Authorisation Rule

sdg:Rule is the class of authorisation rules. A Rule is a single grant: it gives an action (sdg:grantsAction) to a role (sdg:grantsToRole) over the targets matched by a pattern (sdg:onTargetPattern). Rules are authored as blank nodes inside a sdg:PolicyDocument — see the bootstrap policy for the three rules the registry starts from.

Gate 1 of the publish pipeline evaluates every transaction against the current set of published Rules: an action is permitted when some Rule grants it to a role the submitting agent holds, for a target the pattern matches. There is no deny — policy is additive grants, and what no Rule grants is refused.

Usage

  • Instances are blank nodes in PolicyDocuments; each carries exactly one grantsAction, one grantsToRole, and one onTargetPattern.
  • Extending authorisation means publishing further PolicyDocuments — each of which is itself gated by the Rules already in force.
Authorisation Rule — Sparqdown Docs