Finalize design for Trusted Consents and Trusted Grants

[justinwb]

[justinwb]

Per implementation session on 10/13 - some notes:

• Need to establish explicit shapes for trusted data grants / consents
• Should look at dedicated properties for linking from access grants / access consents

[elf-pavlik]

I think we could work with the diagram below, and focus on the part where Omni gives Bob full access Trusted Grant.

From there on, Bob would be able to use their Authorization Agent to create delegated grants based on that trusted source grant. There are some bootstrapping questions, where new storage gets created and Authorization Server gets associated with it. I imagine that creating that initial Trusted Grant for Bob would be part of that bootstrapping process and after that Authorization Server associated with a new instance of storage (Resource Server) would include delegated grants created by Bob as part of policies applying to that storage.

I think in this issue we could focus on a data model for Trusted Grant itself. Besides having full access (equivalent to data owner). Do we need any more specific access to any of the specific registries?

• Data Registries
• Agent Registry
• Access Consent Registry

We should probably work with some real-world use cases to answer it. I'll document full access (equivalent to data owner) use case and we can move forward with requirements coming out of this one first.

[elf-pavlik]

Capturing some insights from a conversation we had last Wednesday during the implementations call.

Looking at the updated diagram in the previous comment. Both users, who act as trusted grantees (marked as admin on the diagram), should be able to:

• Use their authorization agent to manage access to data of organization which they have trusted grantee rights
• Grant access to others, using either of two possible approaches
  • Grant can be directly granted as an organization to some other grantee, trusted grantee would not be in the delegation chain. This would also require their personal authorization agent to add access consents to the organizational access consent registry. An organizational authorization agent would still be responsible for generating access grants based on those consents.
  • Grant can be granted as the trusted grantee, in that case, they would be in the delegation chain. This would keep access consents in their personal access consent registry and their personal authorization agent would generate the access grant.