Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

Authentication and authorization in Data Spaces: A relationship-based access control approach for policy specification based on ODRL

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proposes the ODS profile, adding Data Space roles and actions to ODRL, and an execution engine that compiles the resulting policies into OpenFGA authorization models.

desk verdict The ODS profile is a real, small vocabulary contribution, but the 'validation' is a workflow sketch with no concrete mapping, so the central claim is unsupported as written. read the letter →

arxiv 2505.24742 v1 pith:NQ7XCVVO submitted 2025-05-30 cs.CR cs.ET

Irene Plaza-Ortiz , Andres Munoz-Arcentales , Joaquín Salvachúa , Carlos Aparicio , Gabriel Huecas , Enrique Barra This is my paper
classification cs.CRcs.ET
keywords DataSpacesSovereigntyPolicyExecutionAccessControlReBACODRLOpenFGAODSprofile
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the Open Digital Rights Language (ODRL) can be made operational for Data Spaces by extending it with a profile, ODS, that names the actors and actions of data-sharing ecosystems, and by compiling ODS policies into executable formats for relationship-based authorization systems. If the approach works, a data provider could write one policy in a standard language and have it enforced automatically by an engine such as OpenFGA, turning declarative rights into concrete allow or deny decisions. The authors argue this closes a gap left by existing ODRL profiles, which model purposes and consent but not the distributed roles (provider, consumer, broker, monitor) or operational actions (training, subscribing, retention) typical of Data Spaces.

What carries the argument

The load-bearing mechanism is a compilation pipeline from ODRL and ODS policies to a relationship-based authorization engine. The profile supplies the vocabulary, namely the new Party and Action terms; the compiler supplies the translation into OpenFGA's JSON authorization model and permission tuples; and OpenFGA supplies the evaluation by checking whether the queried relationship exists and returning allow or deny. The ODS terms do the semantic work of mapping Data Space governance concepts onto ODRL's standard rule structure.

What would settle it

Compile a representative ODS policy, for example a Provider allowing a Consumer to Train a dataset only through a Broker, then query OpenFGA for every user, action, and resource triple; if the engine grants or denies any case that the ODRL policy does not, or the compiler fails to produce a valid OpenFGA model, the claimed executability is refuted.

Watch

Extended reading notes

Core claim

The central claim is that a modest vocabulary extension plus a translation pipeline is enough to make ODRL policies enforceable in Data Spaces. The ODS profile adds four specializations of odrl:Party — Consumer, Provider, Broker, and Monitor — and five specializations of odrl:Action — Train, Subscribe, Request_data, Retention, and Kill_job — so that policies can speak about who mediates, who oversees, and what operations count as use. The execution engine takes an ODS policy, compiles it into the JSON authorization model OpenFGA stores, writes the relationship tuples that connect users to resources, and then lets OpenFGA's API answer access queries. The use case with OpenFGA is presented as a validation that this compilation is applicable to relationship-based access control.

Load-bearing premise

The central claim collapses if an ODS policy cannot be compiled into OpenFGA's authorization model and tuples without changing the set of allowed operations, and the paper never spells out the mapping rules that would guarantee that.

Editorial extensions

If this is right

  • Data providers can author access rules once in ODRL and ODS and have them enforced through OpenFGA, removing a manual step between policy writing and runtime authorization.
  • Roles such as Broker and Monitor become explicit in policy, enabling governance of data exchanges and compliance oversight inside the policy itself.
  • Operational actions like Train and Retention give policies granular control over how data may be used, not just who may read it.
  • Because OpenFGA works with federated identities, ODS policies can consume identities from existing authentication systems, so authorization and authentication compose.
  • Alignment with the International Data Spaces Information Model means policies written in ODS can fit into broader Data Space architectures.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not provide mapping rules or a semantic-preservation argument, so the reliability of the compiler is an open empirical question; a natural test is to compile a suite of policies and compare OpenFGA's decisions against the intended ODRL semantics.
  • If the compilation is made rigorous, the same profile could target other ReBAC engines beyond OpenFGA, making policy portability a realistic goal.
  • The authors themselves flag potential privacy leaks through policy metadata; that suggests authoring and publishing tools for ODS policies should minimize or encrypt metadata.
  • Relationship-based control appears well matched to Data Spaces because participants are naturally modeled through trust relationships such as Broker and Monitor, perhaps more than through fixed attributes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes an ODRL Data Spaces (ODS) profile that extends ODRL with Data Space-specific roles and actions, and a policy execution engine that compiles ODRL policies into executable formats, illustrating the idea with OpenFGA as a relationship-based access control engine. The central claim, stated in the abstract, is that the approach is validated through an OpenFGA use case and demonstrates applicability to ReBAC scenarios. The paper also discusses authentication assumptions, alignment with existing ODRL profiles such as OAC and DPV, and future work including usage control and privacy-leakage analysis.

