RE: [xacml] Re: env attributes

..
given request and policy and CONTEXT, which very well may include global parameters independent of an individual request.
.
Also, auditing is best done where the decision is made, not were it is used, as auditing may include information not returned to PEP (such as a reason for DENY).
.