contributing to authorization standards like eXtensible Access Control Markup Language (XACML), NIST ABAC 800-162, and Abbreviated Language for Authorization (ALFA) to helping drive the future of authorization interoperability with OpenID AuthZEN, standards have never been a checkbox to us. They have been foundational to how we think about trust, interoperability, security, and long-term innovation.
As we celebrate Axiomatics’ 20th anniversary, it’s a good time to reflect on why standards continue to matter more than ever. Especially in a world that is increasingly being shaped by AI, APIs, and autonomous workloads.
Why standards matter
Without standards, organizations are left navigating fragmented systems, proprietary integrations, vendor lock-in, and inconsistent security practices. Standards create common languages and shared expectations that allow technologies, organizations, and ecosystems to work together.
At their best, standards:
- Enable interoperability across vendors and platforms
- Reduce complexity for developers and enterprises
- Improve security, governance, and compliance
- Provide guarantees that the models and standards have been carefully thought through and vetted by peers in the industry
Standards also help future-proof technology investments. Organizations can evolve architectures and adopt new technologies without having to rebuild everything from scratch every few years.
Technology standards
When discussing technology standards, it's useful to distinguish between two categories: standards that policy-driven authorization helps organizations achieve and standards that authorization platforms comply with and support. Policy-driven authorization enables organizations to meet the access control requirements of regulations and frameworks such as HIPAA, ISO/IEC 27001:2022, ISO 9001:2015, GDPR, PCI DSS, NIS2, and more by enforcing consistent, fine-grained access decisions. This part of the article, however, focuses on the technical standards and specifications that authorization platforms themselves comply with and integrate with to support secure, interoperable systems.
NIST
When you first think about standards and authorization, the National Institute of Standards and Technology (NIST) comes to mind. NIST formalized what attribute-based access control (ABAC) means and helped clarify what authorization was when many vendors and analysts were using different terms for the same thing. In doing this, NIST also set in stone the P*P architecture, which we use at Axiomatics and within the Organization for the Advancement of Structured Information Standards eXtensible Access Control Markup Language (OASIS XACML). Later, NIST also introduced their Zero Trust Reference Architecture (NIST 800-207) which builds on top of the NIST ABAC architecture. The document is about providing you with implementation guidelines and best practices.
XACML
XACML is a standard developed by leading security experts as part of OASIS. It created a common framework for defining and evaluating policies independently from applications themselves.
This separation between policy and application logic became foundational for modern authorization architectures because it allowed organizations to:
- Centralized authorization policies
- Apply consistent governance across systems
- Move beyond static role-based access control models
As the industry modernizes, the principles behind XACML remain more relevant than ever. As noted in the 2026 Gartner® Reference Architecture Brief: IAM for AI Agents and Other Workloads:
“While the predominant standard for AMP has been the eXtensible Access Control Markup Language (XACML), nowadays there is much traction for technologies such as ALFA and AuthZEN.”*
ALFA
One of the drivers when defining standards is usability, especially from a developer and integrator’s point of view. XACML provided a robust framework and clean interfaces. The original XML-based PEP-PDP APIs were quickly replaced with REST/JSON interfaces. XACML’s policy syntax is XML which many developers shy away from (though AI loves its deterministic, schema-based, structure). That led to the development of ALFA, a domain-specific language developed under the helm of the OASIS XACML Technical Committee based on original designs by Axiomatics.
Fun Fact: ALFA was originally named Axiomatics Language for Authorization (ALFA)
ALFA simplified the process of creating and maintaining authorization policies by giving developers and policy authors a more concise, human-readable way to write policies while still leveraging the underlying XACML model. Instead of focusing on XML syntax, teams could focus on authorization logic itself.
That mattered because successful standards adoption depends not only on technical capability, but also on developer accessibility and operational usability.
The AuthZEN Working Group
The Open ID AuthZEN Working Group aims to create a standardized framework for applications to communicate with policy-based authorization systems by defining common protocols and formats for fine-grained access control decisions.
