Terminology: Resource Manager / Resource Controller / ...

[uvdsl]

The current draft defines a Resource Manager as an agent who has permission to control access.

lws-protocol/spec/index.html

Line 134 in 65b74d5

<li><dfn>resource manager</dfn> - (<a href="https://w3c.github.io/lws-ucs/spec/#dfn-controller">controller</a> in UCS) An agent that has permission to control access to a <a>served resource</a>.</li>

It references the definition of Controller by the Use Cases as equivalent which currently reads

An entity that is capable of performing an action with a specific resource, such as updating a protected document.

To me, there seems to be a difference between the two definitions.

[w3cbot]

This was discussed during the #lws meeting on 26 January 2026.

View the transcript

w3c/lws-protocol#27 Terminology: Resource Manager / Resource Controller / ... (by uvdsl)

acoburn: on #27, there is alot of ground to cover here, let's discuss this more

---

[acoburn]

The terminology section will need good definitions for the following terms:

• Storage
• Container
• Resource
• Metadata
• Agent
• Controller
• Service

There may be other terms, such as "Capability"

[elf-pavlik]

I'm not attached to any specific terminology, whatever is used I find it very important that a clear distinction can be made between Resource Owner and End user. This is for example a fundamental distinction in https://elf-pavlik.github.io/lws-auth/view/oidc/?dynamic=sequence

Possibly in both cases it could be a Person (individual) or an Organization (collective). In general I think clients/apps should be kept as separate category since they don't have autonomous agency and aren't legal personas on their own. Clients/apps can't be resource owners and always act on behalf of end users.

[acoburn]

Firstly, I very much agree about the distinction between Resource Owner and End User, which is precisely what the description of this issue is seeking clarity about.

Secondly, I am not wedded to the particular terms I listed: there may be different terms that the WG aligns on. By "Agent", I was referring to an entity (e.g., End User) that interacts with an LWS Storage, and by "Controller", I was referring to an entity (i.e., Resource Owner) that has authority over the protected resources in a given Storage.

OAuth 2.0 already defines both "Resource Owner" and "End-User":

resource owner
An entity capable of granting access to a protected resource.
When the resource owner is a person, it is referred to as an
end-user.

By indicating that an "end-user" is a person (and OpenID Connect reiterates this), I thought that the term End User would imply that entities such as bots or autonomous agents are excluded. Agent seems to be a more neutral term.

The "Resource Owner" term is more apt in this context, but many of the newer W3C specifications, such as Verifiable Credentials and Controlled Identifiers have moved away from the use of "owner" and toward the use of "controller".

So in short, the WG needs to agree on (1) the terms to use consistently in the specification documents and (2) the definitions for those terms.

[elf-pavlik]

I think End user or Requesting Party should also support Organizations. I believe in MANDAT case where delegation is handeled by impersonation (for a good reason), the requesting party would be the org even that internally some person is making requests via organizational proxy. @uvdsl I hope I'm not misrepresenting MANDAT use case and implementation.