12:47:49 <RRSAgent> RRSAgent has joined #lws
12:47:53 <RRSAgent> logging to https://www.w3.org/2025/03/24-lws-irc
12:47:53 <Zakim> RRSAgent, make logs Public
12:47:54 <Zakim> please title this meeting ("meeting: ..."), laurens
12:48:11 <laurens> meeting: LWS WG Meeting - 24/03/2025
12:48:27 <laurens> agenda: https://www.w3.org/events/meetings/a19ab7dc-1753-433d-bac5-64e3ad8c0a43/20250324T100000/
12:48:28 <agendabot> clear agenda
12:48:28 <agendabot> agenda+ Introductions and Announcements
12:48:28 <agendabot> agenda+ Action Items
12:48:28 <agendabot> agenda+ Use Cases and Requirements
13:55:38 <acoburn> acoburn has joined #lws
13:58:32 <eBremer> eBremer has joined #lws
13:59:16 <hadrian> hadrian has joined #lws
14:00:46 <bendm> bendm has joined #lws
14:00:53 <bendm> present+
14:01:45 <acoburn> -> https://www.w3.org/groups/wg/lws/ LWS
14:02:38 <laurens> present+
14:02:42 <jeswr> jeswr has joined #lws
14:02:48 <jeswr> present+
14:03:02 <acoburn> present+
14:03:13 <eBremer> present+
14:03:27 <acoburn> RRSAgent, make minutes
14:03:28 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html acoburn
14:03:50 <laurens> chair: laurens
14:04:06 <hadrian> present+
14:04:26 <ericP> ericP has joined #lws
14:04:30 <pchampin> present+
14:04:33 <ericP> present+
14:05:08 <ericP> scribe+
14:05:24 <ericP> rrsagent, make minutes
14:05:26 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html ericP
14:06:08 <ericP> scribe+
14:06:56 <ericP> agenda?
14:07:04 <ericP> next agendum
14:07:17 <TallTed> TallTed has joined #lws
14:07:33 <ericP> laurens: no announcements on my side
14:07:43 <laurens> q?
14:07:44 <ericP> ... anyone lese?
14:07:45 <ericP> [crickets]
14:07:55 <ericP> next agendum
14:07:58 <acoburn> s/lese/else
14:08:11 <ericP> Zakim, take up agendum 2
14:08:11 <Zakim> agendum 2 -- Action Items -- taken up [from agendabot]
14:08:32 <bendm7> bendm7 has joined #lws
14:08:39 <laurens> https://github.com/w3c/lws-protocol/issues/16
14:08:40 <gb> https://github.com/w3c/lws-protocol/issues/16 -> Action 16 present a weekly overview of closed issues in the https://github.com/w3c/lws-ucs/issues repository (on hzbarcea) due 2025-03-17
14:09:08 <ericP> acoburn: hadrian, any closed issues?
14:09:26 <ericP> hadrian: i closed 112, 126, 133 last week
14:09:29 <pchampin> s|https://github.com/w3c/lws-protocol/issues/16|topic: https://github.com/w3c/lws-protocol/issues/16
14:09:37 <laurens> https://github.com/w3c/lws-ucs/issues/112
14:09:37 <gb> https://github.com/w3c/lws-ucs/issues/112 -> CLOSED Issue 112 [UC] Storage portability from a provider to another (by hzbarcea) [duplicate] [usecase]
14:09:39 <pchampin> s/topic:/subtopic:
14:09:41 <laurens> https://github.com/w3c/lws-ucs/issues/126
14:09:42 <gb> https://github.com/w3c/lws-ucs/issues/126 -> CLOSED Issue 126 [REQ-F] Guaranteed globally unique Identifier Storage(s) (by hzbarcea) [duplicate]
14:09:43 <laurens> https://github.com/w3c/lws-ucs/issues/123
14:09:44 <gb> https://github.com/w3c/lws-ucs/pull/123 -> MERGED Pull Request 123 Updated glossary (by hzbarcea)
14:09:48 <ericP> hadrian: tx to ted for lots of comments
14:09:55 <pchampin> RRSAgent, make minutes
14:09:56 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html pchampin
14:10:03 <TallTed> present+
14:10:37 <TallTed> TallTed has changed the topic to: LWS WG -- 2025-03-24 agenda: https://www.w3.org/events/meetings/a19ab7dc-1753-433d-bac5-64e3ad8c0a43/20250324T100000/
14:10:47 <laurens> https://github.com/w3c/lws-protocol/issues/15
14:10:47 <gb> https://github.com/w3c/lws-protocol/issues/15 -> Action 15 introduce both the term owner and controller in the glossary, and clarify their meaning. (on hzbarcea) due 2025-02-24
14:11:04 <ericP> discussing PR https://github.com/w3c/lws-ucs/pull/137 and issue 15
14:11:05 <gb> https://github.com/w3c/lws-ucs/pull/137 -> MERGED Pull Request 137 Definitions for owner and controller (by hzbarcea)
14:11:13 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html TallTed
14:11:27 <pchampin> s|https://github.com/w3c/lws-protocol/issues/15|subtopic: https://github.com/w3c/lws-protocol/issues/15
14:11:54 <laurens> https://github.com/w3c/lws-protocol/issues/15
14:12:03 <ericP> laurens: closing issue 15
14:12:32 <ericP> hadrian: csarven commented that we have too many terms that point to a specific solution
14:13:05 <ericP> ... i see his point of view. those glossary terms are there right now. if anyone wants, i can remove them temporarily
14:13:12 <ericP> hadrian: table to next agendum
14:13:27 <ericP> ... status of categories?
