acp.html

<!DOCTYPE html>
<html
  about="https://solidproject.org/TR/acp#"
  typeof="schema:Article doap:Specification"
  prefix="
  acp: http://www.w3.org/ns/solid/acp#
  bibo: http://purl.org/ontology/bibo/
  cito: http://purl.org/spar/cito/
  dc: http://purl.org/dc/terms/
  doap: http://usefulinc.com/ns/doap#
  owl: http://www.w3.org/2002/07/owl#
  rdf: http://www.w3.org/1999/02/22-rdf-syntax-ns#
  rdfs: http://www.w3.org/2000/01/rdf-schema#
  schema: http://schema.org/
  vann: http://purl.org/vocab/vann/
  xsd: http://www.w3.org/2001/XMLSchema#"
  dir="ltr"
  lang="en"
>
  <head>
    <meta charset="utf-8" />
    <meta content="width=device-width, initial-scale=1" name="viewport" />
    <link href="https://solidproject.org/TR/solid.svg" rel="icon">
    <title>Access Control Policy (ACP)</title>
    <link
      rel="stylesheet"
      href="https://www.w3.org/StyleSheets/TR/2016/base.css"
      media="all"
    />
    <link rel="stylesheet" href="./2022/acp-main-20220518.css" media="all" />
    <link rel="stylesheet" href="./2022/acp-code-20220518.css" media="all" />
  </head>
  <body vocab="https://solidproject.org/TR/acp#">
    <header class="head">
      <a class="logo" href="https://solidproject.org/"
        ><img alt="Solid" src="solid.svg" width="72" height="66"
      /></a>
      <h1 property="dc:title">Access Control Policy (ACP)</h1>
      <h2>
        <span property="rdfs:comment">Version 0.9.0</span>,
        <time property="dc:issued" datetime="2022-05-18">2022-05-18</time>
      </h2>
      <details open="">
        <summary>More details about this document</summary>
        <dl>
          <dt>This version</dt>
          <dd>
            <a href="https://solidproject.org/TR/2022/acp-20220518">https://solidproject.org/TR/2022/acp-20220518</a>
          </dd>
          <dt>Latest version</dt>
          <dd>
            <a href="https://solidproject.org/TR/acp">https://solidproject.org/TR/acp</a>
          </dd>
          <dt>Editor's draft</dt>
          <dd>
            <a href="https://solid.github.io/authorization-panel/acp-specification">https://solid.github.io/authorization-panel/acp-specification</a>
          </dd>
          <dt>Source repository</dt>
          <dd>
            <a href="https://github.com/solid/authorization-panel">https://github.com/solid/authorization-panel</a>
          </dd>
          <dt>Issue tracking</dt>
          <dd>
            <a href="https://github.com/solid/authorization-panel/issues">https://github.com/solid/authorization-panel/issues</a>
          </dd>
          <dt>License</dt>
          <dd>
            <a href="http://purl.org/NET/rdflicense/MIT1.0">MIT License</a>
          </dd>
          <dt>Editors</dt>
          <dd>
            <ul>
              <li rel="schema:creator schema:author">
                <span
                  about="https://id.inrupt.com/matthieu"
                  typeof="schema:Person"
                >
                  <a
                    rel="schema:url"
                    href="https://github.com/matthieubosquet/"
                  >
                    <span
                      about="https://id.inrupt.com/matthieu"
                      property="schema:name"
                    >
                      <span property="schema:givenName">Matthieu</span>
                      <span property="schema:familyName">Bosquet</span>
                    </span>
                  </a>
                </span>
              </li>
            </ul>
          </dd>
        </dl>
      </details>
      <p id="copyright" class="copyright">
        <span property="dc:license">MIT License.</span> Copyright ©
        <span property="dc:dateCopyrighted">2022</span>
        <a
          rel="dc:rightsHolder"
          href="http://www.w3.org/community/solid/"
          >W3C Solid Community Group</a
        >.
      </p>
    </header>

    <section
      datatype="rdf:HTML"
      typeof="bibo:Chapter"
      resource=":abstract"
      property="bibo:hasPart"
    >
      <h2 id="abstract">Abstract</h2>
      <p>
        This document defines the
        <span about="acp:" property="rdfs:label"
          >Access Control Policy Language (ACP)</span
        >.
        <span about="acp:" typeof="owl:Ontology" property="rdfs:comment"
          >ACP is a language for describing, controlling, and granting access to
          resources.</span
        >
      </p>
    </section>

    <section
      datatype="rdf:HTML"
      typeof="bibo:Chapter"
      resource=":status-of-this-document"
      property="bibo:hasPart"
    >
      <h2 id="status-of-this-document">Status of this document</h2>
      <p>
        This section describes the status of this document at the time of its
        publication.
      </p>

      <p>
        This document was published by the
        <a href="https://www.w3.org/community/solid/">Solid Community Group</a>
        as an Editor&#39;s Draft. The sections that have been incorporated have
        been reviewed following the
        <a href="https://github.com/solid/process">Solid process</a>. However,
        the information in this document is still subject to change. You are
        invited to
        <a href="https://github.com/solid/specification/issues">contribute</a>
        any feedback, comments, or questions you might have.
      </p>

      <p>
        Publication as an Editor&#39;s Draft does not imply endorsement by the
        W3C Membership. This is a draft document and may be updated, replaced or
        obsoleted by other documents at any time. It is inappropriate to cite
        this document as other than work in progress.
      </p>

      <p>
        This document was produced by a group operating under the
        <a href="https://www.w3.org/community/about/agreements/cla/"
          >W3C Community Contributor License Agreement (CLA)</a
        >. A human-readable
        <a href="https://www.w3.org/community/about/agreements/cla-deed/"
          >summary</a
        >
        is available.
      </p>
    </section>
    <nav id="toc">
      <h2 id="table-of-contents">Table of Contents</h2>
      <ol class="toc">
        <li class="tocline">
          <a href="#abstract" class="tocxref">Abstract</a>
        </li>
        <li class="tocline">
          <a href="#status-of-this-document" class="tocxref"
            >Status of this document</a
          >
        </li>
        <li class="tocline">
          <a href="#introduction" class="tocxref"
            ><span class="secno">1</span>Introduction</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#rdf-terminology" class="tocxref"
                ><span class="secno">1.1</span>RDF terminology</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#namespaces" class="tocxref"
                ><span class="secno">1.2</span>RDF vocabularies and namespace
                IRIs</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#acp-terminology" class="tocxref"
                ><span class="secno">1.3</span>ACP terminology</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#example-graphs" class="tocxref"
                ><span class="secno">1.4</span>Example graphs</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#data-model" class="tocxref"
                ><span class="secno">1.5</span>Data model</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#ontology" class="tocxref"
                ><span class="secno">1.6</span>Ontology</a
              >
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#conformance" class="tocxref"
            ><span class="secno">2</span>Conformance</a
          >
        </li>
        <li class="tocline">
          <a href="#context-graph" class="tocxref"
            ><span class="secno">3</span>Context Graph</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#context" class="tocxref"
                ><span class="secno">3.1</span>Context</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-context" class="tocxref"
                    ><span class="secno">3.1.1</span>Example Context</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#context-extensibility" class="tocxref"
                ><span class="secno">3.2</span>Context extensibility</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-context-extension" class="tocxref"
                    ><span class="secno">3.2.1</span>Example Context
                    extension</a
                  >
                </li>
              </ol>
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#authorization-graph" class="tocxref"
            ><span class="secno">4</span>Authorization Graph</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#access-control-resource" class="tocxref"
                ><span class="secno">4.1</span>Access Control Resource</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-access-control-resource" class="tocxref"
                    ><span class="secno">4.1.1</span>Example Access Control
                    Resource</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#access-control" class="tocxref"
                ><span class="secno">4.2</span>Access Control</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-access-control" class="tocxref"
                    ><span class="secno">4.2.1</span>Example Access Control</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#policy" class="tocxref"
                ><span class="secno">4.3</span>Policy</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-policy" class="tocxref"
                    ><span class="secno">4.3.1</span>Example Policy</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#matcher" class="tocxref"
                ><span class="secno">4.4</span>Matcher</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-matcher" class="tocxref"
                    ><span class="secno">4.4.1</span>Example Matcher</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#matcher-extensibility" class="tocxref"
                ><span class="secno">4.5</span>Matcher extensibility</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-matcher-extension" class="tocxref"
                    ><span class="secno">4.5.1</span>Example Matcher
                    extension</a
                  >
                </li>
              </ol>
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#access-grant-graph" class="tocxref"
            ><span class="secno">5</span>Access Grant Graph</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#access-grant" class="tocxref"
                ><span class="secno">5.1</span>Access Grant</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-access-grant" class="tocxref"
                    ><span class="secno">5.1.1</span>Example Access Grant</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#access-mode-extensibility" class="tocxref"
                ><span class="secno">5.2</span>Access Mode extensibility</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#example-access-mode" class="tocxref"
                    ><span class="secno">5.2.1</span>Example Access Mode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#access-control-resolution" class="tocxref"
            ><span class="secno">6</span>Access Control resolution</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#resolved-access-control" class="tocxref"
                ><span class="secno">6.1</span>Resolved Access Control</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#resolved-access-control-pseudocode" class="tocxref"
                    ><span class="secno">6.1.1</span>Resolved Access Control
                    pseudocode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#effective-policies" class="tocxref"
                ><span class="secno">6.2</span>Effective Policies</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#effective-policies-example" class="tocxref"
                    ><span class="secno">6.2.1</span>Effective Policies
                    example</a
                  >
                </li>
              </ol>
              <ol class="toc">
                <li class="tocline">
                  <a href="#effective-policies-pseudocode" class="tocxref"
                    ><span class="secno">6.2.2</span>Effective Policies
                    pseudocode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#granted-access-modes" class="tocxref"
                ><span class="secno">6.3</span>Granted Access Modes</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#granted-access-modes-example" class="tocxref"
                    ><span class="secno">6.3.1</span>Granted Access Modes
                    example</a
                  >
                </li>
              </ol>
              <ol class="toc">
                <li class="tocline">
                  <a href="#granted-access-modes-pseudocode" class="tocxref"
                    ><span class="secno">6.3.2</span>Granted Access Modes
                    pseudocode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#satisfied-policy" class="tocxref"
                ><span class="secno">6.4</span>Satisfied Policy</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#satisfied-policy-example" class="tocxref"
                    ><span class="secno">6.4.1</span>Satisfied Policy example</a
                  >
                </li>
              </ol>
              <ol class="toc">
                <li class="tocline">
                  <a href="#satisfied-policy-pseudocode" class="tocxref"
                    ><span class="secno">6.4.2</span>Satisfied Policy
                    pseudocode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#satisfied-matcher" class="tocxref"
                ><span class="secno">6.5</span>Satisfied Matcher</a
              >
              <ol class="toc">
                <li class="tocline">
                  <a href="#satisfied-matcher-example" class="tocxref"
                    ><span class="secno">6.5.1</span>Satisfied Matcher
                    example</a
                  >
                </li>
              </ol>
              <ol class="toc">
                <li class="tocline">
                  <a href="#satisfied-matcher-pseudocode" class="tocxref"
                    ><span class="secno">6.5.2</span>Satisfied Matcher
                    pseudocode</a
                  >
                </li>
              </ol>
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#server-implementation" class="tocxref"
            ><span class="secno">7</span>Server implementation</a
          >
          <ol class="toc">
            <li class="tocline">
              <a href="#conforming-resource-server" class="tocxref"
                ><span class="secno">7.1</span>Conforming resource server</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#conforming-acp-server" class="tocxref"
                ><span class="secno">7.2</span>Conforming ACP server</a
              >
            </li>
          </ol>
        </li>
        <li class="tocline">
          <a href="#acknowledgements" class="tocxref">Acknowledgements</a>
        </li>
        <li class="tocline">
          <a href="#references" class="tocxref">References</a>
          <ol class="toc">
            <li class="tocline">
              <a href="#normative-references" class="tocxref"
                >Normative references</a
              >
            </li>
          </ol>
          <ol class="toc">
            <li class="tocline">
              <a href="#informative-references" class="tocxref"
                >Informative references</a
              >
            </li>
          </ol>
        </li>
      </ol>
    </nav>
    <main>
      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":introduction"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="introduction">
          <span class="secno">1. </span><span class="content">Introduction</span
          ><a class="self-link" href="#introduction"></a>
        </h2>
        <p>
          This section introduces ACP with an overview of key terminology, an
          explanation of the conventions used in this document, example graphs
          to illustrate basic concepts of resource access description and
          validation, a diagram representing the main elements of the ACP data
          model, and an RDF representation of the ACP ontology.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":rdf-terminology"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="rdf-terminology">
            <span class="secno">1.1. </span
            ><span class="content">RDF terminology</span
            ><a class="self-link" href="#rdf-terminology"></a>
          </h3>
          <p>
            This document uses the terms
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-resource"
              ><dfn id="rdf-resource">resource</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-property"
              ><dfn id="rdf-property">property</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-rdf-vocabulary"
              ><dfn id="rdf-vocabulary">RDF vocabulary</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-namespace"
              ><dfn id="rdf-namespace">namespace</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-namespace-iri"
              ><dfn id="rdf-namespace-iri">namespace IRI</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-namespace-prefix"
              ><dfn id="rdf-namespace-prefix">namespace prefix</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-rdf-graph"
              ><dfn id="rdf-graph">graph</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-iri"
              ><dfn id="rdf-iri">IRI</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-literal"
              ><dfn id="rdf-literal">literal</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-blank-node"
              ><dfn id="rdf-blank-node">blank node</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-node"
              ><dfn id="rdf-node">node</dfn></a
            >,
            <a href="http://www.w3.org/TR/rdf11-concepts/#dfn-rdf-term"
              ><dfn id="rdf-term">term</dfn></a
            >,
            <a href="https://www.w3.org/TR/rdf11-concepts/#dfn-iri-equality"
              ><dfn id="rdf-iri-eqality">IRI equality</dfn></a
            >
            and
            <a
              href="https://www.w3.org/TR/rdf11-concepts/#dfn-literal-term-equality"
              ><dfn id="rdf-literal-term-eqality">literal term equality</dfn></a
            >
            as defined in RDF 1.1 Concepts and Abstract Syntax
            <cite
              ><a class="bibref" href="#rdf11-concepts">RDF11 CONCEPTS</a></cite
            >.
          </p>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":namespaces"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="namespaces">
            <span class="secno">1.2. </span
            ><span class="content">RDF vocabularies and namespace IRIs</span
            ><a class="self-link" href="#namespaces"></a>
          </h3>
          <p>
            This document uses the following RDF vocabularies and corresponding
            namespace prefix bindings:
          </p>

