This specification uses the following syntax within normative outlines:

Elements and Attributes defined by this specification are referred to in the text of this document using XPath 1.0 [XPATH 1.0] expressions. Extensibility points are referred to using an extended version of this syntax:

Normative text within this specification takes precedence over normative outlines, which in turn take precedence over the XML Schema [] descriptions.

This specification uses a number of namespace prefixes throughout; they are listed in . Note that the choice of any namespace prefix is arbitrary and not semantically significant (see []).

All information items defined by this specification are identified by the XML namespace URI [] http://www.w3.org/ns/ws-policy. A normative XML Schema [, ] document can be obtained indirectly by dereferencing the namespace document at the WS-Policy 1.5 namespace URI.

In this document reference is made to the wsu:Id attribute in a utility schema (http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd). The wsu:Id attribute was added to the utility schema with the intent that other specifications requiring such an Id could reference it (as is done here).

It is the intent of the W3C Web Services Policy Working Group that the Web Services Policy 1.5 - Framework and Web Services Policy 1.5 - Attachment XML namespace URI will not change arbitrarily with each subsequent revision of the corresponding XML Schema documents as the specifications transition through Candidate Recommendation, Proposed Recommendation and Recommendation status. However, should the specifications revert to Working Draft status, and a subsequent revision, published as a WD, CR or PR draft, results in non-backwardly compatible changes from a previously published WD, CR or PR draft of the specification, the namespace URI will be changed accordingly.

Under this policy, the following are examples of backwards compatible changes that would not result in assignment of a new XML namespace URI:

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [].

We introduce the following terms that are used throughout this document:

This specification defines several mechanisms for associating policies (Web Services Policy 1.5 - Framework, []) with various XML Web service entities. For brevity, we define two sample policy expressions that the remainder of this document references.

indicates a policy for reliable messaging []. is a policy for securing messages using X509 certificates [].

The document containing both of these policy expressions is assumed to be located at http://www.example.com/policies.  Per Section 3.2 Policy Identification of Web Services Policy 1.5 - Framework [], the IRIs used for these policy expressions in the remainder of this document are http://www.example.com/policies#RmPolicy and http://www.example.com/policies#X509EndpointPolicy, for the examples in and , respectively.

Policies will often be associated with a particular policy subject using multiple policy attachments. For example, there may be attachments at different points in a WSDL description that apply to one policy subject, and other attachments may be made by UDDI and other mechanisms.

When multiple attachments are made, their relevent policies can be combined. The effective policy, for a given policy subject, is the combination of relevant policies. The relevant policies are those attached to policy scopes that contain the policy subject.

This combination can be achieved through a merge. A merge consists of serializing each policy as a policy expression, replacing their wsp:Policy element with a wsp:All element, and placing each as children of a wrapper wsp:Policy element. The resulting policy expression is considered to represent the combined policy of all of the attachments to that policy subject.

Such calculated policy expressions have no meaningful IRI of their own.

This section defines two general-purpose mechanisms for associating policies [] with one or more policy subjects. The first allows XML-based descriptions of resources to associate policy as part of their intrinsic definition. The second allows policies to be associated with arbitrary policy subjects independently from their definition.

The policy scope of an attachment is specific to the policy attachment Mechanism using it. Accordingly, any policy attachment mechanism MUST define the policy scope of the attachment.

It is often desirable to associate policies with Web services policy subjects represented as XML elements (i.e., WSDL 1.1 elements - Section for the specific details of WSDL attachment).

Since policy assertions are strongly typed by the authors, the precise semantics of how element policy is to be processed once discovered is domain-specific; however, implementations are likely to follow the precedent specified in the section below on WSDL [] and Policy.

This specification defines a global attribute that allows policy expressions to be attached to an arbitrary XML element. The following is the schema definition for the wsp:PolicyURIs attribute:

The namespace URI [] for this attribute is http://www.w3.org/ns/ws-policy.

The wsp:PolicyURIs attribute contains a white space-separated list of one or more IRIs []. When this attribute is used, each of the values identifies a policy expression as defined by []. If more than one IRI is specified, the individual referenced policies need to be merged together to form a single element policy expression. The resultant policy is then associated with the element information item's element policy property. The element policy is the policy attached to the policy subjects associated with the element information item that contains it.

