Permissions and Obligations Expression Working Group Teleconference

<renato> 12:30 pm | Greenwich Time (Reykjavik, GMT) | 1 hr

hi

i can scribe if you like

<scribe> Scribe: victor

<renato> https://www.w3.org/2017/06/19-poe-minutes

<michaelS> scribenick: victor

approve the last meeting's minutes

<phila> (not present)

RESOLUTION: last meeting's minutes are approved

<benws> hmmm - problems calling in

test cases

renato: I have explored the practices of other groups and their exit criteria
... the w3c mawg listed "features" which were implemented by implementors. they were the key selling idea.

<renato> https://github.com/w3c/poe/blob/gh-pages/test/cr-exit.md

renato: we can create test cases for each of the features listed in the url above

phila: I had an action item due, currently almost done trying to identify what an ODRL Evaluator had to do
... I made notes to the examples, the exit criteria would be to check whether the output of the evaluator is the one expected given one or more policies.
... the key is "what an evaluator must do"

renato: constraints in any case are evaluated by black boxes.
... validation is first

phila: i am trying to write down what happens one the black box has worked, "not how the black box works"

<simonstey> +q

simonstey: is the output yes/no or the policy containing the set of rules which are in effect?
... e.g. given a policy with 20 rules, shouldn't the policy evaluator say which is/are the rules which are in effect?

<phila> victor: Is the ODRLE stateless?

<simonstey> +q

<phila> ... A god feature IMO is that it would be

<phila> simonstey: You don't really have a choice of which rules you can take

<phila> ... If the OE is evaluating a request against a policy, all the rules apply, you can't ignore some

simonstey: for each request, there is as an output

<phila> victor: Yes, I'm saying there should be only one request for the test cases

victor: yes, in a system without memory, the test cases should only have at most "requests" but not "sequences of requests".

simonstey: we cannot foresee how the odrl evaluator should be as long as the test cases are passed

<simonstey> +q

renato: it is quite likely that some implementations only consider validation, whereas "evaluation" will not be regarded.

<benws> Sorry guys - I can't call in. V. odd.

simonstey: the absolute minimum should abide to the IM in its section 2.7 onward.
... conflict resolution etc. has to be checked/tested
... propagation of constraints in the root level etc.

<phila> +1 to simonstey

<renato> https://github.com/w3c/poe/blob/gh-pages/test/cr-exit.md

simonstey: we need to check whether ODRL implementations do that, unless we use "MAY"s. etc. The absolute minium is "given a policy or set of set of policies, possibly with conflicts and conflict resolution information, reduce the set of rules to the result of applying the spec".

renato: in the web above, you can see that a feature is "A Policy that includes Policy inhertiance".
... we can write test cases for each of the bullet points above

victor: Phila, have you written anything?

phila: hopefully today I'll distribute something

renato: is there anything missing from the exit criteria list?
... is this ok?

phila: yes

subtopic: who are the potential implementations?

renato: we should contact potential implementors out of the WG

<renato> https://github.com/w3c/poe/blob/gh-pages/test/implementors.md

renato: we should try to fill the table provided in IRL link above
... Caroline could have feedback from three organizations (?)

ivan: 3 implementations are in the low side

renato: indeed

+1

<renato> Fraunhofer Gesellschaft

victor: UPM will provide an implementation, as long as abiding to the test cases is not terribly complicated

renato: possibly Fraunhofer will also.

<renato> https://github.com/w3c/poe/issues/164

victor: UPM has staterd in a Pubby fork to serve linked data conditionally.

Add "source" property to Collections Github Issue

renato: the MAWG has decided to use "source" to prevent id hijaacking
... so for the collections, "source" would be used, and not "uid"

<simonstey> +q

<michaelS> akc m

<simonstey> https://github.com/w3c/poe/issues/201

michaelS: this has to be explained to the users of the information model. source is an alternative to id; but why/how?

simonstey: by not using uid, blank nodes may live. Then, additional constraints identified by a certain URI might be concealed.

renato: it is about creating another property which would be "source".

ivan: not sure if the background of the problem is clear. in RDF, once a triple is out there in the web it is not confined, and anyone can see.
... so if someone makes a statement on a resource on the web ("ivan is blonde"), this is public, and this is what hijaacking is about.

renato: does anybody oppose?

(silence)

<renato> https://github.com/w3c/poe/issues/162

Duty at Policy level GitHub Issue

renato: it is about a policy saying "pay me 5 dollars".
... which as of today, clashes with the current IM definition, which associates duties only at the permission level.

<simonstey> +q

renato: root-level-duties may prove useful for inheritance in an agreement.

simonstey: i already commented in the github, there is an inconsistency now: we said that the IM specifies that a policy must have at least a rule (permission, prohibition, duty), but then we say that duty can only hang from a permission.
... if a duty is added to an offer/agreement then there must be one permission. otherwise, there cannot be a duty alone.

michaels: this is related to shortcuts at the policy level.
... we have some already shortcuts

victor: I want some clarifications in the shortcuts

<renato> https://w3c.github.io/poe/model/#composition

simonstey: the duty case is different from other shortcuts like "odrl:mypolicy odrl:permission odrl:play".
... in the first case, it can be specified otherwise, yes, but with too much effort

victor: I saw and advantage in having a policy defined by a set of triples in the form "odrl:mypolicy odrl:PROPERTY odrl:VALUE".

renato: we can see them not as "shortcuts" but as first class objects
... the duties are naturally "top level" in some cases.

simonstey: there are some duties with an implicit permission. consider GDPR. One may say "if you want to handle with personaldata you have to do X"

victor: if we have two manners of expressing something, we can define a CANONICALIZATION operation (much like in the XML world canonicalization is)

michaelS: (explains a case victor does not grasp)

renato: he means: we have non-conflicting permission A and prohibition B, and a duty at the policy level.
... what is the meaning of the duty once being satisfied?

simonstey: you only pay for your right, but the prohibition also holds.

renato: we need more discussion on this.

RESOLUTION: to accept "source" for collections as an alternative identification mechanism

renato: please join the github issues

<simonstey> :(

<michaelS> says thanks to phila

ivan: will set up a new W3C call for the next weeks
... but i will be on vacation for 4 weeks
... ralph will fix the webex meetings'

phila: this is perhaps my last call
... i will clean up the minutes for the last time.