Access control is an important aspect of regulatory compliance. Therefore, access control specifications must be process-aware in that they can refer to an underlying business process context, but do not specify when and how they must be enforced. Such access control specifications are often expressed in terms of general rules and exceptions,
akin to defeasible logic. In this paper we demonstrate how a role-based, process-aware access control policy can be specified in the SBVR.

Using a rule engine provides a framework that allows to externalize business logic in a common place which in turn empower subject matter experts of the business to easily change and manage the rules. Coding such rules directly into the application makes maintenance difficult and expensive because the rules change so often. This article describes how to architect and build a service that uses Drools to provide business decisions.

The real task developers have is trying to write and maintain the complex business logic in their applications, not only for new applications, but increasingly, for long-lived, business-critical apps whose internal logic needs to change frequently, often at very short notice. Until now, there was a gap in what the frameworks were able to do, in that business logic had no framework. Tools like EJB and Spring are good, but have little to say about how to organize your logic statements!

BPM is business-driven. It’s about optimizing and improving business performance at the end-to-end process level, innovating the business, making it more efficient, faster, more agile, more compliant with policies and best practices, and more measurable. It’s top-down because it begins with the end-to-end process. SOA is IT-driven. It’s about transforming IT infrastructure, leveraging existing investment and breaking it into reusable parts.

Level 1 simply tries to capture the current-state processes for documentation, analysis, and eventual improvement. It uses the part of BPMN that is familiar from traditional flowcharting – swimlanes, boxes, and arrows – easily understood by the newly formed BPM project teams. Level 2 BPMN models created by process architects, business architects, and top-tier business analysts form the base activity flow layer on top of which IT layers the data model, business rules, and other implementation properties.