add Roles and clarify delegation

Author: elf-pavlik

devbox.lock

@@ -2,71 +2,72 @@
   "lockfile_version": "1",
   "packages": {
     "bikeshed@latest": {
-      "last_modified": "2025-05-06T08:06:31Z",
-      "resolved": "github:NixOS/nixpkgs/1cb1c02a6b1b7cf67e3d7731cbbf327a53da9679#bikeshed",
+      "last_modified": "2026-06-27T07:37:20Z",
+      "resolved": "github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d#bikeshed",
       "source": "devbox-search",
-      "version": "5.1.2",
+      "version": "7.0.7",
       "systems": {
         "aarch64-darwin": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/byk7ag1k1mxrn0k2xdik7rzln600d39h-bikeshed-5.1.2",
+              "path": "/nix/store/a58icyxsx4marmfk34ify5x9k1b9pzi7-bikeshed-7.0.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/x7p41gi116xfdn43qyzx61yamwyhaqxk-bikeshed-5.1.2-dist"
+              "path": "/nix/store/81clsi2648lg4pcdvxyvakybj4xyw8pa-bikeshed-7.0.7-dist"
             }
           ],
-          "store_path": "/nix/store/byk7ag1k1mxrn0k2xdik7rzln600d39h-bikeshed-5.1.2"
+          "store_path": "/nix/store/a58icyxsx4marmfk34ify5x9k1b9pzi7-bikeshed-7.0.7"
         },
         "aarch64-linux": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/5nwp942h6mni220dzqbcqb04mxnh6mfc-bikeshed-5.1.2",
+              "path": "/nix/store/1h8pg6z7wifywkfp6zaflp4cak87nwr2-bikeshed-7.0.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/jjrv0vwvnnjpd6wisb8b3xg24rxz5zwp-bikeshed-5.1.2-dist"
+              "path": "/nix/store/cqb8vdb68by49wc79bls26vxa5g6fq96-bikeshed-7.0.7-dist"
             }
           ],
-          "store_path": "/nix/store/5nwp942h6mni220dzqbcqb04mxnh6mfc-bikeshed-5.1.2"
+          "store_path": "/nix/store/1h8pg6z7wifywkfp6zaflp4cak87nwr2-bikeshed-7.0.7"
         },
         "x86_64-darwin": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/vwh4hjpd0r9zw4fxdwjb6z1x9l39jmq9-bikeshed-5.1.2",
+              "path": "/nix/store/xw373ya70pmwlsckyx69kysbmqgbl585-bikeshed-7.0.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/rk3091z67f5mamqywgasm1y9ghfmyizl-bikeshed-5.1.2-dist"
+              "path": "/nix/store/m34l5yblj7yr4239m27r9mq0p8l17m45-bikeshed-7.0.7-dist"
             }
           ],
-          "store_path": "/nix/store/vwh4hjpd0r9zw4fxdwjb6z1x9l39jmq9-bikeshed-5.1.2"
+          "store_path": "/nix/store/xw373ya70pmwlsckyx69kysbmqgbl585-bikeshed-7.0.7"
         },
         "x86_64-linux": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/l80hk33mi0wsynwl12livkc6c3sqj0bd-bikeshed-5.1.2",
+              "path": "/nix/store/km6j3qlqm7v271b3lx8jbp3mvnl4fcdk-bikeshed-7.0.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/gpxy88dizvl00fj10r4dbh0qa10ham5r-bikeshed-5.1.2-dist"
+              "path": "/nix/store/nr1fcnlhjlx3wwpfypvswj9iff1lgzif-bikeshed-7.0.7-dist"
             }
           ],
-          "store_path": "/nix/store/l80hk33mi0wsynwl12livkc6c3sqj0bd-bikeshed-5.1.2"
+          "store_path": "/nix/store/km6j3qlqm7v271b3lx8jbp3mvnl4fcdk-bikeshed-7.0.7"
         }
       }
     },
     "github:NixOS/nixpkgs/nixpkgs-unstable": {
-      "resolved": "github:NixOS/nixpkgs/b3582c75c7f21ce0b429898980eddbbf05c68e55?lastModified=1746576598&narHash=sha256-FshoQvr6Aor5SnORVvh%2FZdJ1Sa2U4ZrIMwKBX5k2wu0%3D"
+      "last_modified": "2026-07-05T19:27:47Z",
+      "resolved": "github:NixOS/nixpkgs/f205b5574fd0cb7da5b702a2da51507b7f4fdd1b?lastModified=1783279667&narHash=sha256-%2FNAkDSsve%2BGNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s%3D"
     }
   }
 }

