The impact of laws in Requirement Engineering has increasingly drawn attention to new methodologies and techniques that address the problem of aligning a set of requirements with applicable norms. Goal models have long provided a lightweight approach for the representation and analysis of requirements. This paper presents ongoing work for evaluating the compliance of a goal model with applicable laws.
Software systems have been increasingly gained the attention of governments and enterprises for the risks they pose in case of mishap. This attention often translates into a rapidly growing body of laws (and/or regulations) that these systems must comply with to alleviate | or at least minimize | risk. Given such a setting, new systems must be designed with an eye to applicable laws that the systems must comply with. Moreover, for every new or amended law, every relevant legacy system must be revisited to ensure that it complies, or amended accordingly. A new challenge for software engineers then is to understand the various ways systems can meet user needs while at the same time complying with applicable laws.
In previous work we have introduced Nomos 2, a conceptual modelling language for laws that supports formal reasoning about alternative ways to comply with them. Nomos 2 relies on the intuition that laws generally establish norms (i.e., duties and rights), but also the context in which these norms apply, their preconditions, exceptions and logical inter-connections. We are currently working on Nomos 3, an extension of Nomos 2 that introduces the concepts of goal (for modelling requirements) and roles for modelling both social roles (e.g., a manager, a professor) and legal ones (e.g., a data processor for a privacy law). The main objective of this progress report is to sketch the main ingredients of Nomos 3. We show how to link models of the requirements (i*) with model of the law, and o er a glimpse of the types of reasoning it needs to support in order to establish compliance of goals relative to a set of applicable laws.
The rest of the position paper is structured as follows. Section 2 presents the Nomos 3 language and its concepts. In section 3 and 4 we show the capabilities of Nomos 3 in evaluating the compliance of goals with some norms.
Nomos 3 [
The Nomos 3 framework consists in a conceptual modelling language and a reasoning technique. The language relies on the concepts of Situation, Legal Role and Norm to represent the legal model; also it has the concepts of Situation, Social Role and Goal to represent the domain model. Relationship among these concepts allow us to give semantics to a Nomos 3 model and to reason about compliance of requirements.
Situation. A Situation represents a state-of-a airs of the world. In Nomos 3 this
concept is used to represent the conditions that make a norm applicable/satis ed,
and the state of the world brought about by satis ed goals. For example, the
situation \Personal data are treated" is a situation, which makes applicable the
duty for the person treating the data to notify the data-owner about modi cation
to its data. When a Goal like \Annotate students presence at school" is satis ed,
the Situation \Students presence is annotated" holds. A Situation is associated
to a satisfaction value (ST = Situation is satis ed; SF = Situation is not satis ed;
SU = it is unknown if the Situation is satis ed) which depends on the values
propagated by relationships in the model or on the scenario evaluated (e.g., a
set of satis ed goals in the domain brings about a set of Situations).
Roles. In Nomos 3 we distinguish 2 types of Roles. Social Roles are used to
model the roles existing in the domain where the requirements are de ned, and
are modelled using the same concept of Role as in i* [
Norm. A Norm is de ned as a 5 tuple (t, hol, cnt, ant, cons). t represents the type of the norm (Duty/Right); the holder (hol) is the Legal Role who is responsible to satisfy the Norm consequent; the counterpart (cnt) is the optional Legal Role whose interests are helped if the Norm is satis ed; the antecedent (ant) are the conditions to make the norm applicable; the consequent (cons) are the conditions to comply with the Norm. Holder and counterpart are modeled in terms of Legal Roles, while antecedent and consequent are modeled in terms of Situations. In Nomos 3 the compliance of a Norm depends on 3 factors: its applicability, its satis ability and the ful llment of responsibilities of the Role. The compliance value of a Norm can be as follows: { Compliant: when a norm is applicable (i.e. the Situations in the antecedent are satis ed), is satis ed (the Situations in the consequent are satis ed), and the holder of the norm has ful lled its responsibilities. { Accidentally compliant: when a norm is applicable, satis ed, but the holder has not ful lled its responsibilities (or it is unknown). The idea of \accidental" compliance is that it allows us to identify cases in which the right situations are brought about, but the Legal Role is not necessarily ful lled. { Tolerance: when a norm is not applicable but it is satis ed and the holder is ful lled; when a right is applicable and not satis ed/unknown satisfaction. { Non-compliant: when a duty applies but it is not satis ed/unknown satisfaction.
{ Inconclusive: when it is unknown whether the norm applies or not. Goals. Goals are used to represent the requirements expressed by the Social Roles. Nomos 3 evaluates the compliance of a given goal by taking into account: (i) the Role and its associated goals, and (ii) the Situations that are brought about in the world when the Goal is achieved. The Role to which goals are associated, is the Social Role. A set of Situations, in conjunction or disjunction, represents the consequence of the achievement of the Goal. For example \Evaluate students mid-term tests" represents a Goal desired by the Social Role \Teacher". The Situations \Tests are evaluated" and \Tests are performed at mid-term" are read as the Situations brought about when the Goal is achieved, as well as the Situations that need to be satis ed in order to say that the Goal is achieved. This latter reading allows us to read the responsibility of the \Teacher" as being assigned/allocated the Situations satisfying the Goal. 3
Relationships in Nomos 3 allow to propagate values and evaluate compliance to norms and ful lment of role responsibilities. For example, Figure 1 shows a (part of) goal model that represents the goals of a Teacher; also, the gure contains iStar ...