14:13:48 <laurens> https://github.com/w3c/lws-protocol/issues/11
14:13:49 <gb> https://github.com/w3c/lws-protocol/issues/11 -> CLOSED Action 11 add categorization to the needs discussion labeled issues (on hzbarcea) due 2025-01-13
14:13:53 <ericP> hadrian: you can close that. we have a critical mass of categories
14:14:26 <ericP> Zakim, take up next agendum
14:14:26 <Zakim> agendum 1 -- Introductions and Announcements -- taken up [from agendabot]
14:14:37 <TallTed> Zakim, close item 1
14:14:37 <Zakim> agendum 1, Introductions and Announcements, closed
14:14:38 <Zakim> I see 1 item remaining on the agenda:
14:14:38 <Zakim> 3. Use Cases and Requirements [from agendabot]
14:14:39 <ericP> Zakim, take up agendum n3
14:14:40 <Zakim> 'n3' does not match any agenda item, ericP
14:14:44 <TallTed> Zakim, take up item 3
14:14:44 <Zakim> agendum 3 -- Use Cases and Requirements -- taken up [from agendabot]
14:14:48 <pchampin> s|https://github.com/w3c/lws-protocol/issues/11|subtopic: https://github.com/w3c/lws-protocol/issues/11
14:15:17 <ericP> laurens: i see progress over the weekend. update, hadrian?
14:15:31 <ericP> hadrian: 1st, two probs:
14:16:05 <laurens> https://github.com/w3c/lws-ucs/pull/139
14:16:06 <gb> https://github.com/w3c/lws-ucs/pull/139 -> MERGED Pull Request 139 add minimal CSS for readable tables (by pchampin)
14:16:30 <ericP> ... .. pchampin's patch for tables was good but doesn't fully work because of respec limitations
14:16:50 <ericP> ... gonna play with HTML tables
14:17:03 <laurens> https://github.com/w3c/lws-ucs/pull/143
14:17:04 <gb> https://github.com/w3c/lws-ucs/pull/143 -> Pull Request 143 Add requirements and requirements matrix (by hzbarcea) [needs-discussion]
14:17:08 <csarven> present+ joined at 14:17 UTC
14:17:12 <ericP> ... there's only one UC because i'm experimenting with the requirements matrix
14:17:36 <ericP> .... i couldn't create anchors in the matrix (of course, i can do it in HTML)
14:18:11 <ericP> ... i added a few requirements
14:18:18 <ericP> ... we can select any for today
14:18:48 <laurens> q?
14:18:55 <ericP> ... i didn't work on authentication requirements. once i've done them, we can add them to lots of UCs and mark them complete
14:19:15 <ericP> ... happy to discuss and close any issues
14:19:36 <laurens> https://github.com/w3c/lws-ucs/issues?q=is%3Aissue%20state%3Aopen%20label%3Aneeds-discussion
14:19:56 <laurens> https://github.com/w3c/lws-ucs/issues/141
14:19:57 <gb> https://github.com/w3c/lws-ucs/issues/141 -> Issue 141 [REQ-F] Consent based sharing (by hzbarcea) [needs-discussion]
14:20:09 <ericP> laurens: let's start with https://github.com/w3c/lws-ucs/pull/141
14:21:10 <ericP> ... the input documents have ACL mechanisms but no protocol for granting access in the input documents
14:21:19 <ericP> q+ to asy that the low bar is that we do nothing
14:21:50 <ericP> ... do we see it as part of the requirements to provide a mechanism to request access
14:22:01 <laurens> q?
14:22:04 <ericP> ... i think it's important to have and make interoperable
14:22:06 <laurens> ack ericP
14:22:06 <Zakim> ericP, you wanted to asy that the low bar is that we do nothing
14:22:22 <pchampin> scribe+
14:23:11 <pchampin> ericP: if you move your data from provider A to provider B, you may have to learn a new way to setup your ACLs
14:23:12 <laurens> q?