Significance. If the approach were fully specified and validated, the ODS profile plus an ODRL-to-OpenFGA compiler would be a genuinely useful contribution: it would give Data Space deployments a standards-based way to express fine-grained authorization policies and execute them in a scalable ReBAC engine. The paper is clearly written and honestly labels the engine as conceptual; it also builds on relevant prior work (OAC, DPV, IDSA) and explicitly identifies privacy-leakage risks as an open issue. These are strengths. However, the current manuscript does not demonstrate the central validation claim: it provides no concrete policy, no generated authorization model or tuples, and no execution trace. The contribution is therefore at the level of a plausible design sketch rather than a validated approach.

major comments (3)
  1. [Abstract and Section 3] The abstract states that the approach is 'validated through a use case involving OpenFGA, demonstrating its applicability.' Section 3 describes a seven-step workflow (Steps 1-7) but does not provide the evidence needed for validation: no concrete ODRL policy is given, no generated OpenFGA authorization model or JSON is shown, no relationship tuples are listed, and no authorization decision is compared against the intended ODRL semantics. The engine is also explicitly called 'conceptual' in Section 3. As written, the paper does not demonstrate that the approach works; it only describes how it might work. Please either add a fully worked example with the actual inputs and outputs, or temper the claim to state that the approach is illustrated rather than validated.
  2. [Section 3, Step 3] The load-bearing step is the compilation of ODRL policies into OpenFGA's executable format, but no mapping rules are specified. The text says 'the runtime uses the compiler to translate the ODRL policy into multiple languages,' yet it never shows how ODS terms such as ODS:Consumer, ODS:Provider, ODS:Train, ODS:Retention, or ODS:Kill_job become OpenFGA types, relations, and tuples. There is also no argument--formal or informal--that the ODRL semantics (permissions, prohibitions, obligations, duties) are preserved under the translation. Without this mapping, the claimed executability of ODS policies is unsupported. A concrete mapping table or a worked example with the generated JSON model and tuple store is necessary to make the claim defensible.
  3. [Section 2, Table 1] Table 1 defines the ODS vocabulary only through natural-language descriptions and parent-class labels. To function as an ODRL profile, the terms need formal definitions: IRIs, stated relationships to odrl:Party and odrl:Action, and axioms or comments that remove ambiguity. For example, ODS:Retention is described as 'Action that defines the maximum data retention period,' but an ODRL action normally denotes an operation, and it is unclear how the retention duration is represented; similarly, ODS:Monitor's relationship to odrl:Party and to any monitoring duty is not specified. This underspecification makes it difficult to compile ODS policies into a ReBAC model in a well-defined way, and it should be addressed for the profile to be usable.
minor comments (4)
  1. [Table 1] In the row for ODS:Broker, the definition begins with 'The The Party'; this typo should be corrected.
  2. [Section 3, Figure 1] The text references 'Figure 1' as showing the workflow, but no figure appears in the manuscript text provided. If the figure was omitted from the submission, please include it; if it is not yet available, the reference should be removed or updated.
  3. [Section 3, Step 3] The sentence 'JSON is the executable format required by OpenFGA' is imprecise: OpenFGA also accepts a DSL for authorization models, and JSON is one serialization used by the API. Please clarify that JSON is the machine-readable form used in the API, not the only format OpenFGA supports.
  4. [Section 4] The paragraph on privacy leaks is a relevant limitation but is addressed in one sentence. Given the paper's focus on policy sharing in Data Spaces, this limitation deserves a more detailed discussion or at least a pointer to the specific mechanisms that could leak metadata through ODRL policies.