          <table>
            <thead>
              <tr>
                <th>Prefix</th>
                <th>Namespace</th>
              </tr>
            </thead>
            <tbody>
              <tr about="acp:">
                <td>
                  <code property="vann:preferredNamespacePrefix">acp:</code>
                </td>
                <td>
                  <code
                    ><a
                      href="http://www.w3.org/ns/solid/acp#"
                      property="vann:preferredNamespaceUri"
                      >http://www.w3.org/ns/solid/acp#</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>acl:</code></td>
                <td>
                  <code
                    ><a href="http://www.w3.org/ns/auth/acl#"
                      >http://www.w3.org/ns/auth/acl#</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>ex:</code></td>
                <td>
                  <code
                    ><a href="https://example.org/"
                      >https://example.org/</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>ldp:</code></td>
                <td>
                  <code
                    ><a href="http://www.w3.org/ns/ldp#"
                      >http://www.w3.org/ns/ldp#</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>rdf:</code></td>
                <td>
                  <code
                    ><a href="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
                      >http://www.w3.org/1999/02/22-rdf-syntax-ns#</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>rdfs:</code></td>
                <td>
                  <code
                    ><a href="http://www.w3.org/2000/01/rdf-schema#"
                      >http://www.w3.org/2000/01/rdf-schema#</a
                    ></code
                  >
                </td>
              </tr>
              <tr>
                <td><code>owl:</code></td>
                <td>
                  <code
                    ><a href="http://www.w3.org/2002/07/owl#"
                      >http://www.w3.org/2002/07/owl#</a
                    ></code
                  >
                </td>
              </tr>
            </tbody>
          </table>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":acp-terminology"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="acp-terminology">
            <span class="secno">1.3. </span
            ><span class="content">ACP terminology</span
            ><a class="self-link" href="#acp-terminology"></a>
          </h3>
          <p><em>This section is non-normative.</em></p>

          <dl>
            <dt id="acp-terminology-context-graph">Context graph</dt>
            <dd>
              <a href="#context-graph">Context graphs</a> describe the
              attributes of resource access instances. An access request's
              attributes can be matched to sets of conditions defined in the
              form of an
              <a href="#acp-terminology-authorization-graph"
                >authorization graph</a
              >
              in order to determine Access Modes granted over resources.
            </dd>

            <dt id="acp-terminology-authorization-graph">
              Authorization graph
            </dt>
            <dd>
              <a href="#authorization-graph">Authorization graphs</a>
              authoritatively define the conditions for granting Access Modes
              over resources through Access Control Resources, Access Controls,
              Policies and Matchers. The result of applying an authorization
              graph to a described instance of resource access is an
              <a href="#acp-terminology-access-grant-graph"
                >access grant graph</a
              >.
            </dd>

            <dt id="acp-terminology-access-grant-graph">Access grant graph</dt>
            <dd>
              <a href="#access-grant-graph">Access grant graphs</a> describe
              sets of Access Modes granted over resources in the context of
              resource access requests. Access grants are the result of
              <a href="#acp-terminology-access-control-resolution"
                >access control resolution</a
              >.
            </dd>

            <dt id="acp-terminology-access-control-resolution">
              Access control resolution
            </dt>
            <dd>
              <a href="#access-control-resolution">Access control resolution</a>
              describes the algorithm used to apply an authorization graph to a
              context graph in order to obtain an access grant graph.
            </dd>
          </dl>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":example-graphs"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="example-graphs">
            <span class="secno">1.4. </span
            ><span class="content">Example graphs</span
            ><a class="self-link" href="#example-graphs"></a>
          </h3>
          <p><em>This section is non-normative.</em></p>

          <p>
            Throughout this document, color-coded boxes contain the RDF
            representation of example context graphs, authorization graphs, and
            access grant graphs serialized in
            <a href="https://www.w3.org/TR/turtle/"
              ><dfn id="turtle-syntax">turtle</dfn></a
            >
            <cite><a class="bibref" href="#turtle">RDF11-TURTLE</a></cite
            >. Those graphs use a mix of IRIs and blank nodes where applicable
            to better show the range of possible representations.
          </p>

          <p>
            The following example
            <a href="#acp-terminology-context-graph">context graph</a> describes
            an instance of resource access and could be translated as:
            <em
              >"Bob is trying to read resource X using client application Y with
              their identity asserted by identity provider Z."</em
            >.
          </p>

          <pre id="example-context-graph" class="example example-context-graph">
# This box contains a context graph
# It describes an instance of resource access&nbsp;&nbsp;

[]
  acp:target ex:resourceX ;
  acp:agent ex:Bob ;
  acp:mode acl:Read ;
  acp:client ex:clientApplicationY ;
  acp:issuer ex:identityProviderZ .
</pre
          >

          <p>
            The following example
            <a href="#acp-terminology-authorization-graph"
              >authorization graph</a
            >
            defines the conditions of access to resource X and could be
            translated as:
            <em
              >"Access to resource X is mandated by one Access Control that
              applies one Policy which allows access mode
              <code>acl:Read</code> when Alice or Bob are the agent trying to
              access resource X."</em
            >.
          </p>

          <pre
            id="example-authorization-graph"
            class="example example-authorization-graph"
          >
# This box contains an authorization graph
# It describes the conditions required for accessing a resource&nbsp;&nbsp;

[]
  a acp:AccessControlResource ;
  acp:resource ex:resourceX ;
  acp:accessControl [
    a acp:AccessControl ;
    acp:apply [
      a acp:Policy ;
      acp:allow acl:Read ;
      acp:anyOf [
        a acp:Matcher ;
        acp:agent ex:Alice, ex:Bob ;
      ]
    ]
  ] .
</pre
          >

          <p>
            The following example
            <a href="#acp-terminology-access-grant-graph">access grant graph</a>
            is the result of
            <a href="#acp-terminology-access-control-resolution">applying</a>
            the previous example authorization graph which defines access to
            resource X to the previous example context graph which describes a
            read access request to target resource X. Bob is matched as the
            context agent and since the policy allowing
            <code>acl:Read</code> defines no further restrictions, it is
            satisfied. The following access grant graph could be read as:
            <em
              >"The access mode <code>acl:Read</code> is granted to Bob who
              requested read access to resource X using client application Y
              with their identity asserted by identity provider Z."</em
            >.
          </p>