14:23:23 <pchampin> ... and we don't have the "google docs" mechanism to request access
14:23:29 <pchampin> ... those are the known pain points
14:23:39 <pchampin> scribe-
14:23:40 <csarven> q+ There was a mechanism proposed for requesting access: https://github.com/solid/specification/pull/253#issuecomment-895062229
14:23:42 <gb> https://github.com/solid/specification/pull/253 -> CLOSED Pull Request 253 Add Inbox Discovery on Client Error (by csarven) [doc: Protocol] [topic: resource access] [topic: events and notifications] [status: Nominated]
14:23:52 <ericP> laurens: i think the lack of standard way to req access is the primary pain point
14:23:59 <bendm7> q+ to ask whether we have (industry) standards to start from
14:24:02 <pchampin> q+ csarven
14:24:04 <laurens> q?
14:24:18 <ericP> ... nothing analogous to the Google Doc req for access
14:24:44 <TallTed> q-
14:25:06 <laurens> ack csarven
14:25:24 <csarven> present+
14:25:58 <ericP> csarven: i think the proposed req issue is unclear but the things that folks have said here seem familiar
14:26:33 <ericP> ... SolidCG made an attemt to build on Solid protoocol to req access
14:26:54 <acoburn> q+ to note Inrupt's incubation of this feature
14:27:13 <ericP> ... in Google Docs, if you try to access a doc you don't have access to, [there's a button to request access]
14:27:37 <pchampin> +1 to csarven, I think there has been several incubated work around consent request; I don't think I heard anyone say it hadn't been incubated, though, only "not standardized"
14:27:38 <ericP> ... 403 gives you a link to req access
14:28:14 <ericP> ... in Solid CG, we had a notification sent to the resource owner
14:28:22 <acoburn> -> https://solid.github.io/data-interoperability-panel/specification/#access-request Interoperability Panel incubation
14:28:32 <ericP> ... this is the low-tech approach to requesting access
14:28:33 <TallTed> q+ to talk about access permission request elements as primitives, rather than specifics
14:28:51 <ericP> ... what to put in the payload is a data-modeling exercise
14:29:09 <ericP> ... the solution incubated in the SolidCG was based on WAC
14:29:19 <laurens> laurens has joined #lws
14:29:24 <laurens> q?
14:30:05 <ericP> q+ to mention SAI
14:30:09 <laurens> q?
14:30:15 <laurens> ack bendm
14:30:15 <Zakim> bendm, you wanted to ask whether we have (industry) standards to start from
14:31:07 <ericP> bendm: csarven's approach is sort of a minimum thing to add to the protocol
14:31:39 <laurens> q?
14:31:45 <laurens> ack acoburn
14:31:45 <Zakim> acoburn, you wanted to note Inrupt's incubation of this feature
14:32:02 <ericP> ... wanted to mention other industry standards
14:32:36 <ericP> acoburn: we have access reqs with tamper evidence. simiarl to interop panel's tech
14:33:08 <ericP> ... these aren't industry standards but they are used in production environments at scale
14:33:17 <laurens> q?
14:33:22 <laurens> ack TallTed
14:33:22 <Zakim> TallTed, you wanted to talk about access permission request elements as primitives, rather than specifics
14:33:23 <ericP> q-
14:33:28 <csarven> s/resource owner/resource owner. There is implementation experience / still in use, e.g., in https://dokie.li/
14:34:10 <hadrian> q+
14:34:15 <ericP> TallTed: rather than taking about interactions, i think we should talk about a resource and an agent trying to delete or append
14:34:51 <ericP> ... the controler and owner may have different interactions
14:35:10 <ericP> ... may be useful to create a Mermaid diagram
14:35:49 <ericP> primatives are more likely to be generically applicable
14:36:43 <laurens> q?
14:36:44 <ericP> ... the looser this can be speciified, the better. how to make it interact and how to make it portable
14:36:46 <laurens> ack hadrian
14:37:33 <laurens> q+
14:37:35 <ericP> hadrian: agree. was careful with phrasing to say "verifiable proof" and "audit trail"
14:37:46 <ericP> ... i'm not personally interested in the flows
14:38:34 <bendm7> +1 on focusing on the proofs of access request/grant so you have portability, eg for the audit trail
14:38:46 <ericP> ... jessie, acoburn and  few others wanted to avoid specific mechanism in the spec
14:39:05 <jeswr> jeswr has joined #lws
14:39:25 <jeswr> q+
14:39:30 <ericP> ... can we just prescribe the proof of an agent's access ?
14:40:04 <ericP> TallTed: just saying we need a "verifiable proof of consent" doesn't tell me the required functionalities
14:40:06 <pchampin> RRSAgent, make minutes
14:40:08 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html pchampin
14:41:05 <ericP> hadrian: as the server, i need to say that i granted an agent access and a proof for how the grant was appropriate
14:41:38 <laurens> q?
