Hi, At the moment policy mechanism is very powerful, but have some limitations. One of them is that it is possible to register only one InterceptorProvider for one policy assertion.
PolicyInterceptorProviderRegistry interface extends Regsitry as: public interface PolicyInterceptorProviderRegistry extends Registry<QName, PolicyInterceptorProvider> { ... I see some use cases where PolicyInterceptorProvider(s) are independent, but associated with the same policy assertion (for example in complex authentication case). Proposal: extend PolicyInterceptorProviderRegistry to save set of PolicyInterceptorProvider for one assertion. If proposal is accepted I will provide patch. Jira issue is already created: https://issues.apache.org/jira/browse/CXF-4073. Regards, Andrei.