          <pre
            id="example-access-grant-graph"
            class="example example-access-grant-graph"
          >
# This box contains an access grant graph
# It describes in context the granted access over a resource&nbsp;&nbsp;

[]
  acp:grant acl:Read ;
  acp:context [
    acp:agent ex:Bob ;
    acp:target ex:resourceX ;
    acp:mode acl:Read ;
    acp:client ex:ClientApplicationY ;
    acp:issuer ex:IdentityProviderZ ;
  ] .
</pre
          >
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":data-model"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="data-model">
            <span class="secno">1.5. </span
            ><span class="content">Data model</span
            ><a class="self-link" href="#data-model"></a>
          </h3>
          <p><em>This section is non-normative.</em></p>
          <p>The following diagram illustrates the main elements of ACP.</p>
          <img
            alt="ACP Data Model"
            src="./2022/acp-data-model-20220518.svg"
            style="width: 100%"
          />
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":ontology"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="ontology">
            <span class="secno">1.6. </span><span class="content">Ontology</span
            ><a class="self-link" href="#ontology"></a>
          </h3>
          <p>
            All terms defined by the Access Control Policy Language are present
            in an RDF representation of the
            <a href="http://www.w3.org/ns/solid/acp#">ACP ontology serialized in turtle</a>.
          </p>
        </section>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":conformance"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="conformance">
          <span class="secno">2. </span><span class="content">Conformance</span
          ><a class="self-link" href="#conformance"></a>
        </h2>
        <p>
          All assertions, diagrams, examples, pseudocode and notes are
          non-normative, as are all sections explicitly marked non-normative.
          Everything else is normative.
        </p>

        <p id="rfc2119-conformance">
          The key words
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-1"
            ><dfn id="rfc2119-must">MUST</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-2"
            ><dfn id="rfc2119-must-not">MUST NOT</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-1"
            ><dfn id="rfc2119-required">REQUIRED</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-1"
            ><dfn id="rfc2119-shall">SHALL</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-2"
            ><dfn id="rfc2119-shall-not">SHALL NOT</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-3"
            ><dfn id="rfc2119-should">SHOULD</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-4"
            ><dfn id="rfc2119-should-not">SHOULD NOT</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-3"
            ><dfn id="rfc2119-recommended">RECOMMENDED</dfn></a
          >,
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-5"
            ><dfn id="rfc2119-may">MAY</dfn></a
          >, and
          <a href="https://datatracker.ietf.org/doc/html/rfc2119#section-5"
            ><dfn id="rfc2119-optional">OPTIONAL</dfn></a
          >, are to be interpreted as defined in
          <cite><a class="bibref" href="#rfc2119">RFC 2119</a></cite
          >.
        </p>

        <p>
          Only UPPERCASE usage of the key words defined in RFC 2119 have special
          meanings, as per
          <cite><a class="bibref" href="#rfc8174">RFC 8174</a></cite
          >.
        </p>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":context-graph"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="context-graph">
          <span class="secno">3. </span
          ><span class="content">Context Graph</span
          ><a class="self-link" href="#context-graph"></a>
        </h2>
        <p>
          This section introduces the ACP terms used to describe instances of
          resource access.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":context"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="context">
            <span class="secno">3.1. </span><span class="content">Context</span
            ><a class="self-link" href="#context"></a>
          </h3>
          <dl>
            <dt
              id="acp-Context"
              about="acp:Context"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:Context</code>
            </dt>
            <dd about="acp:Context" property="rdfs:comment">
              Instances of the <span property="rdfs:label">Context</span> class
              describe instances of resource access.
            </dd>

            <dt
              id="acp-attribute"
              about="acp:attribute"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:attribute</code>
            </dt>
            <dd about="acp:attribute" property="rdfs:comment">
              Sub-properties of ACP
              <span property="rdfs:label">attribute</span> are used to describe
              <span property="rdfs:domain" resource="acp:Context"
                >instances of resource access</span
              >.
            </dd>

            <dt
              id="acp-target"
              about="acp:target"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:target</code>
            </dt>
            <dd about="acp:target" typeof="rdfs:comment">
              The <span property="rdfs:label">target</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes
              <span property="rdfs:domain" resource="acp:AccessRequest"
                >requested resources</span
              >.
            </dd>

            <dt
              id="acp-mode"
              about="acp:mode"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:mode</code>
            </dt>
            <dd about="acp:mode" typeof="rdfs:comment">
              The <span property="rdfs:label">mode</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes requested modes of access.
            </dd>

            <dt
              id="acp-agent"
              about="acp:agent"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:agent</code>
            </dt>
            <dd about="acp:agent" typeof="rdfs:comment">
              The <span property="rdfs:label">agent</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes agents initiating requests.
            </dd>

            <dt
              id="acp-creator"
              about="acp:creator"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:creator</code>
            </dt>
            <dd about="acp:creator" typeof="rdfs:comment">
              The <span property="rdfs:label">creator</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes creators of requested resources.
            </dd>

            <dt
              id="acp-owner"
              about="acp:owner"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:owner</code>
            </dt>
            <dd about="acp:owner" typeof="rdfs:comment">
              The <span property="rdfs:label">owner</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes owners of requested resources.
            </dd>

            <dt
              id="acp-client"
              about="acp:client"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:client</code>
            </dt>
            <dd about="acp:client" typeof="rdfs:comment">
              The <span property="rdfs:label">client</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes client applications used to request resources.
            </dd>

            <dt
              id="acp-issuer"
              about="acp:issuer"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:issuer</code>
            </dt>
            <dd about="acp:issuer" typeof="rdfs:comment">
              The <span property="rdfs:label">issuer</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes identity providers used to assert the identity of agents
              requesting resources.
            </dd>

            <dt
              id="acp-vc"
              about="acp:vc"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:vc</code>
            </dt>
            <dd about="acp:vc" typeof="rdfs:comment">
              The <span property="rdfs:label">vc</span>
              <span property="rdfs:subPropertyOf" resource="acp:attribute"
                >attribute</span
              >
              describes types of Verifiable Credentials (VC) presented as part
              of resource access requests.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-context"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-context">
              <span class="secno">3.1.1. </span
              ><span class="content">Example Context</span
              ><a class="self-link" href="#example-context"></a>
            </h4>

            <p>
              The following example context graph denotes instances of resource
              access initiated by Bob.
            </p>

            <pre id="example-context-0" class="example example-context-graph">
[]
  a acp:Context ;
  acp:agent ex:Bob .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example context graph means that Bob requests access
              to resource X using client application Y and with their identity
              asserted by identity provider Z; furthermore, resource X was
              created by Alice and is owned by Bob.
            </p>

            <pre id="example-context-1" class="example example-context-graph">
ex:contextA
  acp:target ex:resourceX ;
  acp:agent ex:Bob ;
  acp:client ex:ClientApplicationY ;&nbsp;&nbsp;
  acp:issuer ex:IdentityProviderZ ;
  acp:owner ex:Bob ;
  acp:creator ex:Alice .
</pre
            >

            <p>
              The following example context graph denotes instances of resource
              access where client application X or client application Y are used
              and identity is asserted by identity provider Z.
            </p>

            <pre id="example-context-2" class="example example-context-graph">
[
  acp:client ex:ClientApplicationX, ex:ClientApplicationY ;&nbsp;&nbsp;
  acp:issuer ex:IdentityProviderZ ;
] .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":context-extensibility"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="context-extensibility">
            <span class="secno">3.2. </span
            ><span class="content">Context extensibility</span
            ><a class="self-link" href="#context-extensibility"></a>
          </h3>
          <p about="acp:attribute" property="rdfs:comment">
            Sub-properties of <code>acp:attribute</code> can be created to fit
            the specific access control requirements of applications.
          </p>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-context-extension"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-context-extension">
              <span class="secno">3.2.1. </span
              ><span class="content">Example Context extension</span
              ><a class="self-link" href="#example-context-extension"></a>
            </h4>
            <p>
              Let's imagine a property <code>ex:tag</code> defined as a an
              <code>rdfs:subPropertyOf acp:attribute</code> that would describe
              tags applied to requested resources. If such a property was
              defined, then the following example context graph would denote
              instances of resource access over resource X initiated by Bob
              where resource X was tagged <code>ex:Music</code> and
              <code>ex:FavouriteRecord</code>.
            </p>

            <pre
              id="example-context-extensibility-0"
              class="example example-context-graph"
            >
ex:contextA
  acp:target ex:resourceX ;
  acp:agent ex:Bob ;
  ex:tag ex:Music, ex:FavouriteRecord .&nbsp;&nbsp;
</pre
            >
          </section>
        </section>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":authorization-graph"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="authorization-graph">
          <span class="secno">4. </span
          ><span class="content">Authorization Graph</span
          ><a class="self-link" href="#authorization-graph"></a>
        </h2>
        <p>
          This section introduces the ACP terms used to control access to
          resources.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":access-control-resource"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="access-control-resource">
            <span class="secno">4.1. </span
            ><span class="content">Access Control Resource</span
            ><a class="self-link" href="#access-control-resource"></a>
          </h3>
          <dl>
            <dt
              id="acp-Access-Control-Resource"
              about="acp:AccessControlResource"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:AccessControlResource</code>
            </dt>
            <dd about="acp:AccessControlResource" property="rdfs:comment">
              Instances of the
              <span property="rdfs:label">Access Control Resource</span> (ACR)
              class connect resources to their Access Controls.
            </dd>

            <dt
              id="acp-resource"
              about="acp:resource"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:resource</code>
            </dt>
            <dd about="acp:resource" property="rdfs:comment">
              The <span property="rdfs:label">resource</span> property connects
              <span property="rdfs:domain" resource="acp:AccessControlResource"
                >ACRs</span
              >
              to
              <span property="rdfs:range" resource="rdfs:Resource"
                >resources</span
              >
              they control. It is the inverse of
              <code
                property="owl:inverseOf"
                resource="acp:accessControlResource"
                >acp:accessControlResource</code
              >.
            </dd>

            <dt
              id="acp-access-control"
              about="acp:accessControl"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:accessControl</code>
            </dt>
            <dd about="acp:accessControl" property="rdfs:comment">
              The <span property="rdfs:label">access control</span> property
              connects
              <span property="rdfs:domain" resource="acp:AccessControlResource"
                >ACRs</span
              >
              to
              <span property="rdfs:range" resource="acp:AccessControl"
                >Access Controls</span
              >.
            </dd>

