solid / authorization-panel

Github repository for the Solid Authorization Panel
MIT License
19 stars 20 forks source link

OWL for anyOf, allOf, noneOf? #135

Open bblfish opened 3 years ago

bblfish commented 3 years ago

To understand how anyOf, allOf and noneOf work here is my first attempted formalization in OWL.

At present there are no good examples of these being used in a distinct way. The missing use case for acp:allOf in the use case document would indeed make it difficult to show up the difference.

Helpfully @emmettownsend explained on gitter that he is thinking of these as bringing together different sets of agents by description. allOf restricts agents to those that fit all the descriptions, anyOf to those that fit one of the descriptions. Thinking semantically in terms of sets, the first maps to the intersection of agents fitting those description, the second to union of agents fitting those descriptions.

These two concepts are well defined and studied in OWL under Complex Classes (make sure to set check the Turtle view box at the top of that spec). So let us say we have the class of agents eu:Citizen and iso:Over18 then we can create the class of agents

Let us say this document is published in /groups/g1

@prefix owl: <http://www.w3.org/2002/07/owl#> .

<#EUOver18> owl:equivalentClass [ 
    owl:intersectionOf ( eu:Citizen iso:Over18 )
].

To model union of classes we use unionOf

<#EUOrOver18> owl:equivalentClass [
       owl:unionOf ( eu:Citizen iso:Over18 )
] .

And to model a class minus a group of Trolls we can have

<#Responsible> owl:equivalentClass [
      owl:intersectionOf  (  iso:Over18  [ owl:complementOf <g0#Trolls> ] ) 
]

Given this we see that we can perhaps also express these concepts using WAC. Following the initial analysis of the WAC/ACP diff for Access Control Resources, we could write our rules like this:

@prefix wac: <http://www.w3.org/ns/auth/acl> .
<> wac:authorizes  [  
               wac:mode wac:Read, wac:Append; 
               wac:agentClass </groups/g1#Responsible> ].