In many ways, AuthZEN represents an effort to bring interoperability and ecosystem simplicity that OpenID connect brought to authentication into the authorization space. Acting as a bridge between policy decision points (PDPs), identity providers, and API gateways, OpenID AuthZEN ensures seamless, standardized authorization across enterprise IT environments.
Axiomatics has been deeply involved in this effort, with our CTO serving as one of the co-founders and co-chairs of the AuthZEN Working Group.
Standards go beyond technology at Axiomatics
For us, standards aren’t limited to product architecture and interoperability. They also shape how we operate as a business.
ISO certifications
Axiomatics maintains both ISO:9001:2015 and ISO/IEC 27001:2022 certifications, internationally recognized standards for quality management and information security management.
These certifications validate that organizations have structured processes, controls, and governance frameworks in place to consistently deliver secure, high quality services. Achieving and maintaining these certifications requires an ongoing commitment across multiple parts of the organization.
The ISO 9001 is awarded to organizations with processes and procedures in place to ensure standards are met in all aspects of their services. The Quality Management System accreditation helps businesses monitor and manage quality across the business, create satisfied customers and employees, and continually improve.
he ISO/IEC 27001 certification is achieved by organizations for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an Information Security Management System that assures the robustness and quality of the company’s risk management processes to information security. Achieving certification for this standard means Axiomatics has implemented all security management guidelines, minimizing risk exposure and protecting the company, its assets, clients and stakeholders.
Axiomatics first achieved the ISO 27001 Certification in 2021 and has continued to successfully maintain recertification each year. You can read more about our certification journey here.
Standards in how we operate
Standards also influence how we operate day to day as a cybersecurity company. We believe organizations building security technology should hold themselves to the same high standards of security, governance, and accountability that they help their customers achieve.
Across the business, we follow established frameworks, regulations, and industry best practices that guide how we develop software, protect information, and manage risk. This includes following OWASP SAMM security best practices within engineering and meeting applicable requirements under regulations such as CRA, GDPR, and NIST CSF 2.0 — requirements we also help our customers address through dynamic, policy-driven authorization.
As a member of the Leonardo family, Axiomatics operates within Leonardo’s rigorous compliance framework for foreign subsidiaries. This framework provides strong governance and oversight across key risk areas, including anti-corruption, cybersecurity, human rights, and tax compliance, while also encompassing robust trade controls and standardized third-party due diligence supported by risk and red-flag assessments. Regular reporting and ongoing reviews of implementation provide measurable oversight, reinforcing transparency, accountability, and long-term trust.
This integration adds another strong layer of governance and oversight to the principles and practices Axiomatics has built over the past twenty years, creating an even stronger foundation for the future.
Accessibility standards matter too
Standards are almost important for creating inclusive digital experiences. Our new website was designed to align with the Web Content Accessibility Guidelines (WCAG), which are internationally recognized accessibility standards developed by the World Wide Web Consortium (W3C).
WCAG provides technical standards to help ensure websites, applications, and digital experiences are accessible to people with varying physical, visual, auditory, and cognitive disabilities.
Looking ahead
Over the last twenty years, technology has changed dramatically. But what hasn’t changed is the importance of shared standards in creating secure, scalable, and interoperable systems.
Standards create a foundation for quality and consistency while helping organizations future-proof how they build, operate, and evolve. They provide a common framework that can endure even as technologies, requirements, and risks change.
As organizations continue to advance with AI, autonomous systems, cloud-native architectures, and increasingly complex digital environments, the need for open standards will only continue to grow.
That belief has guided Axiomatics for the last twenty years, and it will continue to guide how we build, operate, and innovate for the years ahead.
*Reference Architecture Brief: IAM for AI Agents and Other Workloads, 20 April 2026, Erik Wahlstrom
Gartner is a trademark of Gartner, Inc. and/or its affiliates.