            <dt
              id="acp-member-access-control"
              about="acp:memberAccessControl"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:memberAccessControl</code>
            </dt>
            <dd about="acp:memberAccessControl" property="rdfs:comment">
              The
              <span property="rdfs:label">member access control</span> property
              transitively connects
              <span property="rdfs:domain" resource="acp:AccessControlResource"
                >ACRs</span
              >
              of member resources to
              <span property="rdfs:range" resource="acp:AccessControl"
                >Access Controls</span
              >.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-access-control-resource"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-access-control-resource">
              <span class="secno">4.1.1. </span
              ><span class="content">Example Access Control Resource</span
              ><a class="self-link" href="#example-access-control-resource"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by both Access Controls B and C;
              furthermore, access to members of resource X is controlled by
              Access Control D; furthermore, member control is transitive,
              therefore, further members of member resources will also be
              controlled by Access Control D.
            </p>

            <pre
              id="example-access-control-resource-0"
              class="example example-authorization-graph"
            >
ex:accessControlResourceA
  acp:resource ex:resourceX ;
  acp:accessControl ex:accessControlB, ex:accessControlC ;&nbsp;&nbsp;
  acp:memberAccessControl ex:accessControlD .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":access-control"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="access-control">
            <span class="secno">4.2. </span
            ><span class="content">Access Control</span
            ><a class="self-link" href="#access-control"></a>
          </h3>
          <dl>
            <dt
              id="acp-access-control-class"
              about="acp:AccessControl"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:AccessControl</code>
            </dt>
            <dd about="acp:AccessControl" property="rdfs:comment">
              Instances of the
              <span property="rdfs:label">Access Control</span> class connect
              Access Control Resources to their Policies.
            </dd>

            <dt
              id="acp-apply"
              about="acp:apply"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:apply</code>
            </dt>
            <dd about="acp:apply" property="rdfs:comment">
              The <span property="rdfs:label">apply</span> property connects
              <span property="rdfs:domain" resource="acp:AccessControl"
                >Access Controls</span
              >
              to the
              <span property="rdfs:range" resource="acp:Policy">Policies</span>
              they apply to resources.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-access-control"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-access-control">
              <span class="secno">4.2.1. </span
              ><span class="content">Example Access Control</span
              ><a class="self-link" href="#example-access-control"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by Policy C.
            </p>

            <pre
              id="example-access-control-0"
              class="example example-authorization-graph"
            >
ex:accessControlResourceA
  acp:resource ex:resourceX ;&nbsp;&nbsp;
  acp:accessControl [
    acp:apply ex:policyC ;
  ] .
</pre
            >

            <p>
              The following two example authorization graphs both mean that
              access to resource X is controlled by Policy D and Policy E.
            </p>

            <pre
              id="example-access-control-1"
              class="example example-authorization-graph"
            >
ex:accessControlResourceA
  acp:resource ex:resourceX ;
  acp:accessControl ex:accessControlB, ex:accessControlC .&nbsp;&nbsp;

ex:accessControlB
  acp:apply ex:policyD .

ex:accessControlC
  acp:apply ex:policyE .
</pre
            >

            <pre
              id="example-access-control-2"
              class="example example-authorization-graph"
            >
[]
  acp:resource ex:resourceX ;
  acp:accessControl ex:accessControlF .&nbsp;&nbsp;

ex:accessControlF
  acp:apply ex:policyD, ex:policyE .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":policy"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="policy">
            <span class="secno">4.3. </span><span class="content">Policy</span
            ><a class="self-link" href="#policy"></a>
          </h3>
          <dl>
            <dt
              id="acp-policy"
              about="acp:Policy"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:Policy</code>
            </dt>
            <dd about="acp:Policy" property="rdfs:comment">
              Instances of the <span property="rdfs:label">Policy</span> class
              connect Access Controls to allowed and denied Access Modes as well
              as sets of Matchers describing instances of resource access.
            </dd>

            <dt
              id="acp-allow"
              about="acp:allow"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:allow</code>
            </dt>
            <dd about="acp:allow" property="rdfs:comment">
              The <span property="rdfs:label">allow</span> property connects
              <span property="rdfs:domain" resource="acp:Policy">Policies</span>
              to the
              <span property="rdfs:range" resource="acp:AccessMode"
                >Access Modes</span
              >
              they allow if satisfied.
            </dd>

            <dt
              id="acp-deny"
              about="acp:deny"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:deny</code>
            </dt>
            <dd about="acp:deny" property="rdfs:comment">
              The <span property="rdfs:label">deny</span> property connects
              <span property="rdfs:domain" resource="acp:Policy">Policies</span>
              to the
              <span property="rdfs:range" resource="acp:AccessMode"
                >Access Modes</span
              >
              they deny if satisfied.
            </dd>

            <dt
              id="acp-allOf"
              about="acp:allOf"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:allOf</code>
            </dt>
            <dd about="acp:allOf" property="rdfs:comment">
              The <span property="rdfs:label">all of</span> property connects
              <span property="rdfs:domain" resource="acp:Policy">Policies</span>
              to a set of
              <span property="rdfs:range" resource="acp:Matcher">Matchers</span>,
              all of which MUST be satisfied for the Policy to be satisfied.
            </dd>

            <dt
              id="acp-anyOf"
              about="acp:anyOf"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:anyOf</code>
            </dt>
            <dd about="acp:anyOf" property="rdfs:comment">
              The <span property="rdfs:label">any of</span> property connects
              <span property="rdfs:domain" resource="acp:Policy">Policies</span>
              to a set of
              <span property="rdfs:range" resource="acp:Matcher">Matchers</span>,
              at least one of which MUST be satisfied for the Policy to be
              satisfied.
            </dd>

            <dt
              id="acp-noneOf"
              about="acp:noneOf"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:noneOf</code>
            </dt>
            <dd about="acp:noneOf" property="rdfs:comment">
              The <span property="rdfs:label">none of</span> property connects
              <span property="rdfs:domain" resource="acp:Policy">Policies</span>
              to a set of
              <span property="rdfs:range" resource="acp:Matcher">Matchers</span>,
              all of which MUST NOT be satisfied for the Policy to be satisfied.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-policy"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-policy">
              <span class="secno">4.3.1. </span
              ><span class="content">Example Policy</span
              ><a class="self-link" href="#example-policy"></a>
            </h4>
            <p>
              The following example authorization graph means that Policy A will
              allow <code>acl:Read</code> for instances of resource access
              satisfying both Matcher B and Matcher C.
            </p>

            <pre
              id="example-policy-0"
              class="example example-authorization-graph"
            >
ex:policyA
  acp:allow acl:Read ;
  acp:allOf ex:matcherB, ex:matcherC .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that a Policy will
              deny <code>acl:Write</code> for instances of resource access
              satisfying either Matcher B or Matcher C.
            </p>

            <pre
              id="example-policy-1"
              class="example example-authorization-graph"
            >
[]
  acp:deny acl:Write ;
  acp:anyOf ex:matcherB, ex:matcherC .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that reading and
              writing resource X will be allowed for instances of resource
              access satisfying Matcher A and not Matcher B.
            </p>

            <pre
              id="example-policy-2"
              class="example example-authorization-graph"
            >
[
  acp:resource ex:resourceX ;
  acp:accessControl [
    acp:apply [
      acp:allow acl:Read, acl:Write ;&nbsp;&nbsp;
      acp:anyOf ex:matcherA ;
      acp:noneOf ex:matcherB ;
    ] ;
  ] ;
] .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":matcher"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="matcher">
            <span class="secno">4.4. </span><span class="content">Matcher</span
            ><a class="self-link" href="#matcher"></a>
          </h3>
          <dl>
            <dt
              id="acp-matcher"
              about="acp:Matcher"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:Matcher</code>
            </dt>
            <dd about="acp:Matcher" property="rdfs:comment">
              Instances of the <span property="rdfs:label">Matcher</span> class
              are descriptions of matching Contexts.
            </dd>

            <dt id="acp-agent-matcher">
              <a href="#acp-agent"><code>acp:agent</code></a>
            </dt>
            <dd about="acp:agent" property="rdfs:comment">
              In a Matcher, agent attributes define a set of agents, at least
              one of which MUST match the Context for the Matcher to be
              satisfied.
            </dd>

            <dt
              id="acp-public-agent"
              about="acp:PublicAgent"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual acp:AlwaysSatisfiedRestriction"
            >
              <code>acp:PublicAgent</code>
            </dt>
            <dd about="acp:PublicAgent" property="rdfs:comment">
              In a Matcher, agent attributes using the
              <span property="rdfs:label">Public Agent</span> named individual
              MUST match all Contexts.
            </dd>

            <dt
              id="acp-authenticated-agent"
              about="acp:AuthenticatedAgent"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual"
            >
              <code>acp:AuthenticatedAgent</code>
            </dt>
            <dd about="acp:AuthenticatedAgent" property="rdfs:comment">
              In a Matcher, agent attributes using the
              <span property="rdfs:label">Authenticated Agent</span> named
              individual MUST match Contexts that contain an agent.
            </dd>

            <dt
              id="acp-creator-agent"
              about="acp:CreatorAgent"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual"
            >
              <code>acp:CreatorAgent</code>
            </dt>
            <dd about="acp:CreatorAgent" property="rdfs:comment">
              In a Matcher, agent attributes using the
              <span property="rdfs:label">Creator Agent</span> named individual
              MUST match Contexts where a defined creator matches the defined
              agent.
            </dd>

            <dt
              id="acp-owner-agent"
              about="acp:OwnerAgent"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual"
            >
              <code>acp:OwnerAgent</code>
            </dt>
            <dd about="acp:OwnerAgent" property="rdfs:comment">
              In a Matcher, agent attributes using the
              <span property="rdfs:label">Owner Agent</span> named individual
              MUST match Contexts where a defined owner matches the defined
              agent.
            </dd>

            <dt id="acp-client-matcher">
              <a href="#acp-client"><code>acp:client</code></a>
            </dt>
            <dd about="acp:client" property="rdfs:comment">
              In a Matcher, client attributes define a set of clients, at least
              one of which MUST match the Context for the Matcher to be
              satisfied.
            </dd>

            <dt
              id="acp-public-client"
              about="acp:PublicClient"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual acp:AlwaysSatisfiedRestriction"
            >
              <code>acp:PublicClient</code>
            </dt>
            <dd about="acp:PublicClient" property="rdfs:comment">
              In a Matcher, client attributes using the
              <span property="rdfs:label">Public Client</span> named individual
              MUST match all Contexts.
            </dd>

            <dt id="acp-issuer-matcher">
              <a href="#acp-issuer"><code>acp:issuer</code></a>
            </dt>
            <dd about="acp:issuer" property="rdfs:comment">
              In a Matcher, issuer attributes define a set of issuers, at least
              one of which MUST match the Context for the Matcher to be
              satisfied.
            </dd>

