One of the main architectural advantages of the loosely coupled nature of service-oriented architectures (SOA) and Web services is the strict separation between the interface (the service's method of listening on the network) and the implementation (the actual business logic). This presents the security architect with interesting options in deploying security for SOA and Web services.
For example, a SOAP Web service interface (say, GetAccountBalance) can be hosted as a proxy on an XML security gateway instead of the "real" endpoint that hosts the business logic implementation (like a Java Web service). In a nutshell, an XML security gateway is a specialized service that performs security policy enforcement, enabling decentralized security architectures.
