Data ProtectionIdentity & Access Management
Axiomatics Policy Server
Fine-grained ABAC/PBAC authorization engine externalizing access decisions via XACML and ALFA.
Axiomatics Policy Server Overview
What it does
Axiomatics Policy Server is a runtime, fine-grained authorization engine that externalizes access decisions from application code. It applies attribute-based access control (ABAC) and policy-based access control (PBAC), deciding who can reach a resource using attributes about the user, the resource, the action, and the surrounding context at the moment of each request. Policies are written once and enforced consistently across applications, APIs, microservices, and data.
How it works
The product separates policy decisions from enforcement using a Policy Decision Point delivered as a REST/JSON cloud-native microservice, with Policy Enforcement Points deployed as service-mesh sidecars (such as Envoy), embedded agents, or gateway proxies. Policies are authored as code in the ALFA language and the XACML 3.0 standard, then tested and promoted through a policy DevOps workflow. Attribute Connectors pull data from external sources at evaluation time, and decisions can allow, deny, filter, or dynamically mask responses, aligning with NIST SP 800-162 guidance on ABAC.
Credentials and traction
Axiomatics is named an example technology for Authorization Management Platforms in the 2026 Gartner Reference Architecture Brief: IAM for AI Agents and Other Workloads. It was earlier featured among the vendors in KuppingerCole's 2022 Market Compass for Policy-Based Access Management and won the Zero Trust category at the 2022 Globee Cyber Security Global Excellence Awards. Over 30 percent of its customer base are Fortune 1000 organizations, and the Policy Server is deployed across financial services, healthcare, manufacturing, and public sector customers.
Key Capabilities
mapped to solution categoriesDefines and enforces authorization policies that decide which users and machines can access which applications and APIs, evaluated at runtime alongside authentication.
Enforces externalized, fine-grained authorization policy using ABAC or RBAC for applications and APIs.
Manages OAuth 2.0 client credentials and JWT issuance for machine-to-machine API authentication, with rate limiting and scope enforcement.
Provides access management functions for machines, workloads, services and agentic AI.
Integrations
compatible toolsImplementation & support
Info last updated on June 30, 2026
Vendors
Is this your product?
Claim your profile to connect with the teams looking for your solutions.