The syntax for the response-protection element is as follows:
<<!ELEMENT response-protection EMPTY> <!ATTLIST response-protection auth-source (sender|content)#IMPLIED auth-recipient (before-content |after-content)#IMPLIEDTable 8–8 Attributes of the response-protection Element
| Attribute name | Description | Value | Default | 
| auth-source | Defines a requirement for message layer sender authentication, for example, username and password) or content authentication, for example, digital signature | sender or content | Implied | 
| auth-recipient | Defines a requirement for message layer authentication of the receiver of a message to its sender, for example by XML encryption. The before-content attribute value indicates that recipient authentication occurs before any content authentication with respect to the target of the containing auth-policy. | before-content or after-content | Implied |