Passing additional Meta-Information to the PolicyEngine when the AccessPolicy is evaluated

[efiege]

Background: We would like to implement a Policy which is evaluated on the provider side, when a TransferProcess is started. This Policy should be able to access information about the DataRequest.

The evaluate method of a AtomicConstraintFunction provides the possibility to create new policy logic. The available information in the PolicyContext is however constrained. Currently it is possible to

• check the claims of an accessing connector by using the ParticipantAgent
• use the getContextData method to retrieve provisioned ResourceManifests.

It would be great if further information like the DataRequest is available. But currently I don't see a possibility for using the
DataRequest information in a Policy.

One could pass the information using the ResourceManifests, but the PolicyEngine is just invoked at the consumer side:

Connector/core/control-plane/transfer-core/src/main/java/org/eclipse/edc/connector/transfer/provision/ResourceManifestGeneratorImpl.java

Line 77 in d961153

var result = policyEngine.evaluate(MANIFEST_VERIFICATION_SCOPE, policy, null, contextInformation);

and not on the provider side:

Connector/core/control-plane/transfer-core/src/main/java/org/eclipse/edc/connector/transfer/provision/ResourceManifestGeneratorImpl.java

Line 86 in d961153

public ResourceManifest generateProviderResourceManifest(DataRequest dataRequest, DataAddress assetAddress, Policy policy) {

Furthermore this approach would only work for specific Resources.

Is there another approach for implementing this policy or could another Policy scope be added, where the PolicyEngine's evaluate method is called with additional contextInformation?

[jimmarino]

Hi, what specific use case are you trying to solve?

[efiege]

Restricting data-usage to n-times:

https://github.com/International-Data-Spaces-Association/IDS-G/blob/585fa679c8bbd40c1bb249710076b7b56df7dc4f/UsageControl/Contract/README.md?plain=1#L582

[jimmarino]

That use case appears to be associated with the contract agreement and not the data transfer or resource generation. In the new IDS specs, which we are starting to work on implementing, the Contract Agreement policy will have a target that specifies the contract agreement id. Policy checks should be made before a data transfer is created (during the request), and in the data plane. This can be done by implementing a counter using a correlation mechanism and accessing that in policy functions, which will have a reference to the Policy target attribute.

[efiege]

So there will be an interface?! ContractAgreementPolicy created in the core edc, which has access to the Contract Agreement and could be implemented by us? When is this policy evaluated? Is there an estimation when this is implemented?

Thanks!

[jimmarino]

The Policy for the contract agreement will be available at evaluation time. Based on the policy scope and target attribute, a policy function can be engaged to perform the evaluation.

We haven't yet done milestone planning but the new IDS protocol support is a high priority for many core committers.