proposals/primer/application.bs

@@ -299,8 +299,7 @@ header in HTTP request.
     "title": "Solid Application Interoperability - TypeScript implementation",
     "authors": [
       "elf Pavlik",
-      "Maciej Samoraj",
-      "Ángel Araya"
+      "Maciej Samoraj"
     ]
   }
 }

proposals/primer/authorization-agent.bs

@@ -1,4 +1,3 @@
-
 <pre class='metadata'>
 Title: Solid Application Interoperability - Authorization Agent Primer
 Shortname: sai-authorization-agent-primer
@@ -14,7 +13,7 @@ Boilerplate: issues-index no
 Local Boilerplate: logo yes
 Markup Shorthands: markdown yes
 Editor: elf Pavlik
-!Version: 0.1
+!Version: 0.2
 Abstract: Primer for libraries intended to be used by authorization agents.
 Boilerplate: omit conformance, omit abstract
 </pre>
@@ -233,10 +232,14 @@ link to the user's messaging app. On the other side, the Authorization Agent of
 Independent of the platform, Authorization Agents should always allow a simple copy of the link by the sender
 (e.g., `navigator.clipboard.writeText`) and paste it by the recipient.
 
+## Roles
+
+[[SAI#role]] alows creating authorization can grant access to a team, a group of agents. Roles are only visible to to the agent who can access the Roles Registry and Authorization Registry. Roles can be also used to define a set of data owners, to whose data the authorization applies to. [[#generating-grants-from-authorizations]] describes that process in detail.
+
 ## Application Registration
 
 Application Registrations are created by the End-user for applications they use.
-Since applications do not own or share data, they will never have a [#reciprocal-registration].
+Since applications do not own or share data, they will never have a [[#reciprocal-registration]].
 
 ## Agent Registration Discovery ## {#agent-registration-discovery}
 
@@ -350,6 +353,62 @@ will also have zero or more data grants if it is inheriting from data authorizat
 
 Example of an implementation can be found in [[SAI-JS]] and [[SAI-JAVA]]
 
+<video autoplay loop muted playsinline width="100%">
+  <source src="roles.mp4" type="video/mp4">
+  Your browser does not support the video tag.
+</video>
+
+## Requesting Delegated Data Grants ## {#requesting-delegated-grants}
+
+[[SAI#delegation-issuance-endpoint]] specifies how to request delegation of access. Given following request:
+
+<figure>
+  <pre highlight=json>
+{
+  "grantee": "https://projectron.example/#id",
+  "grantedBy": "https://alice.example/#id",
+  "dataOwner": "https://bob.example/#id",
+  "registeredShapeTree": "http://data.example/shapetrees/pm#ProjectTree",
+  "hasDataRegistration": "https://work.bob.example/data/08a99a10/",
+  "hasStorage": "https://storage.bob.example/",
+  "scopeOfGrant": "http://www.w3.org/ns/solid/interop#AllFromRegistry",
+  "accessMode": [
+    "http://www.w3.org/ns/auth/acl#Read",
+    "http://www.w3.org/ns/auth/acl#Create"
+  ],
+  "hasInheritingGrant": [
+    {
+      "grantee": "https://projectron.example/#id",
+      "grantedBy": "https://alice.example/#id",
+      "dataOwner": "https://bob.example/#id",
+      "registeredShapeTree": "http://data.example/shapetrees/pm#TaskTree",
+      "hasDataRegistration": "https://work.bob.example/data/45e092cf/",
+      "hasStorage": "https://storage.bob.example/",
+      "scopeOfGrant": "http://www.w3.org/ns/solid/interop#Inherited",
+      "accessMode": [
+        "http://www.w3.org/ns/auth/acl#Read",
+        "http://www.w3.org/ns/auth/acl#Create"
+      ]
+    }
+  ]
+}
+  </pre>
+  <figcaption>Delegation request sent to Bob's Authorization Agent</figcaption>
+</figure>
+<figure>
+  <pre highlight=json>
+[
+  "https://auth.bob.example/grants/9849ssd6",
+  "https://auth.bob.example/grants/sioa97dj"
+]
+  </pre>
+  <figcaption>Delegation response received from Bob's Authorization Agent</figcaption>
+</figure>
+
+## Revoking Delegated Data Grants ## {#revoking-delegated-grants}
+
+Agent who delegated the grant (`grantedBy`) can revoke them by simply making `DELETE` HTTP request targeting the URL that identifies a grant. Orphaned grant with `Inherited` scope provide no access and they should be revoked together with the parent grant. Agent who owns the data (`dataOwner`) can revoke delegated grants at any time, agent who delegates them (`grantedBy`) should have their Authorization Agent subscribed to notifications to remove links to revoked grants from agent registries (access grants).
+
 <pre class="biblio">
 {
   "sai": {
@@ -386,8 +445,7 @@ Example of an implementation can be found in [[SAI-JS]] and [[SAI-JAVA]]
     "title": "Solid Application Interoperability - TypeScript implementation",
     "authors": [
       "elf Pavlik",
-      "Maciej Samoraj",
-      "Ángel Araya"
+      "Maciej Samoraj"
     ]
   },
   "sai-java": {

