Flow: Data Access and Download Status: discovery, grant authoring, OpenFGA projection, query APIs, and file access paths are Partially implemented . Composite OPA evaluation and carried obligations are Planned .
data_access · discover, authorize, enforce, audit 01 / 08 ← →
A consumer discovers a resource, obtains a grant, and the grant is projected through RabbitMQ. The gateway requests a composite authorization decision and sends a carried decision to the Data Plane. The Data Plane validates and enforces filters or masks, delivers data, and emits audit events. discover metadata obtain grant policy event projection query / download composite decision carried obligations filtered result / scoped object audit event Consumer discover · request · use Catalogue resource + access modes Policy Service grant + outbox IMPLEMENTED RabbitMQ versioned events Authorization OpenFGA + planned OPA PARTIAL Gateway / app PEP resolve · decide · carry PARTIAL Data executor verify · filter · deliver PARTIAL Audit Service decision + outcome
01 Discover the resource The consumer searches approved Catalogue metadata and selects a resource and access mode such as API, file, OGC, or subscription.
02 Obtain entitlement The consumer receives an explicit grant through provider approval or a successful marketplace purchase. Authentication alone is not entitlement.
03 Grant is recorded and projected The Policy Service commits the grant and outbox fact together. RabbitMQ carries it to the Authorization Service, which updates durable grant and relationship projections.
04 Consumer requests data The consumer calls the gateway using the resource operation selected from the Catalogue: NGSI-LD, OGC, file download, or subscription.
05 Composite authorization decides The PEP asks dx-authz-go. OpenFGA checks relationships; OPA evaluates context and selects filters, field rules, quota, and audit obligations. Any error or unknown state denies.
06 Decision travels to the data service The gateway forwards an integrity-protected decision bound to subject, operation, resource, organization, revisions, and validity. The data service does not call the PDP again.
07 Data service enforces and delivers The service verifies the decision, applies ownership and organization predicates, translates typed filters and masks, accounts quota, and returns only the allowed rows, fields, features, or objects.
08 Access is observable and revocable The request and decision share trace, grant, and decision IDs. Revocation overrides cached allows; the next decision denies and asynchronous projection cleanup follows.
Access-mode specifics
NGSI-LD/OGC: row and field obligations compile into parameterized, allowlisted Elasticsearch/PostGIS queries.Files: object metadata is resolved by owner/databank before presigning; URLs are short-lived and scoped to one object/action.Subscriptions: creation and ongoing delivery follow the subscription's authorization and revocation policy.Marketplace: purchase creates an ordinary Policy Service grant; data services do not recognize a separate payment bypass.
Failure and recovery
New grants remain denied until projection completes. A denied or stale decision, unsupported filter/mask, store outage, quota outage, or ownership mismatch produces no partial result. Projection lag, outbox/DLQ depth, decision failure, and obligation-translation failures are monitored and reconciled.