14:41:57 <ericP> ... we have two providers, A and B
14:42:04 <pchampin> i|let's start with|subtopic: w3c/lws-ucs#141
14:43:26 <ericP> ...if storage provider A grants TallTed access to hadrian's resource, ...
14:43:38 <ryey> ryey has joined #lws
14:43:44 <ericP> TallTed: that seems like ACLs
14:43:56 <laurens> q?
14:44:28 <ryey> present+
14:44:43 <ericP> hadrian: should we say that there should be a way to req access or should we prescribe it?
14:45:11 <ericP> ... i think the former because it will change monthing as providers innovate
14:46:02 <csarven> q+ to follow-up on primitives, e.g., notification, unit of information, actors, kind of access
14:46:05 <laurens> q?
14:46:12 <laurens> ack laurens
14:46:14 <ericP> TallTed: what happens when you move your data from detailed provider to minimal provider
14:47:04 <ericP> laurens: i'm concerned by the spread between a minimal provider and a detailed provider
14:47:16 <ericP> ... diff betwen consent and ACLs:
14:47:43 <ericP> ... .. concsent: i wanna give user Alice access to my health records
14:47:54 <laurens> q?
14:47:57 <laurens> ack jeswr
14:48:03 <acoburn> q+ to note that consent is often time-constrained and bound to a specific purpose
14:48:04 <ericP> ... .. ACLs: specific documents and agents
14:48:14 <ericP> jeswr: i think we're conflating:
14:48:32 <ericP> .... .. portablily
14:48:43 <ericP> ... .. auditability
14:48:47 <csarven> +1 jeswr re not conflating requirements
14:49:00 <ericP> ... .. access management
14:49:03 <ericP> ... .. consent
14:50:15 <csarven> +10 jeswr for making an excellent attempt at reverse-engineering the requirement
14:50:24 <ericP> ... for access controls and consent, i'd like to differentiate hadrian:proof (ESS gramt model, with proof-carrying-authentication) vs. WAC-like mechamisms where you only show up with an identity
14:51:18 <ericP> .... when't we're taking about access conbtrol, we need to discuss attempting to access a resources and the server deciding or not to give access
14:51:53 <laurens> q?
14:51:58 <laurens> ack csarven
14:51:58 <Zakim> csarven, you wanted to follow-up on primitives, e.g., notification, unit of information, actors, kind of access
14:52:08 <ryey> +2 jeswr for distinction between proof and access control, and stages of access (control) evaluation, for more flexible policy mechanism
14:52:12 <ericP> ... also need to determine how we achieve interop on request consents, then we can ground our audit discussion
14:52:24 <ericP> csarven: +1 ot unpacking the reqs
14:53:31 <ericP> ... the first sentence in issue 141 could say "to allow access to an entity"
14:53:55 <ericP> ... sencond sentence talks about "proof of consent"
14:54:15 <laurens> q+
14:54:16 <ericP> ... i think we're using the word "consent" with different perspectives
14:54:28 <ericP> ... +1 to focusing on the primatives
14:54:58 <ericP> ... if i want to req access, i need to make a call, click a button, ....
14:55:47 <ericP> ... are we asking for a specifc way to request access?
14:56:01 <laurens> q?
14:56:15 <laurens> q?
14:56:20 <laurens> ack acoburn
14:56:20 <Zakim> acoburn, you wanted to note that consent is often time-constrained and bound to a specific purpose
14:56:30 <laurens> ack laurens
14:56:37 <ericP> acoburn: more to unpack. continue in following weeks
14:56:58 <ericP> laurens: we need to ensure we understand the terminology, e.g. "consent"
14:57:32 <ericP> ... we need to not conflate reqs. this issue relates closely to data and permission portability
14:57:55 <ericP> ... this discussion has layers. we'll need to scope
14:58:25 <ericP> hadrian: i'll add more thoughts in issue 141
14:58:33 <ericP> acoburn: as will i
14:58:41 <ericP> RRSAgent, make minutes
14:58:42 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html ericP
14:59:53 <ericP> ... anything we want to see more of?
15:00:01 <ericP> laurens: data discoverability
15:00:06 <csarven> pchampin: Note "joined at 14:17 UTC" in the Attendees / Present  :)
15:00:16 <ericP> RRSAgent, make minutes
15:00:17 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html ericP
15:00:24 <ericP> scribe-
15:00:25 <acoburn> acoburn has left #lws
15:00:34 <pchampin> RRSAgent, make minutes
15:00:35 <RRSAgent> I have made the request to generate https://www.w3.org/2025/03/24-lws-minutes.html pchampin