            <dt
              id="acp-public-issuer"
              about="acp:PublicIssuer"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="owl:NamedIndividual acp:AlwaysSatisfiedRestriction"
            >
              <code>acp:PublicIssuer</code>
            </dt>
            <dd about="acp:PublicIssuer" property="rdfs:comment">
              In a Matcher, issuer attributes using the
              <span property="rdfs:label">Public Issuer</span> named individual
              MUST match all Contexts.
            </dd>

            <dt id="acp-vc-matcher">
              <a href="#acp-vc"><code>acp:vc</code></a>
            </dt>
            <dd about="acp:vc" property="rdfs:comment">
              In a Matcher, vc attributes define a set of
              <a
                rel="cito:citesAsAuthority"
                href="https://www.w3.org/TR/vc-data-model/#dfn-type"
                ><dfn id="vc-type">types</dfn></a
              >
              of
              <a
                rel="cito:citesAsAuthority"
                href="https://www.w3.org/TR/vc-data-model/"
                ><dfn id="verifiable-credentials"
                  >Verifiable Credentials</dfn
                ></a
              >
              (VC), at least one of which MUST match the Context for the Matcher
              to be satisfied. A VC type present in the Context MUST be a
              <a href="https://www.w3.org/TR/vc-data-model/#validation"
                ><dfn id="vc-validation">valid</dfn></a
              >
              VC
              <a href="https://www.w3.org/TR/vc-data-model/#presentations"
                ><dfn id="vc-presentation">presented</dfn></a
              >
              as part of the resource access request.
            </dd>

            <dt
              id="acp-always-satisfied-restriction"
              about="acp:AlwaysSatisfiedRestriction"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:AlwaysSatisfiedRestriction</code>
            </dt>
            <dd about="acp:AlwaysSatisfiedRestriction" property="rdfs:comment">
              Defined instances of the
              <span property="rdfs:label">Always Satisfied Restriction</span>
              class are used in Matcher restrictions to indicate that the
              restriction is always satisfied. The default behaviour of a
              Matcher is to not be satisfied, so this is the only way to make a
              Matcher always satisfied.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-matcher"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-matcher">
              <span class="secno">4.4.1. </span
              ><span class="content">Example Matcher</span
              ><a class="self-link" href="#example-matcher"></a>
            </h4>
            <p>
              The following example authorization graph means that Matcher A
              will be satisfied when either Alice or the owner of the access
              controlled resource are requesting access.
            </p>

            <pre
              id="example-matcher-0"
              class="example example-authorization-graph"
            >
ex:matcherA
  a acp:Matcher ;
  acp:agent ex:Alice, acp:OwnerAgent .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that the defined
              Matcher will be satisfied when matched against a context graph
              where the client used to access the access controlled resource is
              client B.
            </p>

            <pre
              id="example-matcher-1"
              class="example example-authorization-graph"
            >
[
  a acp:Matcher ;
  acp:client ex:clientB ;&nbsp;&nbsp;
] .
</pre
            >

            <p>
              The following example authorization graph means that Matcher A
              will be satisfied when matched against a context graph where the
              identity provider used to assert the identity of the agent
              requesting access to the access controlled resource is issuer B.
            </p>

            <pre
              id="example-matcher-2"
              class="example example-authorization-graph"
            >
ex:matcherA
  a acp:Matcher ;
  acp:issuer ex:issuerB .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that the defined
              Matcher will be satisfied when matched against a context graph
              showing that a valid VC of type credential B has been presented by
              the agent requesting access to the access controlled resource.
            </p>

            <pre
              id="example-matcher-3"
              class="example example-authorization-graph"
            >
[]
  a acp:Matcher ;
  acp:vc ex:credentialB .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that matcher A
              will be satisfied only if either Alice or Bob are the agent
              requesting resource access and their identity was asserted by
              Identity Provider B.
            </p>

            <pre
              id="example-matcher-4"
              class="example example-authorization-graph"
            >
ex:matcherA
  a acp:Matcher ;
  acp:agent ex:Bob, ex:Alice ;
  acp:issuer ex:IdentityProviderB .&nbsp;&nbsp;
</pre
            >

            <p>
              The following example authorization graph means that the defined
              matcher will be satisfied only if Alice, whose identity is
              asserted by Identity Provider B, is the agent requesting resource
              access and is doing so presenting a VC that is a valid instance of
              credential A.
            </p>

            <pre
              id="example-matcher-5"
              class="example example-authorization-graph"
            >
[
  a acp:Matcher ;
  acp:agent ex:Alice ;
  acp:issuer ex:IdentityProviderB ;&nbsp;&nbsp;
  acp:vc ex:credentialA ;
] .
</pre
            >

            <p>
              The following example authorization graph means that Policy A
              denies Read and Write access to all clients but client C and
              policy B allows read to all clients. If Policy A and B control
              access to a resource, then anyone using client C will have Read
              access to that resource.
            </p>

            <pre
              id="example-matcher-6"
              class="example example-authorization-graph"
            >
ex:policyA
  acp:deny acl:Read, acl:Write ;
  acp:anyOf [
    acp:client acp:PublicClient ;&nbsp;&nbsp;
  ] ,
  acp:noneOf [
    acp:client ex:clientC
  ] .

ex:policyB
  acp:allow acl:Read ;
  acp:anyOf [
    acp:client:PublicClient ;
  ] .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":matcher-extensibility"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="matcher-extensibility">
            <span class="secno">4.5. </span
            ><span class="content">Matcher extensibility</span
            ><a class="self-link" href="#matcher-extensibility"></a>
          </h3>
          <p about="acp:Matcher" property="rdfs:comment">
            ACP implementations supporting sub-properties of
            <code>acp:attribute</code> other than the ones defined by ACP SHOULD
            also define and implement corresponding matching algorithms.
          </p>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-matcher-extension"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-matcher-extension">
              <span class="secno">4.5.1. </span
              ><span class="content">Example Matcher extension</span
              ><a class="self-link" href="#example-matcher-extension"></a>
            </h4>
            <p>
              Given the property <code>ex:tag</code> previously defined in the
              <a href="#example-context-extension">example context extension</a>
              as a an <code>rdfs:subPropertyOf acp:attribute</code> that
              describes tags applied to requested resources; the following
              example context graph would mean that Policy 1 allows Read and is
              satisfied by instances of resource access initiated over a
              resource that was tagged <code>ex:FavouriteRecord</code> or
              <code>ex:Wishlist</code>.
            </p>

            <pre
              id="example-matcher-extension-0"
              class="example example-authorization-graph"
            >
ex:policy1
  acp:allow acl:Read ;
  acp:anyOf [
    ex:tag ex:FavouriteRecord, ex:Wishlist ;&nbsp;&nbsp;
  ] .
</pre
            >
          </section>
        </section>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":access-grant-graph"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="access-grant-graph">
          <span class="secno">5. </span
          ><span class="content">Access Grant Graph</span
          ><a class="self-link" href="#access-grant-graph"></a>
        </h2>
        <p>
          This section introduces the ACP terms used to grant access to
          resources.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":access-grant"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="access-grant">
            <span class="secno">5.1. </span
            ><span class="content">Access Grant</span
            ><a class="self-link" href="#access-grant"></a>
          </h3>
          <dl>
            <dt
              id="acp-access-grant"
              about="acp:AccessGrant"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:AccessGrant</code>
            </dt>
            <dd about="acp:AccessGrant" property="rdfs:comment">
              Instances of the
              <span property="rdfs:label">Access Grant</span> class define sets
              of Access Modes granted in particular Contexts.
            </dd>

            <dt
              id="acp-context"
              about="acp:context"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:context</code>
            </dt>
            <dd about="acp:context" property="rdfs:comment">
              The <span property="rdfs:label">context</span> property connects
              <span property="rdfs:domain" resource="acp:AccessGrant"
                >Access Grants</span
              >
              to the
              <span property="rdfs:range" resource="acp:Context">Contexts</span>
              in which they're given.
            </dd>

            <dt
              id="acp-grant"
              about="acp:grant"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdf:Property"
            >
              <code>acp:grant</code>
            </dt>
            <dd about="acp:grant" property="rdfs:comment">
              The <span property="rdfs:label">grant</span> property connects
              <span property="rdfs:domain" resource="acp:AccessGrant"
                >Access Grants</span
              >
              to the
              <span property="rdfs:range" resource="acp:AccessMode"
                >Access Modes</span
              >
              they grant.
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-access-grant"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-access-grant">
              <span class="secno">5.1.1. </span
              ><span class="content">Example Access Grant</span
              ><a class="self-link" href="#example-access-grant"></a>
            </h4>
            <p>
              The following example access grant graph means that Access Modes
              <code>acl:Read</code> and <code>acl:Write</code> have been granted
              to Alice for accessing resource X.
            </p>

            <pre
              id="example-access-grant-0"
              class="example example-access-grant-graph"
            >
[]
  acp:grant acl:Read, acl:Write ;&nbsp;&nbsp;
  acp:context [
    acp:agent ex:Alice ;
    acp:target ex:resourceX ;
  ] .
</pre
            >
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":access-mode-extensibility"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="access-mode-extensibility">
            <span class="secno">5.2. </span
            ><span class="content">Access Mode extensibility</span
            ><a class="self-link" href="#access-mode-extensibility"></a>
          </h3>
          <dl>
            <dt
              id="acp-access-mode"
              about="acp:AccessMode"
              property="rdfs:isDefinedBy"
              resource="acp:"
              typeof="rdfs:Class"
            >
              <code>acp:AccessMode</code>
            </dt>
            <dd about="acp:AccessMode" property="rdfs:comment">
              The ACP specification does not define specific Access Modes.
              Instead, any Access Mode granted is an instance of the
              <span property="rdfs:label">Access Mode</span> class. Access Modes
              and their granularity can be tailored to the needs of an
              application and Access Modes defined in other vocabularies can
              also be used (for example, instances of
              <a rel="rdfs:seeAlso" href="http://www.w3.org/ns/auth/acl#Access"
                ><dfn>ACL Access</dfn></a
              >).
            </dd>
          </dl>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":example-access-mode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="example-access-mode">
              <span class="secno">5.2.1. </span
              ><span class="content">Example Access Mode</span
              ><a class="self-link" href="#example-access-mode"></a>
            </h4>
            <p>
              The following example access grant graph means that
              <code>acl:Read</code> and <code>ex:Delete</code> are Access Modes;
              furthermore, it means that <code>acl:Read</code> and
              <code>ex:Delete</code> have been granted to Bob over resource X.
            </p>

