Data has become a crucial resource in the digital economy, fostering initiatives for secure and sovereign data sharing frameworks such as Data Spaces. However, these distributed environments require fine-grained access control mechanisms that balance openness with sovereignty and security. This paper proposes an extension of the Open Digital Rights Language (ODRL) standard, the ODRL Data Spaces (ODS) profile, aimed at supporting authorization -and complementing existing authentication mechanisms- throughout the data lifecycle. Additionally, a policy execution engine is introduced to translate ODRL policies into executable formats, enabling efective enforcement. The approach is validated through a use case involving OpenFGA, demonstrating its applicability to relationship-based access control scenarios.
The European Union’s Data Spaces aim to facilitate secure, decentralized data exchange based on trust
and sovereignty. However, efective governance requires enhanced mechanisms for access and usage
control [
Nevertheless, ODRL existing vocabulary presents limitations when addressing the complex
requirements of decentralized and federated environments. This work addresses these challenges by proposing
the ODRL Data Spaces (ODS) profile, an extension specifically designed to enhance ODRL’s applicability
to cover the life cycle of a data within Data Spaces [
Moreover, as ODRL policies are not inherently executable, this paper introduces a policy execution
engine capable of compiling ODRL specifications into executable formats. The integration of these two
contributions supports the realization of sovereign and controlled data sharing within dynamic and
heterogeneous ecosystems. Additionally, this work explores how OpenFGA, an access control system,
complements ODRL by enabling usage control [
While the main focus of this work is on fine-grained authorization, we assume authentication to be handled by existing identity management solutions, such as decentralized identifiers (DIDs) or federated identity providers, which supply trusted identities for policy evaluation.
The paper is structured as follows: Section 2 presents the ODS profile, Section 3 details the execution engine and the use case with OpenFGA, and Section 4 concludes the paper.
CEUR
ceur-ws.org
The proposed ODRL Data Spaces (ODS) profile builds upon existing eforts to enable fine-grained access
control in decentralized environments. It extends the Open Access Control (OAC) profile for ODRL
[
However, while OAC and DPV enable detailed modeling of purposes and obligations related to data use, they do not explicitly define the roles, actions, and operational constraints specific to federated Data Spaces. The ODS profile addresses this gap by introducing specialized Party and Action terms tailored to common Data Space scenarios, such as diferentiated roles or operational actions like Subscribe, Retention, and Train. These additions support a clearer and more enforceable policy structure in complex data exchange environments.
Furthermore, the ODS profile is designed to complement existing Data Space architectures,
particularly those informed by standards like the International Data Spaces Association (IDSA) Information
Model [
Table 1 includes some of the main terms of the profile, along with a brief description and their alignment with the ODRL vocabulary.
While ODRL provides a robust framework for policy specification, its lack of a native execution model limits its applicability in operational environments. To address this, we propose a conceptual policy execution engine that bridges ODRL-based policies with enforcement mechanisms. The approach focuses on compiling ODRL specifications into formats suitable for relationship-based access control systems.
In our prototype, we use OpenFGA —an authorization engine inspired by Google’s Zanzibar— to demonstrate how policies expressed using the ODS profile can be translated into executable rules. OpenFGA is a modern authorization engine designed to be scalable, flexible, and easily integrated into distributed architectures. It supports access policies based on relationships between entities, making it a suitable choice for dynamic and decentralized environments. Moreover, its compatibility with federated identity providers simplifies the authentication of identities, which are mapped to relationships that drive access decisions.
Figure 1 shows the workflow for this use case according to the following process: 1. ODRL Policy Creation: The first step is to define the access policy using the ODRL language. The policy is set following the previously defined ODS profile. 2. Policy Compilation & Parsing and Analysis: Once the policy is defined in ODRL, it is fed into the policy execution engine, which is responsible for processing and transforming the policy into diferent executable formats. 3. Transformation to executable languages: The runtime uses the compiler to translate the ODRL policy into multiple languages. Among these languages, one of the generated formats is compatible with OpenFGA. Although OpenFGA supports both a DSL and a JSON to define authorization models, JSON is the executable format required by OpenFGA. 4. Store the Authorization Model: Once the JSON authorization model has been generated, it is stored in the Store. The uploaded model includes the access rules that OpenFGA will use to make authorization decisions. 5. Store the Permission Tuples: Next, the relationship tuples are written, defining the relationships between users and resources, and stored along with the authorization model in the Store. 6. Authorization Evaluation: Using the OpenFGA API, permission tuples are queried to assess whether a user has access to a specific resource. The API checks the relationships and rules defined in the authorization model to determine whether access should be granted. 7. Authorization result: Finally, OpenFGA returns a response indicating whether or not the user has the necessary permission to access the requested resource.
This work presents a novel extension of the ODRL framework through the ODS profile, enabling advanced authentication and authorization capabilities tailored to the requirements of Data Spaces. Furthermore, the development of a policy execution engine capable of translating ODRL policies into executable formats provides a practical solution for operationalizing governance mechanisms in decentralized environments.
Future research will focus on further refining the ODS profile to encompass additional aspects of
the data lifecycle [
Another relevant aspect that has not been covered in this article is the study of possible privacy leaks
derived from the use of ODRL policies. Although these policies generally do not involve the processing
of personal or sensitive data, it is crucial to point out the possibility of privacy leaks through metadata.
[
By advancing both the expressiveness and enforceability of access control policies, this work contributes to the realization of secure, sovereign, and interoperable Data Spaces.
The authors would like to acknowledge the support of the FUN4DATE (PID2022-136684OB-C22) project funded by the Spanish Agencia Estatal de Investigacion (AEI) 10.13039/501100011033, and the EUNOMIA Strategic Project: “Solutions for sovereignty, trust and security in data spaces” (C.128.23), result of the collaboration agreement signed between INCIBE and UPM. This initiative is carried out within the framework of the funds of the Recovery, Transformation and Resilience Plan, financed by the European Union (Next Generation). https://eunomia.dit.upm.es.
During the preparation of this work, the authors used Writefull-AI and DeepL in order to: Grammar and spelling check. After using these tools/services, the authors reviewed and edited the content as needed and takes full responsibility for the publication’s content.