One of the following child elements can be used to attach an access control policy to matching requests:
Attaches a custom access control implementation provided by a plugin
Attaches an access control policy using the XML-based plugin provided with the SP. This is a short-hand for embedding the policy in the element above, if you want the policy inside the RequestMapper's configuration file anyway.
...