standard language for evaluating access requests according to rules defined in attribute-based access control policies
