Improving Access Requests and Access Grants

[elf-pavlik]

I'm currently reviewing https://w3c.github.io/lws-protocol/lws10-core/#access-requests-and-grants
And planning for SAI

• Align with LWS Access Requests and Grants solid/data-interoperability-panel#338

Notifications

https://w3c.github.io/lws-protocol/lws10-core/#access-notifications

I think we should be able to fill in that gap already with https://w3c.github.io/lws-protocol/lws10-notifications-webhook/
Given that notifications are recursive and respect access control

• requesting agent can subscribe to the access grants container
• Both requesting agent and assignee should have read access to their grants

This way when new grant is created requesting agent would receive a notification.

Revocation

I'm currently implementing it for SAI, my initial approach was to simply use HTTP DELETE, but now I'm leaning more towards POST on the same endpoint as access request. The main reason is that if there is a longer delegation chain, the whole tail needs to be revoked. Having it as side-effect of DELETE on a resource sounds more complicated to implement than POST on a service endpoint. Especially that container would be handled as a regular LWS Container.

Terminology

Currently LWS has

• storage controller
• requesting agent
• assignee

https://w3c.github.io/lws-protocol/lws10-core/#odrl-assignee

The assignee property identifies the party that is requesting access (in the case of a request) or that is being granted access (in the case of a grant).

I recall conversations where requesting agent and assignee could be different, which would be needed for delegation. I would prefer if we have distinct properties and definitions for both requests and grants. My preference would be:

• storage controller
• delegator - requesting agent
• delegatee - assignee of the grant

This would provide better foundation to support delegation and implementations that auto approve requests for attenuated grants.

Client Constraints

https://w3c.github.io/lws-protocol/lws10-core/#constraint-client

In SAI and my implementation https://sai.js.org this is done by end user creating attenuated delegation to their client and client having read access to that grant. Also taking advantage of it to discover protected data it can access. I would like us to take various possible approaches into consideration.

Resource Type Constraints

https://w3c.github.io/lws-protocol/lws10-core/#constraint-type

In SAI Access Grants are scoped by shape tree (~resrouce type). In LWS example I don't find what would be a target of Access Request / Access Grant using Resource Type Constraints.

How does it fit with https://w3c.github.io/lws-protocol/lws10-searchindex/ ?
Can request have Storage Root as a target and only provide Resource Type Constraints?

---

As I'm exploring aliging SAI specs/primers and https://sai.js.org with LWS I will most likely have more comments/questions, above is mostly a conversation starter.

[elf-pavlik]

@termontwouter it would be great to also get your feedback based on your experience with https://spec.knows.idlab.ugent.be/A4DS/L1/latest/

@uvdsl same with your work on MANDAT and Authorization App

I'm not fully happy with how SAI is disclosing identity of delegatees to the storage controller and both of your approaches can offer nicer privacy properties.

[uvdsl]

@elf-pavlik, from the issue description, I see alot of points where you want to update SAI - but where do we need to work on LWS? Can you highlight particular points for LWS?

[elf-pavlik]

All points in the description are about current text in LWS spec, with links to specific sub-sections.
I'm only bringing SAI as a reference for my implementation experience with prior-art on Access Grants and access delegation in general.
Do you find current LWS Access Grants and Access Request well defined to use it with your Authorization App? I know that MANDAT uses proxies so Access Grants may be less relevant for you when it comes to access delegation.

[uvdsl]

Sorry, I did not understand where you would like my input. I have a hard time parsing what you want me to do here... I have not been actively following the development of access requests and grants in LWS. I take your ping as setting it on my TODO 🙂 Thanks!