Overview
ISO/IEC 40280:2011 - Information technology - W3C Web Services Policy 1.5 - Attachment specifies how to attach and associate Web Services policies with the subjects they govern. It defines two general-purpose mechanisms for linking policies (as defined in ISO/IEC 40270) to service artifacts and shows how those mechanisms apply to common service description technologies such as WSDL (Web Services Description Language) and UDDI (Universal Description, Discovery and Integration). Published in 2011, this ISO attachment provides a standards-based approach to policy association for web services and SOA environments.
Key topics and technical requirements
- General-purpose policy attachment mechanisms: the standard defines two ways to associate policies with the entities they affect (scope and application of these mechanisms are specified, but implementation details follow W3C Policy 1.5 conventions).
- Integration with WSDL: guidance on connecting policies to WSDL descriptions so policy assertions can be discovered alongside service interface and binding metadata.
- Integration with UDDI: guidance for associating policies with UDDI entries to support discovery and governance scenarios in registries.
- Normative linkage to ISO/IEC 40270: policies referenced and attached using this standard are those defined by ISO/IEC 40270 (Web Services Policy model).
- Interoperability and tool support considerations: focuses on consistent attachment semantics to enable cross-vendor, cross-platform use of policy information.
Applications
ISO/IEC 40280:2011 is practical for organizations that need standardized, discoverable policy attachment for web services:
- SOA architects and designers - to express service-level requirements (security, reliability, privacy, QoS) in a discoverable way.
- Enterprise integration and middleware vendors - to implement tooling that reads/attaches policies to WSDL or registry entries.
- Governance and compliance teams - to manage and discover policy assertions across service registries and descriptions.
- Service registries and directories - to publish policy metadata alongside service listings for automated discovery and policy enforcement.
Related standards
- ISO/IEC 40270 - defines the policy model and assertion concepts that ISO/IEC 40280 attaches to subjects.
- W3C Web Services Policy 1.5 - the baseline policy framework to which this ISO attachment relates.
- WSDL and UDDI specifications - the target technologies for policy association.
Keywords: ISO/IEC 40280:2011, W3C Web Services Policy 1.5, policy attachment, WSDL policy, UDDI policy, ISO/IEC 40270, web services policy, SOA governance.