May the FORCE be with you?

Abstract

Driven by data protection laws, interest in decentralized data sharing solutions has surged in recent years. To implement these solutions efectively, usage control is essential for ensuring regulatory compliance and interoperability. The Open Digital Rights Language (ODRL) standard stands out as a potential unified language for formulating fine-grained usage control policies, which must be consistently enforced through a policy engine across every node in the decentralized network. However, how to reliably and uniformly interpret ODRL policies remains an open problem, often leaving implementers to devise their own solutions. To address this problem, this work introduces the Framework for ODRL Rule Compliance through Evaluation (FORCE), designed to assist in policy development and enhance comprehension of evaluation outputs. FORCE is built upon the ODRL Evaluator - a component rigorously tested using the ODRL Test Suite. FORCE's main contributions are i) a guide on the several specifications and pieces of software we are building to work with the current standard and to test new features for a possible future version of the standard, and ii) a Web application that acts as a playground to test these specifications and software libraries. Future work could expand FORCE to include more powerful ODRL Evaluators that can deal with conflict resolution or policy instantiation.

Keywords

• eol>Policy
• ODRL
• Usage Control

1. Introduction

To address privacy concerns arising from the usage of personal data by evolving digital technologies, the General Data Protection Regulation (GDPR) [ 1 ] was introduced as a framework to balance innovation with governance. One of its Articles highlights data portability1, which gives users the right to receive their data and request its transfer from one platform to another. Another one emphasizes the right of access2, entailing the right for users to request access to their data and, in addition, information regarding how that data is used. Conforming to these articles calls for a language that is both interoperable and reliable, ensuring systems can interpret and enforce them uniformly. Addressing the need for interoperability, the Open Digital Rights Language (ODRL) [ 2 ] serves as a versatile standard for defining semantic-based usage control policies. Unfortunately, a lack of formalisation in the standard about how to evaluate such policies results in varying interpretations and inconsistencies in policy enforcement [ 3, 4, 5, 6, 7, 8, 9 ].

To address challenges in interpreting ODRL policies, Slabbinck et al. proposed a systemic approach focused on developing interoperable policy engines [ 3 ]. They did this by introducing the Compliance Report Model, an interoperable model for the output of ODRL Evaluations, alongside an ODRL test suite for verifying implementations of ODRL Evaluators. Additionally, they provided a reference implementation of an ODRL Evaluator.

This article presents FORCE, the Framework for ODRL Rule Compliance through Evaluation, a specification and an open-source Web editor built upon the aforementioned ODRL Evaluator. The former contains a guide on how to design ODRL policies, understand ODRL evaluation and provides references to other specifications, including one about proposals for ODRL 3.0. The latter provides a live editor for inputting ODRL policies, requests, and the state of the world and it runs entirely in the browser without requiring an additional server. Furthermore, it generates machine-readable compliance reports with detailed human-readable explanations to aid user understanding. Finally, users can also load and refine test cases from the test suite to deepen their comprehension.

The remainder of the article is organized as follows: Section 2 discusses prior work on ODRL evaluation. In Section 3, we introduce the Framework for ODRL Rule Compliance through Evaluation and outline its key components. Finally, Section 4 concludes the paper.

2. Related Work

The Open Digital Rights Language (ODRL) Information Model 2.2 [ 2 ] is a W3C Recommendation to express policies. This standardisation efort to reach the aforementioned recommendation explicitly excluded access control or enforcement mechanisms [10]. Over time, however, numerous evaluators have been developed for this exact purpose: i) there is ODRL-PAP3 from the DOME-Marketplace project4, ii) the Open Digital Rights Enforcement (ODRE) Framework from Cimmino et al. [9], iii) the MOSAICrOWNpolicy engine5, iv) the MYDATA Control Technologies policy engine created by Hosseinzadeh et al. [11], v) the Prometheus-X ODRL manager6, vi) the Gaia-X Wizard Policy Decision Point (PDP)7, vii) Polival8, and finally, viii) the ODRL Evaluator from Slabbinck et al. [ 3 ]. Despite these developments, research on ODRL policy evaluation mentions a lack of evaluation semantics, thus resulting in the enforcement amongst existing evaluators not being interoperable [ 3, 4, 5, 6, 7, 8, 9 ]. As a reaction, a task force within the ODRL Community Group was formed to create the ODRL Formal Semantics specification 9 to formalise the behaviour of an ODRL Evaluator, its inputs and its outputs. Slabbinck et al. [ 3 ] contributed to this efort through introducing three contributions: The Compliance Report Model10, an interoperable vocabulary which articulates compliance with ODRL policies and the State of the World (SotW); a test suite11 for ensuring consistent policy evaluation across diferent implementations; and the ODRL Evaluator 12, an implementation that systematically evaluates policies and generates compliance reports.