proposals/primer/roles.mp4

@@ -158,6 +158,8 @@ as an indication that access to a specific data instance is intended to be share
 
 ### Delegation Issuance Endpoint ### {#delegation-issuance-endpoint}
 
+Issue(338):
+
 [=Authorization Agent=] of a grantee, can request delegation of [=Data Grants=] using this endpoint.
 This endpoint expects HTTP `POST` with content type `application/json` including top level JSON object
 representing a [=Data Grant=] without an `id` and all inheriting data grants nested in `hasInheritingGrant`.
@@ -168,7 +170,8 @@ representing a [=Data Grant=] without an `id` and all inheriting data grants nes
 
 * MUST either create all requested grants or return error.
 * MUST return `application/json` with an array including `id` for every created grant when responding with success.
-
+* MUST set Read access to the grantee agent for every created grant
+* MUST set Read and Delete access to the granted by agent for every created grant
 
 ### Authorization Agent Discovery ### {#authorization-agent-discovery}
 

proposals/specification/data-authorization.bs

@@ -34,11 +34,18 @@ internal to the context of the [=Social Agent=] defining the Role.
   </pre>
 </figure>
 
-When [=Authorization Agent=] generates [=Data Grants=] from a [=Data Authorization=]
-* MUST generate a [=Data Grant=] for each member of that [=Role=] as `dataOwner` if a [=Role=] is used as `dataOwner`. 
+When [=Authorization Agent=] generates [=Data Grants=] from a [=Data Authorization=] it
+* MUST generate a [=Data Grant=] for each member of that [=Role=] as `dataOwner` if a [=Role=] is used as `dataOwner`.
 * MUST generate a [=Data Grant=] for each member of that [=Role=] as `grantee` if a [=Role=] is used as `grantee`.
 * MUST generate a [=Data Grant=] for the cartesian product of the two [=Roles=], with each member as corresponding `dataOwner` or `grantee` if a [=Role=] is used as both `dataOwner` and `grantee`.
 
+When a [=Role=] is modified, [=Authorization Agent=] managing it
+* MUST generate corresponding [=Data Grants=], when a member is added to the [=Role=]
+* MUST revoke corresponding [=Data Grants=], when a member is removed from the [=Role=]
+* MUST revoke [=Data Authorizations=] where the role was used as a `dataOwner` or a `grantee`, when the [=Role=] is deleted.
+
+Note: When [=Data Authorization=] is revoked, [=Data Grants=] that are derrived because of it also must be revoked.
+
 ## Role Registry ## {#datamodel-role-registry}
 
 A <dfn>Role Registry</dfn> contains all the [=Roles=] defined by the [=Social Agent=] who owns the [=Role Registry=]

proposals/specification/role.bs

@@ -67,7 +67,6 @@
       "required": [
         "accessMode",
         "dataOwner",
-        "delegationOfGrant",
         "grantedBy",
         "grantee",
         "hasDataRegistration",