Consent envelopes in Solid

[bjdmeest]

Only shoe shops can see my shoe size

Pitch

Consent flows in Solid are currently underdeveloped: it's not fully clear how authorized data processing stays in line the with the given permissions, i.e., is trustworthy. For example: I want to share my shoe size with all shoe shops (but not all shops!)

Desired solution

• A consent service that manages and clears my consent envelopes
• A consent app that helps me manage my consent envelopes, i.e., where I can manage rules like "all ?x of type :shop that :sells :shoes can access pod.bjmeest.com/shoeSize", which get stored in the consent service

Acceptance criteria

• In my consent app, I specify that the resource containing my current shoe size can be accessed by all verified shoe shops in Belgium
• After I log into "The Nice Little Shoe Shop" app, the app goes via my consent service to ask for permission to get my shoe size. the consent service verifies the request, and clears the consent
• "The Nice Little Shoe Shop" app can directly access my shoe size and personalize its service
• After I log into "The Malicious Huge Dark Shoe Shop" app, the app goes via my consent service to ask for permission to get my shoe size. the consent service verifies the request, and sees that this shop is not a Belgian verified shoe shop so cannot access my shoe size. I can still use the app, but not personalized.

Pointers

• TBD how much more you need on top of ACP rules with extended matchers (that translates to 'default' ACP rules in the solid pod?)
• TBD how much 'legal' stuff is needed, or we can resort to something like Verifiable Credentials to make sure every processing request is OK

I could change the use case to 'only share blood pressure measurements with verified medical staff', but that has an additional step propably: first verify the hospitals/medical companies, then its staff

[pheyvaer]

@RubenVerborgh What changes do you want to see here?

[RubenVerborgh]

For one of the cases to be fully fleshed out (or two cases, but then it would likely be a separate challenge).

[pheyvaer]

@bjdmeest Can you implement the aforementioned changes?

[bjdmeest]

Yes, implemented!