A policy administration point (PAP) is the component of an access control system where access policies are created, stored, updated and distributed. It is one of the four core components in a policy-based architecture, alongside the policy decision point (PDP), policy enforcement point (PEP) and policy information point (PIP). The PAP does not evaluate requests, enforce decisions or grant access. It defines and manages the rules that the rest of the system applies.
Administrators use the PAP to write access policies, such as which roles can view salary data in the HR system or approve transactions in the finance system. The work has two parts:
Policy definition. The PAP is where access rules are written. An HR policy, for example, might allow only designated managers to view salary data.
Policy management. The PAP stores policies, keeps them current as they change and makes the current version available to the PDPs that evaluate requests. Many PAPs also keep a history of who changed what and when.
Where are PAPs used?
Any organization that manages access through policies rather than individual permissions has a PAP. Some examples:
Healthcare. PAPs hold the policies that govern access to medical records, defining which clinicians, billing staff and administrators can view or edit patient information.
Financial services. PAPs define who can execute transactions and who can access financial data, creating a tiered set of permissions for different roles within an institution.
IT infrastructure. PAPs hold the policies that control which engineers and service accounts can reach servers, databases and cloud resources, often managed as code.
Why does a PAP matter?
Keeping policy in one place pays off in three ways:
Security. A single, authoritative set of access policies reduces the gaps that open when each system keeps its own rules, such as permissions revoked in one place but still active in another.
Compliance. A PAP that keeps a history of every policy and change gives auditors a clear record of which access rules were in force and when. Regulations such SOX and HIPAA expect organizations to show how they control access to sensitive systems and data.
Agility. When policies live in one place, a new regulation or reorganization means updating a policy, not re-permissioning every system.
PAPs work with the common access control models. In role-based access control (RBAC), the PAP holds the role definitions and their permissions. In attribute-based access control (ABAC) and policy-based access control (PBAC), it holds the conditions, such as device, location or time, that a decision point evaluates.
How Policy-based Access Control Improves Agility and Security