The syntax for the response-protection element is as follows:
<<!ELEMENT response-protection EMPTY> <!ATTLIST response-protection auth-source (sender|content)#IMPLIED auth-recipient (before-content |after-content)#IMPLIEDTable 8–8 Attributes of the response-protection Element
| 
 Attribute name  | 
 Description  | 
 Value  | 
 Default  | 
| 
 auth-source  | 
 Defines a requirement for message layer sender authentication, for example, username and password) or content authentication, for example, digital signature  | 
 sender or content  | 
 Implied  | 
| 
 auth-recipient  | 
 Defines a requirement for message layer authentication of the receiver of a message to its sender, for example by XML encryption. The before-content attribute value indicates that recipient authentication occurs before any content authentication with respect to the target of the containing auth-policy.  | 
 before-content or after-content  | 
 Implied  |