Which of the following protocols only facilitates access control?

XACML (eXtensible Access Control Markup Language) is an OASIS standard that defines both a declarative policy language and a request/response protocol solely for evaluating access control decisions - determining who can perform what actions on which resources under which conditions. Unlike the other protocols listed, XACML has no authentication function; its exclusive purpose is to serve as a Policy Decision Point (PDP) in attribute-based access control (ABAC) architectures. This makes it the only protocol in the list that purely and exclusively facilitates access control.

Kerberos is a network authentication protocol that issues tickets to prove identity and enable mutual authentication; it does not evaluate or enforce access control policies.

SPML (Service Provisioning Markup Language) is used for provisioning, managing, and deprovisioning user accounts and entitlements across directory services and applications, not for making runtime access control decisions.

SAML (Security Assertion Markup Language) handles both authentication assertions and authorization decision statements between identity and service providers, making it a broader protocol rather than a pure access control mechanism.