a variable with a name the identifier a data type and a value most facts relating to the subject 104 the resource 102 the action and the environment 106 can be described in terms of attributes the request is constructed by a pep 108 the purpose of a pep 108 is to guard access to a resource 102 and only let authorized users through the pep 108 itself does not know who is authorized but it submits the request to a pdp 110 which contain policies governing what requests are to be permitted or denied respectively the pdp 110 evaluates the policies and returns a permit deny response to the pep 108 the pep 108 then either lets the access proceed or stops it as already noted the pep policy enforcement point may provide only some initial attribute values and the pdp policy decision point or other components may dynamically fetch more values from remote sources as they are needed if all necessary values cannot be retrieved the policy evaluation may return an output to the effect that the policy is indeterminate or not applicable in the circumstances or an error message a purpose of this architecture is to establish separation of concerns that is to differentiate between policy decision making and policy enforcement enforcement is by its nature specific to a particular resource 102 while a decision engine can be made general purpose and reusable in general policies can be nested to form a policy set which may be visualized in a tree form of the type shown in fig2 the combination of different policies is governed by combining algorithms which define what policy takes precedence over another policy the node u201c policyset 1 u201d in fig2 is of.