XACML - Does a policy actually require a rule?

Question

If I define a XACML policy and provide some attributes in the policy target, do I actually need to provide an additional rule?

Answer 1

Yup, you need a Rule to actually say whether you want to Permit or Deny access.

Answer 2

From a schema validation perspective, you could have a policy with no rules, but as Craig points it out, the rule is what carries the decision. So a rule-less policy is pointless.

Answer 3

You need to think about the flow of logic for the policy. By defining target attributes, you are telling it what to affect, but not how. Even if you define actions in the policy target using ActionMatch, what you really did was target the Rule at Actions with a specific ActionID.

In other words, actions defined in the target of a policy identify action-related entities by matching attribute values. This still misses the mandatory Rule, which will contain action logic.