2.1. ODRL extensions

In addition to the evaluation behaviour of ODRL 2.2, several research eforts aim to extend the recommendation with new features. Fornara and Colombetti propose incorporating temporal properties to model the lifecycles of permissions, obligations, and prohibitions, enabling compliance monitoring[12]. Akaichi et al. introduce variable constraints, resolved by introducing a deterministic dereferencing mechanism tied to external sources [ 5 ]. Cimmino and Fornara provide six distinct theoretical proposals, including a more generic proposal for variables in an ODRL Policy that can change over time [13]. 3ODRL-PAP: https://github.com/wistefan/odrl-pap 4DOME-Marketplace project: https://dome-marketplace.eu/ 5MOSAICrOWNpolicy policy engine: https://github.com/mosaicrown/policy-engine 6Prometheus-X ODRL manager: https://github.com/Prometheus-X-association/odrl-manager 7Gaia-X Wizard Policy Decision Point (PDP): https://wizard.lab.gaia-x.eu/policyStepper 8Polival: https://codeberg.org/elbtech/Polival 9ODRL Formal Semantics specification: https://w3c.github.io/odrl/formal-semantics 10ODRL Compliance Report Model: https://w3id.org/force/compliance-report 11Test suite Repository: https://zenodo.org/records/14290518 12ODRL Evaluator: https://w3id.org/force/evaluator Esteves et al. [14] are developing a policy instantiation specification 13 that builds on Slabbinck et al. work on the Compliance Report Model and the ODRL Evaluator [ 3 ] to create an instantiated agreement that fulfils both the requester’s and the data holder’s policies and specifies agreed conditions for data exchange. As such, there is a clear need for an experimentation platform to test and demonstrate both ODRL Evaluators and proposed extensions to the language.

3. FORCE

This section introduces the Framework for ODRL Rule Compliance through Evaluation (FORCE). The first subsection focuses on the FORCE specification, and the second discusses the FORCE web demonstrator used to explore ODRL evaluations and proposed extensions.

3.1. FORCE Specification

The FORCE specification 14 serves as a guide for the development and evaluation of ODRL policies. It elaborates how the behaviour of the ODRL Evaluator and how ODRL Evaluators in general should be tested for correct behaviour, complementing the work of Slabbinck et al. [ 3 ]. Examples are included that clarify how the ODRL Compliance Reports, the evaluation results, are produced and interpreted. Furthermore, the specification introduces a suite of specifications and tools under development, designed to support both the current ODRL standard and experimentation with ODRL 3.0 proposals.

3.2. FORCE Web Demonstrator

This section describes FORCE Web editor15, a demonstrator developed to aid the understanding of ODRL policy evaluation. This is achieved through three core features: An intuitive user interface to edit and evaluate policies, comprehensive output explanations, and a selection of scenarios to facilitate the exploration of ODRL evaluation examples.

The first feature is its intuitive design, achieved by implementing it as a Web application for evaluating ODRL policies. The ODRL Evaluator operates with three essential inputs: (i) an ODRL policy, which outlines the rules defining what access is allowed to which resource by a specific entity; (ii) an ODRL request, containing an ODRL request policy that specifies the actions a party wishes to perform; and (iii) the state of the world, which provides additional context necessary for evaluating constraints. To accommodate these, the FORCE application ofers three editable input fields. To further enhance the user experience, the application addresses the cold start problem by pre-loading an example, as illustrated in Figure 1. Evaluating over the input happens in the browser by relying on the EYE JS [15] library as the core reasoning engine of the ODRL Evaluator16.

The second feature serves to reduce the intricacies of the ODRL Compliance Report Model. The machine-readable Compliance Report describes for each policy its associated rules, the activation state, and the rationale behind that state. To enhance clarity, the web editor includes a humanreadable explanation highlighting the most important messages of the report. For example, if there is a report:PermissionReport that is report:Active, text is provided that entails that the requested action is allowed to be performed by the requesting party.

Furthermore, the demonstrator allows for showcasing a large number of handcrafted scenarios as example inputs for ODRL evaluations. For that purpose, the test cases from the test suite introduced by Slabbinck et al. [ 3 ] are reused. A specific scenario can be selected through using the dropdown menu, as shown at the top of Figure 1. When a selection is made, the inputs are dynamically fetched thanks to the index hosted in the test-suite17. 13Policy instantiation specification: https://w3id.org/force/policy-instantiation 14FORCE specification: https://w3id.org/force 15FORCE web demonstrator: https://w3id.org/force/demo 16ODRL Evaluator npm package: https://www.npmjs.com/package/odrl-evaluator 17Index of all the test cases of the test suite: https://github.com/SolidLabResearch/ODRL-Test-Suite/blob/main/data/index.ttl 3.2.1. FORCE ODRL Extensions To showcase how the FORCE Web interface can support ODRL extensions, we implemented the ODRL Dynamic Constraint extension introduced by Akaichi et al. [ 5 ]. Their approach resolves ambiguity in evaluating dynamic right operands in ODRL by introducing a new class (OperandReference) and a derefencing algorithm based on SHACL property paths18. An ODRL Constraint has two operands to which comparisons can be made with one relational operator: • Left Operand: An instance of odrl:LeftOperand, linked via odrl:leftOperand. While

