Authorization with `creator` condition

[uvdsl]

There exist use cases (e.g., Project MANDAT), where an agent is to be authorized for target resource access if the agent themself is the creator of the target resource.

Proposal:
acl:CreatorCondition which would be a condition that requires the requesting authenticated agent to match (one of) the creators of the target resource (as available during evaluation, i.e., as recorded in the evaluating system). Practically, this functionality could rely on the server-internal recording of resource creators also used for the mechanism proposed in solid/specification#807.

Example:

:authz a acl:Authorization ;
      acl:accessTo <./> ;
      acl:default <./> ;
      acl:agentClass acl:AuthenticatedAgent ;
      acl:mode acl:Read ;
      acl:condition 
                 [ a acl:CreatorCondition ] .

This rule would grant target resource access to any requesting agent recorded as its creator by the evaluating system.

[uvdsl]

Maybe defining an acl:agentClass like acl:Creator would also suffice:

:authz a acl:Authorization ;
      acl:accessTo <./> ;
      acl:default <./> ;
      acl:agentClass acl:Creator ;
      acl:mode acl:Read .

[csarven]

I think acl:agentClass acl:Creator would be better for this feature.

[uvdsl]

Then there could be fun rules like grant Alice access to any resource that Bob creates in this container:

:authz a acl:Authorization ;
      acl:default <./> ;
      acl:agent alice:me ;
      acl:mode acl:Read ;
      acl:condition 
                 [ a acl:CreatorCondition ; acl:creator bob:me ] .

[uvdsl]

The above would open up the condition for a maybe somewhat unconventional (?) approach to using WAC:

:authz a acl:Authorization ;
      acl:accessTo _:bn ;
      acl:agent alice:me ;
      acl:mode acl:Read ;
      acl:condition 
                 [ a acl:CreatorCondition ; acl:creator bob:me ] .

This rule would grant target resource access to alice:me on a resource that was created by bob:me. A resource really means any resource here, as the blank node _:bn acts as an existential quantifier -- and this makes this authorization rule really more a kind of "global" rule to be evaluated for each request made by the agent indicated via acl:agent (i.e.,alice:me), rather than being evaluated for each request made against the target resource indicated via acl:accessTo.

This might seem contradictory to the evaluation of the Effective ACL Resource but a Server could dynamically (and temporarily) materialize a corresponding rule in that effective ACL resource (graph) where the blank node is substituted with the target requests URI.

Just documenting the idea, not attached to it.

[csarven]

That's interesting/powerful but I wonder how common is that use case. I worry that we'll get ourselves into introducing too many terms every time. Do we need creator/creatorClass/creatorGroup? 😟

[uvdsl]

No, I don't think so (yet) 🙂. These were just some ideas...
I am happy to keep it to the simple "creator of a resource" use case.

A very simple solution would be to add an agent class:

<dt id="acl-agentclass-creator-agent"><code>acl:Creator</code></dt>
<dd>Allows access to an authenticated agent who is attributed with the creation of the target resource.</dd>

However, this approach deserves proper discussion:

• whether or not an agent is of class acl:Creator is dependent on the target resource (i.e., the requested resource to be accessed).
• this is local to a specific request.
• My understanding so far was that acl:agentClass indicates something more contextual from the evaluating system, which --granted-- the creator of a resource is as well,
• but the agent being of class acl:Creator cannot be transferred with the agent into the next request's context (potentially on a different target resource)

Example:

ex:resource dcterms:creator bob:me .

:authz a acl:Authorization ;
      acl:accessTo ex:resource ;
      acl:agentClass acl:Creator ;
      acl:mode acl:Read .

bob:me is authenticated and requesting read on ex:resource.
It follows (in this specific context):

bob:me a acl:Creator .

and thus access is granted.

The statement bob:me a acl:Creator . only holds in that request's context and MUST NOT be used outside of it.

Question: Is the entailment of the requesting agent's class always request-specific / contextual?