Access Decision Services

Real-Time Authorization Decision Services that evaluate every access request in sub-milliseconds, from a simple yes or no to open-ended questions like what can Alice do.

Binary Decisions, Sub-Millisecond

Ask a simple yes or no question, like can Alice view this record, and get a permit or deny decision back in sub-milliseconds.

Open-Ended Questions, Answered

Ask broader questions, like what can Alice do or who can access this record, and get back the full set of conditions that apply.

Deployed Anywhere You Need It

Run centrally, as a sidecar, at the edge, or in a container, so the decision engine fits your architecture instead of the other way around.

What the Access Decision Service Is

The Brain Behind Every Authorization Decision

The Access Decision Service (ADS) is the externalized runtime decision engine at the heart of the Axiomatics Authorization Management Platform. It evaluates every access request in real time against centralized authorization policies and contextual attributes, returning consistent, fine-grained authorization decisions across applications, APIs, data, and AI.

It replaces a different decision engine hidden in every application with one consistent service.
It answers requests in sub-milliseconds, so authorization never becomes the bottleneck.
It answers open-ended questions too, not just yes or no, through Contextual Authorization.

Core Functions

Binary Decisions

Answer yes or no access questions in sub-milliseconds through a binary API, with a batch mode to send multiple requests and receive multiple decisions in one round trip.

Policy Gap Analysis

Compare policy snapshots over time to spot unused, conflicting, or overly broad rules before they become a risk.

Open-Ended Queries

Answer broader questions like what can Alice do or who can access this document, returning the full set of conditions that apply, not just a permit or deny.

Flexible Deployment

Deploy centrally, as a sidecar, at the edge, or in a container, built on XACML 3.0 with OpenID AuthZEN support, so it fits any architecture.

Standards-Based Decisions

Turn query results into CSV reports, access matrices, and recertification evidence for governance and audit teams.

Built for Scale

A stateless, lightweight engine with a minimal footprint handles thousands of requests per second, scaling from a single service to millions of decisions a day.

About the Access Decision Service

Talk to an Expert

The Runtime Engine Behind Every Access Decision You Make Today

The Access Decision Service is the decision plane of the Axiomatics platform. Acting as the Policy Decision Point, it evaluates every access request against the policies and attributes defined in the Authorization Hub and returns a decision to the application through a REST API built on the XACML 3.0 standard.

When an application intercepts a request, it asks the Decision Service a question, such as can Alice view record 123. The service evaluates that question against deployed policies, retrieves any additional attributes it needs from connected sources, and returns permit or deny. The same engine also answers open-ended questions through Contextual Authorization Query (CAQ), so one runtime service covers both binary decisions and broader access questions.

Light Enough to Run Anywhere, Fast Enough to Run Everywhere Yet

A minimal footprint and stateless design mean the Decision Service runs centrally, as a sidecar, or at the edge, without becoming a bottleneck, and scales from a single application to millions of decisions a day.

CAQ Highlight

Ask Any Access Question, Not Just Yes or No

Get the full set of conditions behind a decision, powered by reverse queries using Conditional Access Query (CAQ)

Open-Ended Questions

Ask what can Alice do, who can access this document, or what can happen, and get back the conditions that apply.

Runtime Data Filtering

Generate filter expressions that translate into your database or GraphQL query, so apps only ever return what a user can see.

Entitlement Provisioning

Feed reverse query results directly into entitlement provisioning for downstream COTS and SaaS systems, without manual mapping.

Faster Bulk Decisions

Precompute the conditions behind a decision once, instead of asking the same yes-or-no question thousands of times over.

Relevant Use Cases

Use case

Eliminate Role Explosion with Policy-driven Authorization

Reduce role complexity, simplify access management, and enforce least-privilege access with dynamic, fine-grained authorization.

Use case

Minimize the Impact of Identity Breaches with Policy-driven Authorization

Reduce standing privileges, limit lateral movement, and enforce least-privilege access with dynamic authorization.

See all Use Cases

FAQs

What’s the difference between the Access Decision Service and CAQ?

Access Decision Service (ADS) answers binary yes-or-no questions in sub-milliseconds, acting as the Policy Decision Point defined in NIST SP 800-162. Contextual Authorization Query (CAQ), running as part of ADS, answers open-ended questions like what can Alice do, returning the full set of conditions instead of a single answer.

Can I run ADS and CAQ together?

Yes. ADS can run in three modes: ADS only, ADS with CAQ combined, or CAQ only, depending on what your architecture needs.

What standards does the Decision Service support?

It's built on XACML 3.0 and has support OpenID AuthZEN, so your integration stays portable across authorization vendors.

How does the Decision Service get the attributes it needs?

It retrieves them at evaluation time from connected sources like LDAP, Active Directory, databases, and APIs, filling the Policy Information Point role defined in NIST SP 800-162, so every decision reflects live data.

Where can I deploy ADS?

Centrally, as a sidecar, at the edge, or in a container. It's a stateless, lightweight service designed to fit into your existing architecture.

Request a Demo

Take the Next Step in Securing Your Enterprise Systems

Schedule a meeting with our experts to discover how the Axiomatics Authorization Management Platform helps you implement fine-grained access control, support Zero Trust, and meet today's security and compliance requirements.

Explore More Content

Related Use Case

From AI to Authorization: Key Takeaways from Identiverse 2026

June 30, 2026 7 min read

Product

Company

Product

Company

Access Decision Services

Binary Decisions, Sub-Millisecond

Open-Ended Questions, Answered

Deployed Anywhere You Need It

The Brain Behind Every Authorization Decision

Core Functions

Binary Decisions

Policy Gap Analysis

Open-Ended Queries

Flexible Deployment

Standards-Based Decisions

Built for Scale

About the Access Decision Service

The Runtime Engine Behind Every Access Decision You Make Today

Light Enough to Run Anywhere, Fast Enough to Run Everywhere Yet

Ask Any Access Question, Not Just Yes or No

Open-Ended Questions

Runtime Data Filtering

Entitlement Provisioning

Faster Bulk Decisions

Relevant Use Cases

Eliminate Role Explosion with Policy-driven Authorization

Minimize the Impact of Identity Breaches with Policy-driven Authorization

FAQs

What’s the difference between the Access Decision Service and CAQ?

Can I run ADS and CAQ together?

What standards does the Decision Service support?

How does the Decision Service get the attributes it needs?

Where can I deploy ADS?

Take the Next Step in Securing Your Enterprise Systems

Explore More Content

From AI to Authorization: Key Takeaways from Identiverse 2026

From AI to Authorization: Key Takeaways from Identiverse 2026

The Challenge Isn’t AI. The Challenge Is Authorization.

What Are MCP Apps and How Do You Secure Them? Using Dynamic Authorization for Enterprise AI Agents

AI agents in finance: Why dynamic access control is critical