ODRL defines its semantics, how to resolve its value remains unspecified 19. • Operator: A comparison operator from the odrl:Operator class. • Right Operand: Either a static value (odrl:rightOperand) or a dynamic reference (odrl:rightOperandRef that must be dereferenced at evaluation time.

The challenge lies in comparing a left operand to a dynamic value. The proposed algorithm deterministically resolves the reference using SHACL paths and a dereferenceable URL. We’ve implemented this algorithm in the ODRL Evaluator and integrated several examples in the FORCE web demonstrator for ODRL extensions20. Further implementation details and a worked-out example are provided in the ODRL 3.0 proposals specification 21. 18Property Path : https://www.w3.org/TR/shacl/#property-paths 19At the time of writing, no formal method exists to materialize left operand values. 20FORCE ODRL extension sandbox: https://w3id.org/force/demo/odrl3proposal 21FORCE ODRL 3.0 proposals: https://w3id.org/force/odrl3proposal

4. Conclusion

In this paper, we present FORCE as a set of specifications and a Web application that enhances user comprehension of ODRL policy evaluation. The Web editor enables users to create and edit ODRL policies, define requests, and configure various environment variables, all of which can be evaluated through an intuitive interface that also provides human-readable insights into compliance reports.

Through pointers to additional resources and proposals for ODRL 3.0, the FORCE specifications lay the groundwork for continued research and development. As an open-source initiative, FORCE facilitates extensibility and experimentation, enabling further research on ODRL evaluators. Future work includes addressing open challenges for ODRL, including conflict resolution, which addresses cases where multiple policies are incompatible, and policy instantiation, which involves defining the agreed-upon terms of exchange based on a set of policies and a request.

Acknowledgments

This research was funded by SolidLab Vlaanderen (Flemish Government, EWI and RRF project VV023/10) and by the imec.icon project PACSOI (HBC.2023.0752), which was co-financed by imec and VLAIO and brings together the following partners: FAQIR Foundation, FAQIR Institute, MoveUP, Byteflies, AContrario, and Ghent University – IDLab.

Declaration on Generative AI

During the preparation of this work, the author(s) used Grammarly in order to: Grammar and spelling check. After using this tool/service, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content. [8] R. Zhao, J. Zhao, Perennial Semantic Data Terms of Use for Decentralized Web, in: Proceedings of the ACM Web Conference 2024, ACM, Singapore Singapore, 2024, pp. 2238–2249. doi:10.1145/ 3589334.3645631. [9] A. Cimmino, J. Cano-Benito, R. García-Castro, Open Digital Rights Enforcement framework (ODRE): From descriptive to enforceable policies, Comput. Secur. 150 (2025). doi:10.1016/j. cose.2024.104282. [10] V. Rodríguez-Doncel, N. Roman, Towards Conformance in ODRL 3.0, in: M. Sabou, A. Harth, P. Lisena, E. Curry, B. Zhang, R. Alharbi, Y. He, G. Rehm, S. Schimmler, S. Dietze, N. Manola, A. Cimmino, N. Fornara, V. Rodríguez-Doncel, J. Domingue, A. Rettinger, D. Trilling, M. Grobelnik, C. d’Amato, V. Fionda, I. Tiddi, G. Tolomei (Eds.), Joint Proceedings of the ESWC 2025 Workshops and Tutorials, volume 3977 of CEUR Workshop Proceedings, CEUR, Portorož, Slovenia, 2025. URL: https://ceur-ws.org/Vol-3977/OPAL2025-8.pdf, iSSN: 1613-0073. [11] A. Hosseinzadeh, A. Eitel, C. Jung, A Systematic Approach toward Extracting Technically Enforceable Policies from Data Usage Control Requirements:, in: Proceedings of the 6th International Conference on Information Systems Security and Privacy, SCITEPRESS - Science and Technology Publications, Valletta, Malta, 2020, pp. 397–405. URL: http://www.scitepress.org/DigitalLibrary/ Link.aspx?doi=10.5220/0008936003970405. doi:10.5220/0008936003970405. [12] N. Fornara, M. Colombetti, Using semantic web technologies and production rules for reasoning on obligations, permissions, and prohibitions, AI Communications 32 (2019) 319–334. URL: https://doi.org/10.3233/AIC-190617, publisher: IOS Press. [13] A. Cimmino, N. Fornara, Improving ODRL 2.2: current limitations and theoretical solutions, in: M. Sabou, A. Harth, P. Lisena, E. Curry, B. Zhang, R. Alharbi, Y. He, G. Rehm, S. Schimmler, S. Dietze, N. Manola, A. Cimmino, N. Fornara, V. Rodríguez-Doncel, J. Domingue, A. Rettinger, D. Trilling, M. Grobelnik, C. d’Amato, V. Fionda, I. Tiddi, G. Tolomei (Eds.), Joint Proceedings of the ESWC 2025 Workshops and Tutorials, volume 3977 of CEUR Workshop Proceedings, CEUR, Portorož, Slovenia, 2025. URL: https://ceur-ws.org/Vol-3977/OPAL2025-6.pdf, iSSN: 1613-0073. [14] B. Esteves, R. Dedecker, W. Slabbinck, F. Pattyn, R. Verborgh, Semantic Framework for Legallyaligned Health Data Exchanges, in: M. Sabou, A. Harth, P. Lisena, E. Curry, B. Zhang, R. Alharbi, Y. He, G. Rehm, S. Schimmler, S. Dietze, N. Manola, A. Cimmino, N. Fornara, V. RodríguezDoncel, J. Domingue, A. Rettinger, D. Trilling, M. Grobelnik, C. d’Amato, V. Fionda, I. Tiddi, G. Tolomei (Eds.), Joint Proceedings of the ESWC 2025 Workshops and Tutorials, volume 3977 of CEUR Workshop Proceedings, CEUR, Portorož, Slovenia, 2025. URL: https://ceur-ws.org/Vol-3977/ OPAL2025-9.pdf, iSSN: 1613-0073. [15] J. Wright, J. D. Roo, I. Smessaert, EYE JS: A client-side reasoning engine supporting Notation3 and RDF Surfaces, in: L. Etcheverry, V. L. Garcia, F. Osborne, R. Pernisch (Eds.), Proceedings of the ISWC 2024 Posters, Demos and Industry Tracks: From Novel Ideas to Industrial Practice, volume 3828 of CEUR Workshop Proceedings, CEUR, Maryland, USA, 2024. URL: https://ceur-ws. org/Vol-3828/paper8.pdf, iSSN: 1613-0073.

References

[1] Regulation (EU) 2016 / 679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data , and repealing Directive 95 /46/EC (General Data Protection Regulation) , 2016 . URL: http://data.europa.eu/eli/reg/2016/679/oj/eng.

[2] R. Iannella , S. Villata , The Open Digital Rights Language (ODRL) , 2018 . URL: https://www.w3.org/ TR/odrl-model/.

[3] W. Slabbinck , J. Rojas Meléndez , B. Esteves , P. Colpaert , R. Verborgh , Interoperable Interpretation and Evaluation of ODRL Policies , in: E. Curry, M. Acosta , M. Poveda-Villalón , M. van Erp , A. Ojo , K. Hose , C. Shimizu , P. Lisena (Eds.), The Semantic Web , Springer Nature Switzerland, Cham, 2025 , pp. 192 - 209 . doi: 10 .1007/978-3- 031 -94578-6_ 11 .

[4] I. Akaichi , S. Kirrane , Usage Control Specification, Enforcement, and Robustness : A Survey, 2022 . URL: http://arxiv.org/abs/2203.04800. doi: 10 .48550/arXiv.2203.04800, arXiv: 2203 .04800 [cs].

[5] I. Akaichi , W. Slabbinck , J. A. Rojas , C. V. Gheluwe , G. Bozzi, P. Colpaert , R. Verborgh , S. Kirrane , Interoperable and Continuous Usage Control Enforcement in Dataspaces , in: J. Theissen-Lipp , P. Colpaert , S. K. Sowe , E. Curry , S. Decker (Eds.), Proceedings of the Second International Workshop on Semantics in Dataspaces (SDS 2024 ), volume 3705 of CEUR Workshop Proceedings , CEUR, Hersonissos, Greece, 2024 . URL: https://ceur-ws. org/ Vol- 3705 /paper10.pdf, iSSN: 1613 - 0073 .

[6] M. De Vos , S. Kirrane , J. Padget , K. Satoh , ODRL policy modelling and compliance checking , in: Rules and Reasoning : Third International Joint Conference, RuleML+ RR 2019 , Bolzano , Italy, September 16-19 , 2019 , Proceedings 3, Springer, 2019 , pp. 36 - 51 .

[7] M. G. Kebede , G. Sileno, T. Van Engers , A critical reflection on ODRL , in: International Workshop on AI Approaches to the Complexity of Legal Systems , Springer, 2018 , pp. 48 - 61 .