            <pre
              id="example-access-mode-0"
              class="example example-access-grant-graph"
            >
[]
  acp:grant acl:Read, ex:Delete ;&nbsp;&nbsp;
  acp:context [
    acp:target ex:resourceX ;
    acp:agent ex:Bob ;
  ] .
</pre
            >
          </section>
        </section>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":access-control-resolution"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="access-control-resolution">
          <span class="secno">6. </span
          ><span class="content">Access Control resolution</span
          ><a class="self-link" href="#access-control-resolution"></a>
        </h2>
        <p>
          This section introduces the ACP access control resolution algorithm
          for resolving permissions to access controlled resources.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":resolved-access-control"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="resolved-access-control">
            <span class="secno">6.1. </span
            ><span class="content">Resolved Access Control</span
            ><a class="self-link" href="#resolved-access-control"></a>
          </h3>
          <p>
            An ACP engine MUST grant exactly those Access Modes allowed by
            Effective Policies.
          </p>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":resolved-access-control-pseudocode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="resolved-access-control-pseudocode">
              <span class="secno">6.1.1. </span
              ><span class="content">Resolved Access Control pseudocode</span
              ><a
                class="self-link"
                href="#resolved-access-control-pseudocode"
              ></a>
            </h4>
            <pre
              class="highlight pseudocode"
            ><code><span class="kd">function</span> <span class="nx">resolveAccessControl</span><span class="p">(</span><span class="nx">acr</span><span class="p">,</span> <span class="nx">ancestorAcrs</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="kd">const</span> <span class="nx">effectivePolicies</span> <span class="o">=</span> <span class="nx">gatherEffectivePolicies</span><span class="p">(</span><span class="nx">acr</span><span class="p">,</span> <span class="nx">ancestorAcrs</span><span class="p">)</span>
  <span class="kd">const</span> <span class="nx">allowedAccessModes</span> <span class="o">=</span> <span class="nx">grantAccessModes</span><span class="p">(</span><span class="nx">effectivePolicies</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span>
  <span class="kd">const</span> <span class="nx">grantGraph</span> <span class="o">=</span> <span class="p">{</span>
      <span class="nx">context</span><span class="p">,</span>
      <span class="na">grant</span><span class="p">:</span> <span class="nx">allowedAccessModes</span>
  <span class="p">}</span>

  <span class="k">return</span> <span class="nx">grantGraph</span>
<span class="p">}</span>
</code></pre>
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":effective-policies"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="effective-policies">
            <span class="secno">6.2. </span
            ><span class="content">Effective Policies</span
            ><a class="self-link" href="#effective-policies"></a>
          </h3>
          <p>
            Effective Policies are the Policies controlling access to a
            resource.
          </p>

          <p>A Policy MUST control access to a resource if:</p>

          <ul>
            <li>
              it is applied by an Access Control of an ACR of the resource; or,
            </li>
            <li>
              it is applied by a member Access Control of an ACR of an ancestor
              of the resource.
            </li>
          </ul>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":effective-policies-example"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="effective-policies-example">
              <span class="secno">6.2.1. </span
              ><span class="content">Effective Policies example</span
              ><a class="self-link" href="#effective-policies-example"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by both Access Controls B and C, access
              to resource X is therefore controlled by Policy E and Policy F.
              The member Access Controls are not taken into account at this
              level. Member Access Control D will be included in the effective
              authorization graph of resource X's members' ACRs both as an
              Access Control and a member Access Control. Therefore, Policy G
              will be part of the set of effective Policies controlling access
              to resource X's members and transitively to further members of
              member resources.
            </p>

            <pre
              id="determining-effective-policies-example-0"
              class="example example-authorization-graph"
            >
  ex:accessControlResourceA
    acp:resource ex:X ;
    acp:accessControl ex:accessControlB, ex:accessControlC ;&nbsp;&nbsp;
    acp:memberAccessControl ex:accessControlD .

  ex:accessControlB
    acp:apply ex:PolicyE .

  ex:accessControlC
    acp:apply ex:PolicyF .

  ex:accessControlD
    acp:apply ex:PolicyG .
</pre
            >
          </section>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":effective-policies-pseudocode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="effective-policies-pseudocode">
              <span class="secno">6.2.2. </span
              ><span class="content">Effective Policies pseudocode</span
              ><a class="self-link" href="#effective-policies-pseudocode"></a>
            </h4>
            <pre
              class="highlight pseudocode"
            ><code><span class="kd">function</span> <span class="nx">gatherEffectivePolicies</span><span class="p">(</span><span class="nx">acr</span><span class="p">,</span> <span class="nx">ancestorAcrs</span><span class="p">)</span> <span class="p">{</span>
  <span class="kd">const</span> <span class="nx">effectivePolicies</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Set</span>

  <span class="c1">// Direct access controls of own ACR.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">accessControl</span> <span class="k">of</span> <span class="nx">acr</span><span class="p">.</span><span class="nx">accessControls</span><span class="p">)</span>
      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">policy</span> <span class="k">of</span> <span class="nx">accessControl</span><span class="p">.</span><span class="nx">appliedPolicies</span><span class="p">)</span>
          <span class="nx">effectivePolicies</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="nx">policy</span><span class="p">)</span>

  <span class="c1">// Member access controls of ancestor ACRs.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">acr</span> <span class="k">of</span> <span class="nx">ancestorAcrs</span><span class="p">)</span>
      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">accessControl</span> <span class="k">of</span> <span class="nx">acr</span><span class="p">.</span><span class="nx">memberAccessControls</span><span class="p">)</span>
          <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">policy</span> <span class="k">of</span> <span class="nx">accessControl</span><span class="p">.</span><span class="nx">appliedPolicies</span><span class="p">)</span>
              <span class="nx">effectivePolicies</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="nx">policy</span><span class="p">)</span>

  <span class="k">return</span> <span class="nx">effectivePolicies</span>
<span class="p">}</span>
</code></pre>
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":granted-access-modes"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="granted-access-modes">
            <span class="secno">6.3. </span
            ><span class="content">Granted Access Modes</span
            ><a class="self-link" href="#granted-access-modes"></a>
          </h3>
          <div about="acp:Policy" property="rdfs:comment">
            <p>
              An Access Mode MUST be granted if and only if in the set of
              Effective Policies:
            </p>
            <ul>
              <li>a satisfied policy allows the Access Mode; and,</li>
              <li>no satisfied policy denies it.</li>
            </ul>
          </div>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":granted-access-modes-example"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="granted-access-modes-example">
              <span class="secno">6.3.1. </span
              ><span class="content">Granted Access Modes example</span
              ><a class="self-link" href="#granted-access-modes-example"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by Policy B and Policy C. Depending on
              the satisfaction of Policies B and C, different access modes will
              be granted.
            </p>
            <ul>
              <li>
                If only Policy B is satisfied, then Access Modes
                <code>acl:Read</code> and <code>acl:Write</code> will be
                granted.
              </li>
              <li>
                If both Policy B and Policy C are satisfied, then only Access
                Mode <code>acl:Read</code> will be granted.
              </li>
              <li>
                If only Policy C is satisfied, then no Access Mode will be
                granted.
              </li>
            </ul>

            <pre
              id="granting-access-example-0"
              class="example example-authorization-graph"
            >
[
  acp:resource ex:X ;
  acp:accessControl [
    acp:apply ex:policyB, ex:policyC ;&nbsp;&nbsp;
  ]
] .

ex:policyB
  acp:allow acl:Read, acl:Write .

ex:policyC
  acp:deny acl:Write .
</pre
            >
          </section>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":granted-access-modes-pseudocode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="granted-access-modes-pseudocode">
              <span class="secno">6.3.2. </span
              ><span class="content">Granted Access Modes pseudocode</span
              ><a class="self-link" href="#granted-access-modes-pseudocode"></a>
            </h4>
            <pre
              class="highlight pseudocode"
            ><code><span class="kd">function</span> <span class="nx">grantAccessModes</span><span class="p">(</span><span class="nx">policies</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="kd">const</span> <span class="nx">allowedAccessModes</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Set</span><span class="p">,</span> <span class="nx">deniedAccessModes</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Set</span>

  <span class="c1">// Gather allowed and denied access modes from satisfied policies</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">policy</span> <span class="k">of</span> <span class="nx">policies</span><span class="p">)</span>
      <span class="k">if</span> <span class="p">(</span><span class="nx">isSatisfiedPolicy</span><span class="p">(</span><span class="nx">policy</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span> <span class="p">{</span>
          <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">mode</span> <span class="k">of</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">allowedAccessModes</span><span class="p">)</span>
              <span class="nx">allowedAccessModes</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="nx">mode</span><span class="p">)</span>

          <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">mode</span> <span class="k">of</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">deniedAccessModes</span><span class="p">)</span>
              <span class="nx">deniedAccessModes</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="nx">mode</span><span class="p">)</span>
      <span class="p">}</span>

  <span class="c1">// Deny overrules allow.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">mode</span> <span class="k">of</span> <span class="nx">deniedAccessModes</span><span class="p">)</span>
      <span class="nx">allowedAccessModes</span><span class="p">.</span><span class="k">delete</span><span class="p">(</span><span class="nx">mode</span><span class="p">)</span>

  <span class="k">return</span> <span class="nx">allowedAccessModes</span>
<span class="p">}</span>
</code></pre>
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":satisfied-policy"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="satisfied-policy">
            <span class="secno">6.4. </span
            ><span class="content">Satisfied Policy</span
            ><a class="self-link" href="#satisfied-policy"></a>
          </h3>
          <div about="acp:Policy" property="rdfs:comment">
            <p>A Policy MUST be satisfied if and only if:</p>
            <ul>
              <li>
                it references at least one Matcher via an
                <code>acp:allOf</code> or <code>acp:anyOf</code> property; and,
              </li>
              <li>
                all of its <code>acp:allOf</code> Matchers are satisfied; and,
              </li>
              <li>
                at least one of its <code>acp:anyOf</code> Matchers is
                satisfied; and,
              </li>
              <li>
                none of its <code>acp:noneOf</code> Matchers are satisfied.
              </li>
            </ul>
          </div>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":satisfied-policy-example"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="satisfied-policy-example">
              <span class="secno">6.4.1. </span
              ><span class="content">Satisfied Policy example</span
              ><a class="self-link" href="#satisfied-policy-example"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by Policy A. Depending on the
              satisfaction of Matchers B, C, D, E and F, Policy A will be
              satisfied or not.
            </p>
            <ul>
              <li>
                If either Matcher B or Matcher C are not satisfied, then Policy
                A will not be satisfied.
              </li>
              <li>
                If neither Matcher D nor Matcher E are satisfied, then Policy A
                will not be satisfied.
              </li>
              <li>
                If either Matcher F or Matcher G is satisfied, then Policy A
                will not be satisfied.
              </li>
              <li>
                If both Matcher B and Matcher C are satisfied, and, either
                Matcher D or Matcher E are satisfied, and, Matcher F and Matcher
                G are not satisfied, then Policy A will be satisfied.
              </li>
            </ul>