An example of element policy through the use of this global attribute is given below using the sample policies stated in Section .

If the policies referenced by the following XML element

have been processed and merged, it would result in an element policy whose XML 1.0 representation is listed in :

Note that this element policy has no meaningful IRI.

The presence of the wsp:PolicyURIs attribute does not prohibit implementations from using additional mechanisms for associating policy expressions with XML-based constructs.

Alternatively, rather than using the global attribute, XML elements MAY use the wsp:Policy or wsp:PolicyReference elements directly as children, in order to support element policy (Per Section 4.3.4 Policy References of Web Services Policy 1.5 - Framework []), and the semantics for this are the same as for the use of the global attribute. For example, an alternative way of attaching the policies in the above example, using child elements, would be as follows: 

This mechanism allows policies to be associated with a policy subject independent of that subject's definition and/or representation through the use of a wsp:PolicyAttachment element.

This element has three components: the policy scope of the attachment, the policy expressions being bound, and optional security information. The policy scope of the attachment is defined using one or more extensible domain expressions that identify policy subjects, typically using IRIs.

Domain expressions identify the domain of the association. That is, the set of policy subjects that will be considered for inclusion in the scope using an extensible domain expression model. Domain expressions identify policy subjects to be included within the policy scope. Domain expressions yield an unordered set of policy subjects for consideration.

For the purposes of attaching policy to a policy subject through this mechanism, any policy expression contained inside of the wsp:AppliesTo element MUST NOT be considered in scope. For example, an Endpoint Reference may be used as a domain expression, and it may contain policy expressions within it, but this policy expressions are not considered in scope with respect to the wsp:PolicyAttachment element using it.

The following is the pseudo-schema for the wsp:PolicyAttachment element:

The following describes the attributes and elements listed in the pseudo-schema outlined above:

Domain expressions are used to identify entities such as endpoints, messages or resources with which a policy can be associated. For example, domain expressions may be used to refer to WSDL 1.1 definitions, WSDL 2.0 components, endpoint references, etc.

The following example illustrates the use of this mechanism with an EndpointReference domain expression for a deployed endpoint as defined in Web Services Addressing []:

In this example, the policy expression at http://www.example.com/policies#RmPolicy applies to all interactions with the endpoint at http://www.example.com/acct.

Policy attachment mechanisms use IRIs for some identifiers. This document does not define a base URI but relies on the mechanisms defined in XML Base [] and RFCs 3023 [], 3986 [] and 3987 [] for establishing a base URI against which relative IRIs can be made absolute.

Policy attachments in WSDL 1.1 can be used to associate policies with four different types of policy subject, identified as the service policy subject, the endpoint policy subject, the operation policy subject, and the message policy subject. These policy subjects should be considered as nested, due to the hierarchical nature of WSDL.

When attaching a policy to a WSDL element, a policy scope is implied for that attachment. The policy scope only contains the policy subject associated with that element and not those associated with the children of that element. Therefore, it is RECOMMENDED that each policy assertion contained within a WSDL element's element policy should have the correct semantic such that the policy subject for that assertion is that WSDL element. For example, assertions that describe behaviours regarding the manipulation of messages should only be contained within policies attached to WSDL message elements.

Figure 1 represents how the effective policies, with regard to WSDL, are calculated for each of these policy subjects. In the diagram, the dashed boxes represent policy scopes implied by WSDL elements. For a particular policy subject, the effective policy MUST merge the element policy of each element with a policy scope that contains the policy subject.

For abstract WSDL definitions, the element policy is considered an intrinsic part of the definition and applies to all uses of that definition. In particular, it MUST be merged into the effective policy of every implementation of that abstract WSDL definition.

Policies that are attached to a deployed resource (e.g., services or ports) are only considered in the effective policy of that deployed resource itself.

