1. A method in a data processing system for controlling access to a resource, the method comprising: receiving an access decision information document; evaluating the access decision information document in an extensible markup language format with an extensible markup language rule; and generating an access decision based on the evaluation.