Circularity Check

0 steps flagged · score 2.0 of 10

No substantive circularity: the only self-citation is forward-looking and not load-bearing; the main weakness is an under-specified validation, not circular reasoning.

full rationale

The paper's central contributions are vocabulary terms in the ODS profile and a conceptual compilation flow to OpenFGA. No equation or fitted parameter is involved. The ODS terms are defined as specializations of existing ODRL classes in Table 1, and the execution engine is explicitly described as a conceptual workflow; the claimed validation is a described seven-step process, not a result derived from its own inputs. There is no instance where a predicted quantity equals a fitted quantity or where a load-bearing assumption is justified solely by the authors' prior work. The only self-citation, [10], appears in future work: 'One of the key aspects to be incorporated into the profile is the control of data usage, which will be based on the architecture defined in [10].' This does not support the paper's central claim and is not load-bearing. The abstract's 'demonstrating its applicability' is unsupported because the paper gives no concrete ODRL-to-OpenFGA mapping, authorization model, or decision trace; but an unsupported claim is a correctness/evidence gap, not circularity. Cited external standards and prior OAC/DPV work are independent. Therefore the circularity score is at the low end, reflecting only the non-load-bearing self-citation.

Assumptions & free parameters 0 free parameters · 4 assumptions · 3 invented entities

The central claim rests on domain assumptions about identity management, translation feasibility, vocabulary sufficiency, and backend suitability. The newly invented ODS terms and the engine are unverified outside this paper.

assumptions (4)
  • domain assumption Authentication is handled by existing identity management solutions (DIDs, federated IdPs).
    Section 1 states this assumption; no evaluation of identity binding or trust.
  • domain assumption ODRL policies can be compiled to OpenFGA executable models without semantic loss.
    Section 3 describes the compilation but gives no mapping rules, proof, or concrete example.
  • ad hoc to paper The ODS vocabulary in Table 1 covers the required Data Space roles and actions.
    The terms are proposed as sufficient; no gap analysis beyond the authors' own scenario.
  • domain assumption OpenFGA is a suitable enforcement backend for Data Spaces.
    Stated in Section 3; no performance or integration tests.
invented entities (3)
  • ODS:Consumer, ODS:Provider, ODS:Broker, ODS:Monitor (subclasses of odrl:Party)
    purpose: Model Data Space roles in ODRL policies
    Defined only in Table 1; no external or operational validation.
  • ODS:Train, ODS:Subscribe, ODS:Request_data, ODS:Retention, ODS:Kill_job (subclasses of odrl:Action)
    purpose: Model Data Space operations in ODRL policies
    Defined only in Table 1; no published usage, no implementation.
  • Policy execution engine
    purpose: Compile ODRL policies into executable formats such as OpenFGA JSON
    Described conceptually in Section 3; no code or prototype artifact is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Authentication and authorization in Data Spaces: A relationship-based access control approach for policy specification based on ODRL." pith.science (2026). https://pith.science/paper/NQ7XCVVO

@misc{pith2026250524742,
  author       = {Pith},
  title        = {Pith review of: Authentication and authorization in Data Spaces: A relationship-based access control approach for policy specification based on ODRL},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NQ7XCVVO}},
  note         = {Machine review of arXiv:2505.24742}
}
read the original abstract

Data has become a crucial resource in the digital economy, fostering initiatives for secure and sovereign data sharing frameworks such as Data Spaces. However, these distributed environments require fine-grained access control mechanisms that balance openness with sovereignty and security. This paper proposes an extension of the Open Digital Rights Language (ODRL) standard, the ODRL Data Spaces (ODS) profile, aimed at supporting authorization and complementing existing authentication mechanisms throughout the data lifecycle. Additionally, a policy execution engine is introduced to translate ODRL policies into executable formats, enabling effective enforcement. The approach is validated through a use case involving OpenFGA, demonstrating its applicability to relationship-based access control scenarios.

Figures

Figures reproduced from arXiv: 2505.24742 by the authors.

