6.2. <authorization>

This element contains <policy-module> elements that define the policy module used to authorize application users, and whether the module is required:

When multiple <policy-module> elements are present, they form a collective group of requirements that must be met before authorization is verified. This collective group is called a stack.

This element uses the code attribute to specify what policy module implementation an application can use, and the flag attribute to tell the application how to parse each policy module present in the policy stack. The flag attribute supports the following values: