What is special about the authorisation decision statement, and why is it rarely used today?

It moves the access decision from the resource to a trusted external decision point, but the feature was frozen in SAML 2.0 and XACML is recommended instead.

With an authorisation decision statement, the resource does not evaluate its own access rules; it asks (or receives an answer from) a trusted authority that says "permit" or "deny" for a given subject, action and resource. This is the classic split between a policy decision point and a policy enforcement point.

In practice almost every SAML deployment uses only authentication and attribute statements and leaves the authorisation decision to the application, which knows its own resources best. The SAML 2.0 core specification states that the <AuthzDecisionStatement> feature is frozen, with no future enhancements planned, and points to XACML (eXtensible Access Control Markup Language) for richer authorisation decisions.

Go deeper:

• OASIS: SAML V2.0 Core specification (PDF) — section 2.7.4 carries the note that the feature is frozen.
• XACML (Wikipedia) — the policy language recommended for externalised authorisation.