Geoserver is now able to act as a GeoXACML Policy Decision Point. The status quo is described here http://jira.codehaus.org/browse/GEOS-3172 Next steps are some concepts how geoserver itself will use GeoXACML for its authorization requirements.