The example below illustrates the use of WS-Policy Attachment for WSDL 2.0:

The SecureBinding WSDL binding description describes a binding for an interface that provides real-time quotes and book information on securities. (The prefixes wsdl20 and tns are used here to denote the Web Services Description Language 2.0 XML Namespace and the target namespace of this WSDL document respectively.) To require the use of security for these offerings, a policy expression that requires the use of either transport-level or message-level security is attached to the binding description. The policy expression applies to any message exchange associated with any endpoint that supports this binding description.

The RealTimeDataPort WSDL endpoint description describes an endpoint that supports the SecureBinding WSDL binding description. To require the use of addressing and allow the use of optimization (Optimized MIME Serialization as defined in the MTOM specification []), a policy expression that represents the addressing requirement and optimization capability is attached to the endpoint description. The policy expression applies to any message exchange associated with the RealTimeDataPort endpoint.

In the above example, the #secure and #common policy expressions attached to the SecureBinding WSDL binding and RealTimeDataPort WSDL endpoint descriptions collectively apply to any message exchange associated with the RealTimeDataPort endpoint. The example below represents the combination of these two policies, that is, the effective policy for the RealTimeDataPort endpoint.

Policy attachment points in a WSDL 2.0 document are:

Any of these elements MAY have one or more wsp:Policy or wsp:PolicyReference child elements.

Policy attachment points in a WSDL document are associated with specific policy subjects as described in the table below. There are four policy subjects in WSDL: the service policy subject, the endpoint policy subject, the operation policy subject and the message policy subject. When a policy expression is attached to a policy subject in a WSDL document, capabilities and requirements represented by the policy expression apply to any message exchange or message associated with (or described by) the policy subject.

For a WSDL component, the attached policy (extension to the WSDL component model is described in ) is considered an intrinsic part of the WSDL component definition and applies to all uses of that definition. For example, when attached to a WSDL Interface component, capabilities and requirements represented by a policy apply to all the use of this WSDL Interface description. When attached to a WSDL Binding component, capabilities and requirements represented by a policy apply to all the Endpoints that support this binding description.

A policy associated with a service policy subject applies to any message exchange (that is explicitly described by the Interface component in the Service component's {interface} property) using any of the endpoints offered by that service.

Policies associated with an endpoint policy subject apply to any message exchange (that is explicitly described by the Interface component in the Service component’s {interface} property of the Endpoint component’s {parent} property) made using that endpoint. Given that a WSDL Interface component may be used by one or more binding descriptions, it is RECOMMENDED that only a policy containing policy assertions that apply to any possible binding description should be attached.

Policies associated with an operation policy subject apply to the message exchange described by that operation. Given that a WSDL Interface Operation component may be used by one or more binding descriptions, it is RECOMMENDED that only a policy containing policy assertions that apply to any possible binding description should be attached.

Policies associated with a message policy subject apply to that message (input, output or fault). Given that a WSDL Interface Message Reference, Interface Fault, Interface Fault Reference components may be used by one or more binding descriptions, it is RECOMMENDED that only a policy containing policy assertions that apply to any possible binding should be attached.

Policies MAY be attached at different levels of the WSDL component hierarchy. A message exchange with an endpoint MAY be described by the policies in all four policy subjects simultaneously.

The common mechanism of associating a policy expression with a policy subject is to attach a reference to the policy expression to the policy subject. As described in the WS-Policy specification [], a reference to a policy expression is represented using the wsp:PolicyReference element. A policy attachment to a WSDL element is represented by attaching a wsp:PolicyReference element as a child element of the WSDL element.

Policy expressions can be included within a WSDL document or may reside external to a WSDL document. If including policy expressions with a WSDL document is the chosen approach, it is RECOMMENDED that the wsp:Policy elements are included as children of the wsdl20:description element after the wsdl20:types element and referenced using the wsp:PolicyReference elements.

To mandate the processing of a policy expression attached to a policy attachment point in a WSDL document, the expression MUST be marked as required using the @wsdl20:required flag.

If the wsp:Policy elements are included as children of the wsdl20:description element, these Policy elements MUST NOT be marked as required using the @wsdl20:required. (Note: these policy expressions may be included as children of the wsdl20:description element and may not be attached to any policy attachment point in a WSDL document.)

