Considering the use case when organisations acquire data from third parties and must align their processing to access and usage constraints set forth by the data providers, this paper has presented three mechanisms towards interoperability and collaboration: an ontology-import mechanism for aligning proprietary concepts with standards such as DPV and ODRL, eliminating manual mapping and enabling rule propagation across class hierarchies; a bidirectional adaptor for translating ODRL to semantic attribute-based access and usage control rules; and an enhanced PDP for the semantic resolution of conflicts among the intentions and constraints of data providers and consumers. 

The mechanisms have been built upon the existing goodFlows Policy Engine. This has been driven by two key considerations. First, goodFlows provides a state-of-the-art ABAC implementation, offering a mature and sophisticated reasoning mechanism that aligns well with ODRL’s constraint-based policy expression. Although ODRL is not explicitly an ABAC model, its policy constructs and constraints allow it to represent ABAC-like rules effectively. Leveraging goodFlows reasoning capabilities was therefore an intuitive choice, ensuring robust policy evaluation. Furthermore, ODRL’s conflict resolution strategy relies on a static conflict property, thereby being insufficient for handling complex rule conflicts in dynamic environments. In real-world scenarios, contextual factors such as attributes of parties and contextual exceptions must influence access control decisions. For instance, while a general rule might prohibit data sharing outside the EU, exceptions based on cross-border agreements or emergency purposes (e.g., a public health crisis) may allow such sharing under specific conditions. Such cases require a more advanced conflict resolution mechanism that can incorporate principles such as lex specialis (specific rules override general ones), lex posterior (newer rules override older ones), and lex superior (higher authority rules override lower ones). Integrating goodFlows' reasoning capabilities with ODRL’s policy expression model enables a context-aware, dynamic, and legally grounded access and usage control system that overcomes ODRL’s inherent limitations in resolving complex policy conflicts.
