Policy separation

A computer program product comprising a non-transitory computer-readable medium with computer-readable instructions for performing a method in a policy decision point (PDP) for controlling a subject's access to a resource, the PDP being arranged for interacting with a computer system comprising a plurality of resources, to which subjects' access is controlled by corresponding policy enforcement points (PEPs), said method comprising:

• obtaining an access request from a PEP through an end point address of a plurality of end point addresses of the PDP, the plurality of end point addresses pointing to the PDP;
• analyzing the obtained access request and determining, based on the end point address receiving the access request, an associated one of at least two policy packages stored by the PDP;
• and
• evaluating the access request against the policy package thus determined, thereby obtaining an access decision to be returned to and enforced by the PEP.

A server device comprising a policy decision point (PDP), arranged for interacting with a computer system comprising a plurality of resources, to which subjects' access is controlled by corresponding policy enforcement points (PEPs), the PDP being configured to:

• obtain an access request from a PEP;
• analyze the obtained access request;
• and
• evaluate the access request for obtaining an access decision to be returned to an enforced by the PEP,
• wherein the PDP is characterized by being configured to:
• obtain the access request through an end point address of a plurality of end point addresses of the PDP, the plurality of end point addresses pointing to the PDP;
• determine, based on the end point address receiving the access request, an associated one of at least two policy packages stored by the PDP;
• and
• evaluate the access request against the policy package thus determined, thereby obtaining an access decision to be returned to and enforced by the PEP.