Listing 1: Sample policy statement

<?xml version="1.0" encoding="UTF-8"?>
<Request ...>
    <Subject>
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
		DataType="http://www.w3.org/2001/XMLSchema#string">
            <AttributeValue>LoanAgent</AttributeValue>
        </Attribute>
    </Subject>
    <Resource>
        <Attribute DataType="http://www.w3.org/2001/XMLSchema#string"
		AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" >
            <AttributeValue>http://localhost:8080/axis/HLoan</AttributeValue>
        </Attribute>
    </Resource>
    <Action>
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
		DataType="http://www.w3.org/2001/XMLSchema#string">
            <AttributeValue>ChristmasOffer</AttributeValue>
        </Attribute>
    </Action>
</Request>


Listing 2: Code snippet showing hotspots in PEP

/* SimplePEP.java */
...
public void process(SOAPEnvelope req, SOAPEnvelope resp) throws AxisFault{
  try {
    // Get the endpoint for the message based on encoded rules
    ...
    // Get the actions associated with the endpoint and then 
	// forward the call to the policy negotiator.  The negotiator lookups 
	// the policy store of the necessary policy statements, if the policy 
	// statements are accepted then necessary aspects are enabled
	Collection actions = SimplePDP.getActions(destination);	
	SimpleNegotiator negotiator = new SimpleNegotiator();
	negotiator.negotiate(destination, actions);

    /** variation hotspot -- begin **/
    Message variedReqMsg = induceVariations(currCtx.getRequestMessage());
    /** variation hotspot -- end **/

    // create the call to the external web services
    ...
    call.setRequestMessage(variedReqMsg);
    ...

   /** variation hotspot -- begin **/
   Message variedResMsg = induceVariations(currCtx.getResponseMessage());
   currCtx.setResponseMessage(variedResMsg);
   /** variation hotspot -- end **/

  }catch(Exception ex){
     // handle exception
  }
}

public Message induceVariations(Message env){
  Message msgForVariation;
  msgForVariation = msg;
  return msgForVariation;
}

/* -- Aspect definition -- */
aspect FunctionalAdaptations{

  pointcut variation () : execution(* induceVariations(..));

  before () : variation() {
    // the necessary code to do the changes before changes are assigned 
	// to the new SOAP Message object
  }

  after () : variation() {
    // the necessary code to do the changes after changes are assigned 
	// to the new SOAP Message object
  }
}