Skip to content

Access & usage policies enforcement#

Part of the LDT Governance and Trust Framework — instantiates the iSHARE Data Space Template block Access & usage policies enforcement (© iSHARE Foundation, see Legal notices).

Purpose#

Implement contractual and regulatory rules technically: control access and usage based on attributes, roles, group membership and declared purposes.

LDT instantiation — drafted by iSHARE (with HyEnSys)#

  • Policy language: the iSHARE ODRL profile; usage terms bound to offerings via the iSHARE Licence Catalog (licenses.ishare.eu, binding artefact). Policies are machine-enforceable by design (RBAC/ABAC).
  • Enforcement architecture: federated PEP/PDP pattern at the connectors (EDC iSHARE extension), with the Participant Registry and credential status as shared PIPs; no central policy engine.
  • Baseline vs stricter: the scheme sets the platform-wide baseline; use-case groups (LEZ, PED, airport, Marketplace of the EU LDT Toolbox) may define stricter policies — the Commons controls govern citizen/community data on top of the baseline.
  • Consent: GDPR-consent handling follows PD1; consent state is a PIP input where citizen data is in scope.
  • Proof: every policy decision leaves an audit-trail entry (see Provenance & observability).

🧩 Building block requested — Owner: HyEnSys#

What we need: the Commons-controls specification: the community-level policy set for citizen/community data (PED, LEZ), how community consent/mandates translate into ODRL constraints, and the escalation path when Commons rules and participant policies conflict.

Format: Markdown section in this page (merge request) · Due: 26 Sep 2026 (v0.5) · Status: OPEN

🧩 Building block requested — Owner: Both cities (sign-off)#

What we need: review of the baseline policy set against municipal open-data and privacy commitments.

Format: Markdown section in this page (merge request) · Due: 17 Oct 2026 (v0.9 review) · Status: OPEN

Guiding questions#

All 20 of the template's questions for this block, with the 6 LDT answer slots to fill, are on access-and-usage-policies-and-enforcement/guiding-questions.md. The digest below is the subset that most shapes this block.

  • Which platform-wide policies are enforced, what is the minimum baseline, and can participants define stricter policies in their groups?
  • Which shared PIPs (e.g. consent registry) does the scheme maintain and how do they integrate with trust & identity?
  • How are machine-readable agreements negotiated (ODRL templates), when do policy checks occur, and how are revocations propagated?
  • How are audit trails generated and retained, and are enforcement proofs published for audits and marketplace listing?

PD4 mapping#

Feeds PD4 chapter 5 — Data & data-model sharing conditions (the enforcement half).