            <pre
              id="satisfying-policy-example-0"
              class="example example-authorization-graph"
            >
[
  acp:resource ex:X ;
  acp:accessControl [
    acp:apply ex:policyA ;
  ]
] .

ex:policyA
  acp:allOf ex:matcherB, ex:matcherC ;&nbsp;&nbsp;
  acp:anyOf ex:matcherD, matcherE ;
  acp:noneOf ex:matcherF, ex:matcherG .
</pre
            >
          </section>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":satisfied-policy-pseudocode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="satisfied-policy-pseudocode">
              <span class="secno">6.4.2. </span
              ><span class="content">Satisfied Policy pseudocode</span
              ><a class="self-link" href="#satisfied-policy-pseudocode"></a>
            </h4>
            <pre
              class="highlight pseudocode"
            ><code><span class="kd">function</span> <span class="nx">isSatisfiedPolicy</span><span class="p">(</span><span class="nx">policy</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="c1">// If any 'none of' matcher is satisfied then the policy is not satisfied.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">matcher</span> <span class="k">of</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">noneOfMatchers</span><span class="p">)</span>
      <span class="k">if</span> <span class="p">(</span><span class="nx">isSatisfiedMatcher</span><span class="p">(</span><span class="nx">matcher</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span>
          <span class="k">return</span> <span class="kc">false</span>

  <span class="c1">// If any 'all of' matcher is not satisfied then the policy is not satisfied.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">matcher</span> <span class="k">of</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">allOfMatchers</span><span class="p">)</span>
      <span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nx">isSatisfiedMatcher</span><span class="p">(</span><span class="nx">matcher</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span>
          <span class="k">return</span> <span class="kc">false</span>

  <span class="c1">// If any 'any of' matcher is satisfied then the policy is satisfied.</span>
  <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">matcher</span> <span class="k">of</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">anyOfMatchers</span><span class="p">)</span>
      <span class="k">if</span> <span class="p">(</span><span class="nx">isSatisfiedMatcher</span><span class="p">(</span><span class="nx">matcher</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span>
          <span class="k">return</span> <span class="kc">true</span>

  <span class="c1">// At this point there are</span>
  <span class="c1">// - no satisfied 'none of' matchers,</span>
  <span class="c1">// - no unsatisfied 'all of' matchers and</span>
  <span class="c1">// - no satisfied 'any of' matchers.</span>

  <span class="c1">// Hence, the policy is satisfied if it has</span>
  <span class="c1">// - an 'all of' condition and</span>
  <span class="c1">// - no 'any of' condition.</span>
  <span class="k">return</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">allOfMatchers</span><span class="p">.</span><span class="nx">size</span> <span class="o">!==</span> <span class="mi">0</span> <span class="o">&amp;&amp;</span> <span class="nx">policy</span><span class="p">.</span><span class="nx">anyOfMatchers</span> <span class="o">===</span> <span class="mi">0</span>
<span class="p">}</span>
</code></pre>
          </section>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":satisfied-matcher"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="satisfied-matcher">
            <span class="secno">6.5. </span
            ><span class="content">Satisfied Matcher</span
            ><a class="self-link" href="#satisfied-matcher"></a>
          </h3>
          <div about="acp:Matcher" property="rdfs:comment">
            <p>A Matcher MUST be satisfied if and only if:</p>
            <ul>
              <li>it defines at least one attribute; and,</li>
              <li>
                at least one value of each defined attribute matches the
                Context.
              </li>
            </ul>
            <p>
              ACP engines MUST match the context attributes defined by this
              specification according to IRI equality and literal term equality.
            </p>
          </div>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":satisfied-matcher-example"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="satisfied-matcher-example">
              <span class="secno">6.5.1. </span
              ><span class="content">Satisfied Matcher example</span
              ><a class="self-link" href="#satisfied-matcher-example"></a>
            </h4>
            <p>
              The following example authorization graph means that access to
              resource X is controlled by a Policy that will allow read if it is
              satisfied and be satisfied if either matcher A or matcher B or
              both are satisfied.
            </p>

            <p>Matcher A will be satisfied if:</p>

            <ul>
              <li>
                either Alice or Bob are the requesting agent or if the
                requesting agent is an owner or creator; and,
              </li>
              <li>client 1 is used by the requesting agent; and,</li>
              <li>
                issuer 2 is used by the requesting agent to assert their
                identity.
              </li>
            </ul>

            <p>Matcher B will be satisfied if:</p>

            <ul>
              <li>a valid VC of type "Family Member" is presented.</li>
            </ul>

            <pre
              id="satisfied-matcher-example-0"
              class="example example-authorization-graph"
            >
[
  acp:resource ex:X ;
  acp:accessControl [
    acp:apply [
      acp:allow acl:Read ;
      acp:anyOf ex:matcherA, ex:matcherB ;
    ]
  ]
] .

ex:matcherA
  acp:agent ex:Alice, ex:Bob, acp:CreatorAgent, acp:OwnerAgent ;&nbsp;&nbsp;
  acp:client ex:client1 ;
  acp:issuer ex:issuer2 .

ex:matcherB
  acp:vc ex:FamilyMember .
</pre
            >
          </section>

          <section
            datatype="rdf:HTML"
            typeof="bibo:Chapter"
            resource=":satisfied-matcher-pseudocode"
            property="bibo:hasPart"
          >
            <h4 class="heading" id="satisfied-matcher-pseudocode">
              <span class="secno">6.5.2. </span
              ><span class="content">Satisfied Matcher pseudocode</span
              ><a class="self-link" href="#satisfied-matcher-pseudocode"></a>
            </h4>
            <pre
              class="highlight pseudocode"
            ><code><span class="kd">function</span> <span class="nx">isSatisfiedMatcher</span><span class="p">(</span><span class="nx">matcher</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="c1">// An empty matcher is never satisfied.</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">matcher</span><span class="p">.</span><span class="nx">agents</span><span class="p">.</span><span class="nx">size</span> <span class="o">===</span> <span class="mi">0</span> <span class="o">&amp;&amp;</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">clients</span><span class="p">.</span><span class="nx">size</span> <span class="o">===</span> <span class="mi">0</span> <span class="o">&amp;&amp;</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">issuers</span><span class="p">.</span><span class="nx">size</span> <span class="o">===</span> <span class="mi">0</span> <span class="o">&amp;&amp;</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">vcs</span><span class="p">.</span><span class="nx">size</span> <span class="o">===</span> <span class="mi">0</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">false</span>

  <span class="c1">// For each attribute, if any values are defined, then at least one of them must match the context.</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">matcher</span><span class="p">.</span><span class="nx">agents</span><span class="p">.</span><span class="nx">size</span> <span class="o">!==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="kd">let</span> <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">false</span>

      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">agent</span> <span class="k">of</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">agents</span><span class="p">)</span>
          <span class="k">if</span> <span class="p">(</span><span class="nx">agentMatches</span><span class="p">(</span><span class="nx">agent</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span> <span class="p">{</span>
              <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">true</span>
              <span class="k">break</span>
          <span class="p">}</span>

      <span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nx">isMatch</span><span class="p">)</span>
          <span class="k">return</span> <span class="kc">false</span>
  <span class="p">}</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">matcher</span><span class="p">.</span><span class="nx">clients</span><span class="p">.</span><span class="nx">size</span> <span class="o">!==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="kd">let</span> <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">false</span>

      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">client</span> <span class="k">of</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">clients</span><span class="p">)</span>
          <span class="k">if</span> <span class="p">(</span><span class="nx">clientMatches</span><span class="p">(</span><span class="nx">client</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span> <span class="p">{</span>
              <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">true</span>
              <span class="k">break</span>
          <span class="p">}</span>

      <span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nx">isMatch</span><span class="p">)</span>
          <span class="k">return</span> <span class="kc">false</span>
  <span class="p">}</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">matcher</span><span class="p">.</span><span class="nx">issuers</span><span class="p">.</span><span class="nx">size</span> <span class="o">!==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="kd">let</span> <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">false</span>

      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">issuer</span> <span class="k">of</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">issuers</span><span class="p">)</span>
          <span class="k">if</span> <span class="p">(</span><span class="nx">issuerMatches</span><span class="p">(</span><span class="nx">issuer</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span> <span class="p">{</span>
              <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">true</span>
              <span class="k">break</span>
          <span class="p">}</span>

      <span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nx">isMatch</span><span class="p">)</span>
          <span class="k">return</span> <span class="kc">false</span>
  <span class="p">}</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">matcher</span><span class="p">.</span><span class="nx">vcs</span><span class="p">.</span><span class="nx">size</span> <span class="o">!==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="kd">let</span> <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">false</span>

      <span class="k">for</span> <span class="p">(</span><span class="kd">const</span> <span class="nx">vc</span> <span class="k">of</span> <span class="nx">matcher</span><span class="p">.</span><span class="nx">vcs</span><span class="p">)</span>
          <span class="k">if</span> <span class="p">(</span><span class="nx">vcMatches</span><span class="p">(</span><span class="nx">vc</span><span class="p">,</span> <span class="nx">context</span><span class="p">))</span> <span class="p">{</span>
              <span class="nx">isMatch</span> <span class="o">=</span> <span class="kc">true</span>
              <span class="k">break</span>
          <span class="p">}</span>

      <span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nx">isMatch</span><span class="p">)</span>
          <span class="k">return</span> <span class="kc">false</span>
  <span class="p">}</span>

  <span class="c1">// At this point, the matcher is satisfied because</span>
  <span class="c1">// - there was at least one defined attribute and</span>
  <span class="c1">// - at least one value of each defined attribute matched the context.</span>
  <span class="k">return</span> <span class="kc">true</span>
<span class="p">}</span>

