w3c / poe

Permissions & Obligations Expression WG
Other
23 stars 18 forks source link

Single vs. Collection of Asset and Party unclear #195

Closed nitmws closed 7 years ago

nitmws commented 7 years ago

The Information Model defines the Asset Class this way: An Asset is a resource or a collection of resources that are the subject of a Rule. ... and the subclass AssetCollection that way: an Asset that is a group of resources. This indicates that all the items in the group will be the subject of the Rule.

Unclear is:

These issues above apply to PartyCollection too.

riannella commented 7 years ago

1) s/group/collection/

2) There is not definitive way to indicate a (single) Asset - as we are only concerned with Collections to ensure the constraints are applied correctly

3) We have no restrictions on levels of partOf

commit: 9bfdc6fae0d75cc4be9679b834afefa7b9b723b0

simonstey commented 7 years ago

Design: how to indicate that an Asset is only a single resource and not a collection? Using the class Asset covers both, the class AssetCollection only collections - nothing specific for a single resource.

An asset can be a single asset as long as it's:

  1. not of type AssetCollection, and
  2. has no assets that are part of it.
nitmws commented 7 years ago

@simonstey the tripwire of 2. is: it is not required that a used AssetCollection must list all of its "parts" in a policy. Therefore at the time of processing a Policy the processor does not know exactly if this asset thing thing has other Assets claiming they are a partOf it.

riannella commented 7 years ago

Yes, that is correct. We can't really do anything about that...can we?

simonstey commented 7 years ago

@simonstey the tripwire of 2. is: it is not required that a used AssetCollection must list all of its "parts" in a policy. Therefore at the time of processing a Policy the processor does not know exactly if this asset thing thing has other Assets claiming they are a partOf it.

that's why we shouldn't adopt the Open World Assumption for evaluating/processing policies. otherwise, you also wouldn't know whether a policy is really linked to all of its rules, a rule is really listing all of its assignees, assigners, etc.

Yes, that is correct. We can't really do anything about that...can we?

sticking to CWA for policy evaluation, i.e. everything that's not explicitly stated does not exist.


fwiw, following SHACL shape can be used to check whether an asset conforms to the requirements of single assets (i.e., not of type AssetCollection and not partOf another Asset)

odrl:SingleAssetShape
    a sh:NodeShape ;
    sh:targetNode ex:partB ; # replace ex:partB with the asset you want to check
    sh:not [ sh:class odrl:AssetCollection ] ;
    sh:property [
    sh:path odrl:partOf ;
    sh:maxCount 0 ;
    ] .
riannella commented 7 years ago

We only know what we know ;-)

Perhaps some of this more semantic processing we document in the Formal Semantics Note?