...
...
sr1 holds Nòmos 3
Notify tests results to students Update students records reserved Update g2 students records Notify tests results to students g1 y itf s a s y itf s a s Teacher
are available
Final results are
publicly available
atisfy
s
a Nomos 3 model representing the duties associated to the Teacher role. The
model is used to evaluate the compliance of the Teacher goals with some norms
regarding the noti cation and publication of students results. We present the
relationships of our language together with the illustration of the example.
{ hold is a relation from a Legal Role to a Norm representing the fact that
the Role is responsible for the Situations in the consequent of that Norm.
This relationship is also from a Social-Role to a Goal and represents the fact
that the Social Role is responsible for the Situations that satisfy the Goal.
For example in gure 1, the Role having the two Goals is represented by
the hold relationship between the Social Role \Teacher" and the two Goals
g1; g2. The intuition is that when the Teacher has ful lled its responsibility,
then the Situations satisfying the Goals are satis ed.
{ satisfy/break are relationships between Situations: when the source Situation
is satis ed, the target Situations is satis ed (resp. not-satis ed for break ).
For example, when \Data concern students' test result" is satis ed, the
Situation \Scholarly data are managed" is also satis ed (s3 satisf!y s7). This
relationship is used from Situation to Norm/Goal, to represent that when
the source Situations are satis ed, the Norm's consequent/Goal is/is-not
satis ed. For example, when \Data on student record is updated" and \Data
Concern students' test results" hold, then the Goal g2 is satis ed (s4 and
s3 satisf!y g2). When \Student full record is disclosed" holds, the duty to not
disclose the full record of a student is not satis ed (s10 brea!k D1).
{ activate/block are relationships between Situations: when the source
Situation is satis ed, the Situations antecedent of the Norm are Satis ed (resp.
not-satis ed for block ). For example, when \Scholarly data are managed"
holds, the three duties on disclosure of students record and test results are
applicable (s7 activat!e D1, s7 activat!e D2, s7 activat!e D3)
{ reserved is a relationship from a Situation to a Role identifying that the
Situation can only be brought about by that speci c Role (i.e., the speci ed
role is the only responsible for bringing about the situation). The idea behind
is that compliance is often strictly related to who satis es a norm, so we need
to represent cases in which it is necessary that a speci c role. For example,
when the consent for data treatment is needed, only the legal role of Data
Subject (the Subject whom the data belong) can express a consent for its
data. The legal role managing the data (Data Processor) is the only one who
can actually manage and process the data (s7 reserve!d lr1). Similarly, in a
goal model, we may need to represent that some Situations like \Data on
student record is updated" can only be brought about by the Social Role of
the \Teacher" (s4 reserve!d rs1)
Nomos 3 inherits from Nomos 2 three relationships between Norms (Imply/
Derogate/ Endorse) to model legal variability [
The concepts in Nomos 3 allow us to model and reason over a model of the law, while o ering concepts for representing and talking about requirements. The link between i* and Nomos 3 comes therefore from the expression of i* concepts (such as a Role wanting a Goal) in terms of Nomos 3 concepts and the relationships between them (e.g., the Social Role responsible for some Situations, Situations brought about when a Goal is achieved, . . . ).
Compliance to norms in Nomos 3 is evaluated by means of inference
reasoning. Initial values are assigned to input nodes of the model and the values are
propagated across the model according to the semantics of relations. Input nodes
are situations, which are observed or hypothesized to be satis ed (i.e., the state
of a air that they represent holds), false (the state of a air that they represent
does not hold) or unde ned (it is not known whether the state of a airs that
they represent holds or not). In the end, norms and roles will also receive
values, and from the evaluation of such values a general compliance assessment is
formulated. In particular, compliance evaluation involves: (a) the identi cation
of applicable Norms (Situations that satisfy the antecedent of Norms); (b)
satis ed Norms (Norms which consequent is satis ed); and (c) Legal Roles, who
have ful lled their responsibilities (Situations assigned to Roles). The general
compliance condition consists in having all the norms complied with, and all the
roles ful lling their responsibilities. A Nomos 3 model can be queried by means
of forward or backward analysis, as described in [
In this paper we have presented a modeling language, called Nomos 3, tailored for evaluating compliance of a set of requirements | represented by means of Goals | to a fragment of law | represented by means of Norms and Situations. We have described the main concepts and relations of our language with an example related to the compliance of a set of i* goals with a given law. Currently, our models are generated manually, so part of our current research investigates the possibility to develop a tool-supported methodology for the semi-automatic generation of Nomos 3 models from natural language regulatory texts. Also, a signi cant part of our future work concerns the management of responsibilities in an organizational setting: according to what's the role of the actor in charge of complying with a given norm or set of norms, the role must be enabled to delegate its responsibilities to others, while ensuring that the compliance condition is maintained. This will allow us to further integrate Nomos 3 with i* and goal/task-delegations between Roles. Ongoing work is trying to expand our reasoning support to include questions regarding delegations of responsibilities.
This work has been supported by the ERC advanced grant 267856 \Lucretius: Foundations for Software Evolution" (April 2011 { March 2016) http://www.lucretius.eu.