<span class="kd">const</span> <span class="nx">publicAgent</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#PublicAgent</span><span class="dl">"</span>
<span class="kd">const</span> <span class="nx">authenticatedAgent</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#AuthenticatedAgent</span><span class="dl">"</span>
<span class="kd">const</span> <span class="nx">creatorAgent</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#CreatorAgent</span><span class="dl">"</span>
<span class="kd">const</span> <span class="nx">ownerAgent</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#OwnerAgent</span><span class="dl">"</span>
<span class="kd">function</span> <span class="nx">agentMatches</span><span class="p">(</span><span class="nx">agent</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">agent</span> <span class="o">===</span> <span class="nx">publicAgent</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">agent</span> <span class="o">===</span> <span class="nx">authenticatedAgent</span> <span class="o">&amp;&amp;</span> <span class="nx">context</span><span class="p">.</span><span class="nx">agent</span> <span class="o">!==</span> <span class="kc">null</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">agent</span> <span class="o">===</span> <span class="nx">creatorAgent</span> <span class="o">&amp;&amp;</span> <span class="nx">context</span><span class="p">.</span><span class="nx">creators</span><span class="p">.</span><span class="nx">includes</span><span class="p">(</span><span class="nx">context</span><span class="p">.</span><span class="nx">agent</span><span class="p">))</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">agent</span> <span class="o">===</span> <span class="nx">ownerAgent</span> <span class="o">&amp;&amp;</span> <span class="nx">context</span><span class="p">.</span><span class="nx">owners</span><span class="p">.</span><span class="nx">includes</span><span class="p">(</span><span class="nx">context</span><span class="p">.</span><span class="nx">agent</span><span class="p">))</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">agent</span> <span class="o">===</span> <span class="nx">context</span><span class="p">.</span><span class="nx">agent</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>
<span class="p">}</span>

<span class="kd">const</span> <span class="nx">publicClient</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#PublicClient</span><span class="dl">"</span>
<span class="kd">function</span> <span class="nx">clientMatches</span><span class="p">(</span><span class="nx">client</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">client</span> <span class="o">===</span> <span class="nx">publicClient</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">client</span> <span class="o">===</span> <span class="nx">context</span><span class="p">.</span><span class="nx">client</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>
<span class="p">}</span>

<span class="kd">const</span> <span class="nx">publicIssuer</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">https://www.w3.org/ns/solid/acp#PublicIssuer</span><span class="dl">"</span>
<span class="kd">function</span> <span class="nx">issuerMatches</span><span class="p">(</span><span class="nx">issuer</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">issuer</span> <span class="o">===</span> <span class="nx">publicIssuer</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>

  <span class="k">if</span> <span class="p">(</span><span class="nx">issuer</span> <span class="o">===</span> <span class="nx">context</span><span class="p">.</span><span class="nx">issuer</span><span class="p">)</span>
      <span class="k">return</span> <span class="kc">true</span>
<span class="p">}</span>

<span class="kd">function</span> <span class="nx">vcMatches</span><span class="p">(</span><span class="nx">vc</span><span class="p">,</span> <span class="nx">context</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">context</span><span class="p">.</span><span class="nx">vcs</span><span class="p">.</span><span class="nx">includes</span><span class="p">(</span><span class="nx">vc</span><span class="p">))</span>
      <span class="k">return</span> <span class="kc">true</span>
<span class="p">}</span>
</code></pre>
          </section>
        </section>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":server-implementation"
        property="bibo:hasPart"
      >
        <h2 class="heading" id="server-implementation">
          <span class="secno">7. </span
          ><span class="content">Server implementation</span
          ><a class="self-link" href="#server-implementation"></a>
        </h2>
        <p>
          This section introduces conforming resource server and ACP server
          requirements.
        </p>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":conforming-resource-server"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="conforming-resource-server">
            <span class="secno">7.1. </span
            ><span class="content">Conforming resource server</span
            ><a class="self-link" href="#conforming-resource-server"></a>
          </h3>
          <p>
            Conforming resource servers MUST provide ACP servers with resource
            access Contexts and MUST authorize resource access according to
            grant graphs produced by a conforming ACP server.
          </p>

          <p>
            When responding to requests targetting access controlled resources,
            conforming resource servers MUST include a <code>Link</code> header
            with the <code>rel</code> value of <code>acl</code> and controlled
            resources&apos; ACRs as the link target
            <cite><a class="bibref" href="#rfc8288">RFC 8288</a></cite
            >.
          </p>

          <p>
            Conforming resource servers MUST provide ACP servers with sufficient
            resource membership information to resolve ancestor ACRs.
          </p>
        </section>

        <section
          datatype="rdf:HTML"
          typeof="bibo:Chapter"
          resource=":conforming-acp-server"
          property="bibo:hasPart"
        >
          <h3 class="heading" id="conforming-acp-server">
            <span class="secno">7.2. </span
            ><span class="content">Conforming ACP server</span
            ><a class="self-link" href="#conforming-acp-server"></a>
          </h3>
          <p>
            When responding to requests targetting an ACR, conforming ACP
            servers MUST include a <code>Link</code> header with the
            <code>rel</code> value of <code>type</code> and the
            <code>http://www.w3.org/ns/solid/acp#AccessControlResource</code>
            IRI as the link target.
          </p>

          <p>
            When responding to OPTIONS requests targetting an ACR, conforming
            ACP servers MUST include a <code>Link</code> header for each
            supported Access Mode with the <code>rel</code> value of
            <code>http://www.w3.org/ns/solid/acp#grant</code> and the full IRI
            of the supported Access Mode as the link target.
          </p>

          <p>
            When responding to OPTIONS requests targetting an ACR, conforming
            ACP servers MUST include a <code>Link</code> header for each
            supported attribute with the <code>rel</code> value of
            <code>http://www.w3.org/ns/solid/acp#attribute</code> and the full
            IRI of the supported attribute as the link target.
          </p>

          <p>Conforming ACP engines MAY be conforming resource servers.</p>

          <p>
            The lifecycle of Access Control Resources SHOULD take into account
            the lifecycle of resources they control access to.
          </p>
        </section>
      </section>
    </main>

    <section
      datatype="rdf:HTML"
      typeof="bibo:Chapter"
      resource=":acknowledgements"
      property="bibo:hasPart"
    >
      <h2 id="acknowledgements">Acknowledgements</h2>
      <p><em>This section is non-normative.</em></p>

      <p>
        Samu Lang provided a comprehensive review of the specification as well
        as the pseudocode sections.
      </p>

      <p>
        The Solid Community Group would like to thank the following individuals
        for reviewing and providing feedback on the specification (in
        alphabetical order): Justin Bingham, Sarven Capadisli, Aaron Coburn,
        Pete Edwards, Samu Lang, Elf Pavlik, Henry Story, Ted Thibodeau Jr,
        Emmet Townsend.
      </p>
    </section>

    <section
      datatype="rdf:HTML"
      typeof="bibo:Chapter"
      resource=":references"
      property="bibo:hasPart"
    >
      <h2 id="references">References</h2>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":normative-references"
        property="bibo:hasPart"
      >
        <h3 id="normative-references">Normative references</h3>
        <dl>
          <dt id="rdf11-concepts">[RDF11-CONCEPTS]</dt>
          <dd>
            <a
              href="https://www.w3.org/TR/rdf11-concepts/"
              rel="cito:citesAsAuthority"
              ><cite>RDF 1.1 Concepts and Abstract Syntax</cite></a
            >. Richard Cyganiak; David Wood; Markus Lanthaler. W3C. 25 February
            2014. W3C Recommendation. URL:
            <a href="https://www.w3.org/TR/rdf11-concepts/"
              >https://www.w3.org/TR/rdf11-concepts/</a
            >.
          </dd>

          <dt id="rfc2119">[RFC2119]</dt>
          <dd>
            <a
              href="https://www.rfc-editor.org/info/rfc2119"
              rel="cito:citesAsAuthority"
              ><cite
                >Key words for use in RFCs to Indicate Requirement Levels</cite
              ></a
            >. S. Bradner. IETF. March 1997. Best Current Practice. URL:
            <a href="https://datatracker.ietf.org/doc/html/rfc2119"
              >https://datatracker.ietf.org/doc/html/rfc2119</a
            >.
          </dd>

          <dt id="rfc8174">[RFC8174]</dt>
          <dd>
            <a
              href="https://www.rfc-editor.org/info/rfc8174"
              rel="cito:citesAsAuthority"
              ><cite
                >Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</cite
              ></a
            >. B. Leiba. IETF. May 2017. Best Current Practice. URL:
            <a href="https://datatracker.ietf.org/doc/html/rfc8174"
              >https://datatracker.ietf.org/doc/html/rfc8174</a
            >.
          </dd>

          <dt id="rfc8288">[RFC8288]</dt>
          <dd>
            <a
              href="https://www.rfc-editor.org/info/rfc8288"
              rel="cito:citesAsAuthority"
              ><cite>Web Linking</cite></a
            >. B. Leiba. IETF. October 2017. Proposed Standard. URL:
            <a href="https://datatracker.ietf.org/doc/html/rfc8288"
              >https://datatracker.ietf.org/doc/html/rfc8288</a
            >.
          </dd>

          <dt id="vc-data-model">[VC-DATA-MODEL]</dt>
          <dd>
            <a
              href="https://www.w3.org/TR/vc-data-model/"
              rel="cito:citesAsAuthority"
              ><cite>VC Data Model</cite></a
            >. Manu Sporny; Grant Noble; Dave Longley; Daniel C. Burnett; Brent
            Zundel; Kyle Den Hartog. W3C. 3 March 2022. W3C Recommendation. URL:
            <a href="https://www.w3.org/TR/vc-data-model/"
              >https://www.w3.org/TR/vc-data-model/</a
            >.
          </dd>
        </dl>
      </section>

      <section
        datatype="rdf:HTML"
        typeof="bibo:Chapter"
        resource=":informative-references"
        property="bibo:hasPart"
      >
        <h3 id="informative-references">Informative references</h3>
        <dl>
          <dt id="turtle">[RDF11-TURTLE]</dt>
          <dd>
            <a href="https://www.w3.org/TR/turtle/" rel="rdfs:seeAlso"
              ><cite>RDF 1.1 Turtle</cite></a
            >. Eric Prud'hommeaux; Gavin Carothers. W3C. 25 February 2014. W3C
            Recommendation. URL:
            <a href="https://www.w3.org/TR/turtle/"
              >https://www.w3.org/TR/turtle/</a
            >.
          </dd>
        </dl>
      </section>
    </section>

    <p role="navigation" id="back-to-top">
      <a href="#table-of-contents"><abbr title="Back to top">↑</abbr></a>
    </p>

    <script src="https://www.w3.org/scripts/TR/2021/fixup.js"></script>
  </body>
</html>