This document adds an optional {policy} property to the following WSDL components:

The {policy} property, when present, represents the capabilities and requirements as a policy. The value of the {policy} property is a policy as defined by Section 3 - Policy Model in the WS-Policy specification []. The following table describes the mapping from XML representation to the {policy} property.

Two {policy} properties are equivalent when they represent policies that contain the same number of policy alternatives, and each policy alternative in the first policy is equivalent to some policy alternative in the second policy, and conversely.

Two policy alternatives are equivalent when each policy assertion in the first policy alternative is equivalent to some policy assertion in the second policy alternative, and conversely. If either policy alternative contains multiple policy assertions of the same type, policy alternative equality is dependent on the semantics of that assertion type.

Two policy assertions are equivalent if they have the same QName, if either policy assertion is an ignorable policy assertion, both assertions must be ignorable policy assertions and, if either policy assertion has a nested policy, both assertions must have a nested policy and the nested policies must be equal. If either assertion contains policy assertion parameters, then the policy assertion parameters SHOULD be compared for equality. Comparing policy assertion parameters for equality is not defined by this document, but policy assertion equality may be further refined by the corresponding policy assertion specification.

The following diagram illustrates the four policy subjects in WSDL and how the effective policy is calculated for each of these policy subjects.

If multiple policies are attached to WSDL components that collectively represent a policy subject then the effective policy of these policies applies. (For example, there is a policy attached to an Endpoint component that describes the component and there is a policy attached to the Binding component in the Endpoint component’s {binding} property.) The effective policy is the merge of the policies that are attached to the same policy subject. The rest of this section describes how the effective policy is calculated for each of these policy subjects.

When attaching a policy to a UDDI entity a policy scope is implied for that attachment. The policy scope only contains the policy subjects associated with that entity, and not those associated with the children of that entity. This policy is the entity's element policy.

Each policy assertion contained within a UDDI entity's element policy should have the correct semantic such that the policy subject for that assertion is that UDDI entity. For example, assertions that describe behaviours regarding a service provider should only be contained within policies attached to a businessEntity structure.

For UDDI tModels that represent Web service types, the element policy is considered an intrinsic part of the tModel and applies to all uses of that tModel. In particular, it MUST be merged into the effective policy of every bindingTemplate that references that tModel.

Policies that apply to deployed Web services (bindingTemplates) are only considered in the effective policy of that deployed resource itself.

Each of these entities MAY have an element policy per Section . The remainder of this section defines how that element policy is interpreted to calculate the effective policy.

UDDI tModels provide a generic mechanism for associating arbitrary metadata with services and other entities in a UDDI registry. To properly integrate Web Services Policy into the UDDI model, Web Services Policy 1.5 - Attachment pre-defines one tModel that is used to associate a remotely accessible policy with an entity in a UDDI registry.

This new tModel is called the remote policy reference category system and is defined in Appendix .

UDDI registries MUST use the (UDDI V2 []) tModelKey uuid:a27078e4-fd38-320a-806f-6749e84f8005 to uniquely identify this tModel so that UDDI registry users can expect the same behavior across different UDDI registries.

The tModel's valid values are those IRIs that identify external policy expressions; that is, when referencing this category system in a categoryBag, the corresponding keyValue of the keyedReference is the IRI of the policy expression.

Using the remote policy reference category system, one can then associate a policy expression with a businessEntity, a businessService, and a tModel using the entity's categoryBag. For example, associating the policy expression that is identified by the IRI http://www.example.com/myservice/policy with a businessService is done as follows: 

The tModelKey of the keyedReference MUST match the fixed tModelKey from the remote policy reference category system. The keyValue MUST be the IRI that identifies the policy expression.

A different approach has to be taken to associate a policy expression with a bindingTemplate, since bindingTemplates do not contain a categoryBag in UDDI Version 2. Therefore, the bindingTemplate's tModelInstanceInfo and instanceParms MUST be used as follows: 

The tModelKey of the tModelInstanceInfo MUST match the fixed tModelKey from the remote policy reference category system as defined above. The instanceParms MUST be the IRI that identifies the policy expression.

