## 3. Set the attributes element.
Attributes represent the data entities for which access should be restricted. They're required if you want to define which data a user is authorized to process.
Attributes provide instance-based, fine-granular authorization checks. See Setting Up Instance-Based Authorizations [page 552].
```
 Sample Code { ... "attributes" : [ { "name"        : "Country", "description" : "Country", "valueType"   : "string" }, { "name"        : "CostCenter", "description" : "CostCenter", "valueType"   : "int" } ], ... }
```
4. Set the role-templates element.
Role templates combine scopes with attributes and serve as templates from which roles are created later by the administrator.
```
 Sample Code { ... "role-templates" : [ { "name"                 : "Viewer", "description"          : "View all books", "scope-references"     : [ "$XSAPPNAME.Display" ], "attribute-references" : [ "Country" ] }, { "name"                 : "Editor", "description"          : "Edit, delete books", "scope-references"     : [ "$XSAPPNAME.Edit", "$XSAPPNAME.Delete" ], "attribute-references" : [ "Country", "CostCenter"] } ] }
```
5. Deploy the application security descriptor ( xs-security.json ).
Example:
```
 Sample Code cf create-service xsuaa application my_xsuaa_service_instance -c xssecurity.json
```
6. Check the scopes in the application.
```
 Sample Code app.get('/books', checkReadScope, getBooks); // Scope check function checkReadScope(req, res, next) { if (req.authInfo.checkLocalScope('read')) { return next(); } else { console.log('Missing the expected scope'); res.status(403).end('Forbidden'); } }
```
The checkReadScope function ensures that only a user with the correct authorizations can look at the books.
See Tutorials for the SAP Authorization and Trust Management Service [page 558] for ways to check scopes in Java and other frameworks, like Spring.
7. In the manifest file, add the binding for the service instance to your application.
8. Deploy the application.
<!-- image -->
##  Sample Code
cf push
## Results
You've declared and deployed your application security descriptor ( xs-security.json ) with scopes (functional authorizations), attributes (data authorizations), and role templates (to combine scopes with attributes). The xsappname element is mandatory. The scopes , attributes , and role-templates elements are optional. You've also bound your service instance to your application, and then deployed it.
```
 Sample Code { "xsappname" : "hello-world", "scopes"    : [ { "name"        : "$XSAPPNAME.Display", "description" : "display" }, { "name"        : "$XSAPPNAME.Edit", "description" : "edit" }, { "name"        : "$XSAPPNAME.Delete", "description" : "delete" } ], "attributes" : [ { "name"        : "Country", "description" : "Country", "valueType"   : "string" }, { "name"        : "CostCenter", "description" : "CostCenter", "valueType"   : "int" } ], "role-templates" : [ { "name"                 : "Viewer", "description"          : "View all books", "scope-references"     : [ "$XSAPPNAME.Display" ], "attribute-references" : [ "Country" ] }, { "name"                 : "Editor", "description"          : "Edit, delete books", "scope-references"     : [ "$XSAPPNAME.Edit", "$XSAPPNAME.Delete" ], "attribute-references" : [ "Country", "CostCenter"] } ] }
```
## Next Steps
To implement web access using a browser or a browser-based user interface, you can use an application router to enable you to create a secure route to your application, or an open source UI framework, such as Spring (Boot). For more information, see the related links.
## Related Information
Application Router [page 439]
Open Source UI Framework
Limits for Technical Artifacts of the SAP Authorization and Trust Management Service [page 3248]
Application Security Descriptor Configuration Syntax [page 576]