Figure 1
Figure 1. Workflow for a use case with OpenFGA with OpenFGA. Although OpenFGA supports both a DSL and a JSON to define authorization models, JSON is the executable format required by OpenFGA. 4. Store the Authorization Model: Once the JSON authorization model has been generated, it is stored in the Store. The uploaded model includes the access rules that OpenFGA will use to make authorization decisions. 5. Store the Permissio… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Policy-Driven AI in Dataspaces: Taxonomy, Explainability, and Pathways for Compliant Innovation

    cs.CR 2025-07 reject novelty 2.0 of 10

    The paper is a literature review that classifies privacy-preserving AI techniques in dataspaces using a qualitative taxonomy of privacy, performance, and compliance ratings.

Reference graph

Works this paper leans on

11 extracted references · 11 canonical work pages · cited by 1 Pith paper

  1. [1]

    Eimear, M

    F. Eimear, M. Marco, K. Alexander, S. G. Josep, T. Brooke, M. Marina, P. S. Monica, S. Serena, T. Alessio, B. C. Jaime, et al., European Data Spaces-Scientific Insights into Data Sharing and Utilisation at Scale, Technical Report, Joint Research Centre, 2023

    work page 2023

  2. [2]

    Meckler, R

    S. Meckler, R. Dorsch, D. Henselmann, A. Harth, The web and linked data as a solid foundation for dataspaces, in: Companion Proceedings of the ACM Web Conference 2023, 2023, pp. 1440–1446

    work page 2023

  3. [3]

    Akaichi, W

    I. Akaichi, W. Slabbinck, J. A. Rojas, C. Van Gheluwe, G. Bozzi, P. Colpaert, R. Verborgh, S. Kir- rane, Interoperable and continuous usage control enforcement in dataspaces, in: The Second International Workshop on Semantics in Dataspaces, co-located with the Extended Semantic Web Conference, 2024

    work page 2024

  4. [4]

    Cimmino, J

    A. Cimmino, J. Cano-Benito, R. García-Castro, Open digital rights enforcement framework (odre): from descriptive to enforceable policies, Computers & Security 150 (2025) 104282

    work page 2025

  5. [5]

    Esteves, H

    B. Esteves, H. J. Pandit, V. Rodríguez-Doncel, Odrl profile for expressing consent through granular access control policies in solid, in: 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), IEEE, 2021, pp. 298–306

    work page 2021

  6. [6]

    URL: https://w3c.github.io/dpv/2.1/dpv/, accessed on March 25, 2025

    W3C, W3c data privacy vocabulary, 2025. URL: https://w3c.github.io/dpv/2.1/dpv/, accessed on March 25, 2025

    work page 2025

  7. [7]

    H. J. Pandit, B. Esteves, G. P. Krog, P. Ryan, D. Golpayegani, J. Flake, Data privacy vocabulary (dpv) – version 2.0, in: The Semantic Web – ISWC 2024, Springer Nature Switzerland, Cham, 2025, pp. 171–193

    work page 2024

  8. [8]

    Mader, J

    C. Mader, J. Pullmann, N. Petersen, C. L.-B. Steffen Lohmann, F. IAIS/EIS, F. FIT, W3c international data spaces information model, 2025. URL: https://international-data-spaces-association.github.io/ InformationModel/docs/index.html#, accessed on April 28, 2025

    work page 2025

Show all 11 references
  1. [9]

    D. M. Mustafa, A. Nadgeri, D. Collarana, B. T. Arnold, C. Quix, C. Lange, S. Decker, From instructions to odrl usage policies: An ontology guided approach, Proceedings of the VLDB Endowment. ISSN 2150 (2024) 8097

    2024

  2. [10]

    Munoz-Arcentales, S

    A. Munoz-Arcentales, S. López-Pernas, A. Pozo, Á. Alonso, J. Salvachúa, G. Huecas, An architecture for providing data usage and access control in data sharing ecosystems, Procedia Computer Science 160 (2019) 590–597

    2019

  3. [11]

    H. J. Pandit, B. Esteves, Enhancing data use ontology (duo) for health-data sharing by extending it with odrl and dpv, Semantic Web 15 (2024) 1473–1498

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.