In addition to using the approach outlined in the section above, publishers may register a specific policy expression in a UDDI registry as a distinct tModel. To properly categorize tModels as policy expressions, Web Services Policy 1.5 - Attachment pre-defines the Web Services Policy Types category system as a tModel. This tModel is defined in Appendix .

The following illustrates a tModel for the policy expression identified by the IRI http://www.example.com/myservice/policy.

The first keyedReference specifies that the tModel represents a policy expression — rather than only being associated with one — by using the Web Services Policy Types category system's built-in category "policy", which is its single valid value. This is necessary in order to enable UDDI inquiries for policy expressions in general. The second keyedReference designates the policy expression the tModel represents by using the approach from the section above. This is necessary in order to enable UDDI inquiries for particular policy expressions based on their IRI.

Note that the policy expression IRI is also specified in the tModel's overview URL to indicate that it is a resolvable URL to actually retrieve the policy expression.

Web Services Policy 1.5 - Attachment pre-defines another tModel that is used to associate such a pre-registered, locally available policy expressions with an entity in a UDDI registry

This new tModel is called the local policy reference category system and is defined in Appendix .

UDDI registries MUST use the tModelKey uuid:a27f7d45-ec90-31f7-a655-efe91433527c to uniquely identify this tModel so that UDDI registry users can expect the same behavior across different UDDI registries.

The local policy reference category system is based on tModelKeys. The valid values of this category system are those tModelKeys identifying tModels that

That is, when referencing this category system in a category bag, the corresponding keyValue of the keyedReference is the tModelKey of the tModel that represents the policy expression.

Given the local policy reference category system, one can then associate a policy expression tModel with a businessEntity, a businessService, and a tModel using the entity's categoryBag. For example, associating the policy expression tModel with the tModelKey "uuid:04cfa…" from above with a businessService is done as follows: 

The tModelKey of the keyedReference MUST match the fixed tModelKey from the local policy reference category system. The keyValue MUST be the tModelKey of the policy expression that is registered with the UDDI registry.

A different approach has to be taken to associate a policy expression with a bindingTemplate, since bindingTemplates do not contain a categoryBag in UDDI Version 2. Therefore, the bindingTemplate's tModelInstanceInfo and instanceParms MUST be used as follows: 

The tModelKey of the tModelInstanceInfo MUST match the fixed tModelKey from the local policy reference category system. The instanceParms MUST be the tModelKey of the policy expression that is registered with the UDDI registry.

UDDI Version 3 [] provides a number of enhancements in the areas of modeling and entity keying. Special considerations for UDDI multi-version support are outlined in chapter 10 of []. The changes with respect to the previous sections are as follows.

First, the tModelKeys of the pre-defined tModels are migrated to domain-based keys. The migration is unique since the Version 2 keys introduced in this specification are already programmatically derived from the Version 3 keys given below.

The tModelKey for the remote policy reference tModel changes from "uuid:a27078e4-fd38-320a-806f-6749e84f8005" to "uddi:schemas.xmlsoap.org:remotepolicyreference:2003_03".

The tModelKey for the Web Services Policy Types tModel changes from "uuid:fa1d77dc-edf0-3a84-a99a-5972e434e993" to "uddi:schemas.xmlsoap.org:policytypes:2003_03".

The tModelKey for the local policy reference tModel changes from "uuid:a27f7d45-ec90-31f7-a655-efe91433527c" to "uddi:schemas.xmlsoap.org:localpolicyreference:2003_03".

Second, rather than putting policy expression references in a bindingTemplate's tModelInstanceInfo, they are added to the bindingTemplate's categoryBag, analogous to the mechanism described for other UDDI entities. For example, the example bindingTemplate from section would be changed as follows: 

Third, inquiries for reusable policy expression tModels described in Section and UDDI tModel entities that are associated with remote policy expression is enhanced by the wildcard mechanism for keyValues in keyedReferences. For example, searching for all policy expression tModels whose IRI starts with http://www.example.com/, the following find_tModel API call can be used: 

Fourth, all UDDI entities may be digitally signed using XML digital signatures []. Publishers who want to digitally sign their policy expression tModels or policy expression references in UDDI MUST use the Schema-centric canonicalization algorithm [].