DPP Access Control SHACL Shapes
Release: 2026-04-01
- This version:
- http://w3id.org/dpp/access-control/shapes/1.0.0
- Latest version:
- http://w3id.org/dpp/access-control/shapes
- Revision:
- 1.0.0
- Authors:
- Rahel Kebede
- Contributors:
- Bincy Veena
- Annika Moscati
- Peter Johansson
- Imports:
- DPP Access Control Ontology Module (dpp-ac core)
- Download serialization:
- License:
- Cite as:
- Rahel Kebede. DPP Access Control SHACL Shapes. Revision: 1.0.0. Retrieved from: http://w3id.org/dpp/access-control/shapes/1.0.0
Abstract
This is the SHACL shapes graph for the
DPP Access Control ontology. It defines
node and property shapes co-designed with the dpp-ac core T-Box, operating
under the Closed World Assumption. The shapes are kept separate from the OWL ontology to
prevent reasoner misinterpretation of SHACL triples.
Note: SHACL shapes are validation constraints, not OWL vocabulary terms. They are
therefore documented here as a companion artifact rather than with the WIDOCO vocabulary
template used for the dpp-ac core, roles, data-categories and GDPR modules.
Shapes overview (14 node shapes)
| Node shape | Target class | Key constraints |
|---|---|---|
PrincipalShape | dpp-ac:Principal | closed; exactly 1 hasRole (a Role); non-empty dcterms:identifier (min length 3). Violation |
AccessRequestShape | dpp-ac:AccessRequest | closed; exactly 1 each of requestedBy, requestedAction, requestedResource, requestTimestamp; requestContext recommended. Violation / Warning |
DPPResourceShape | dpp-ac:DPPResource | exactly 1 resourceSensitivity ∈ {PUBLIC, RESTRICTED, CONFIDENTIAL, STRICTLY_CONFIDENTIAL}; exactly 1 belongsToModule; exactly 1 ownedBy. Violation |
AccessPolicyShape | dpp-ac:AccessPolicy | exactly 1 appliesToRole; ≥1 odrl:permission; exactly 1 policyOwner. Violation |
AccessDecisionShape | dpp-ac:AccessDecision | exactly 1 decidesOn; decisionOutcome ∈ {GRANT, DENY, DELEGATE, PENDING}; exactly 1 decisionTimestamp. Violation |
TemporalContextShape | dpp-ac:TemporalContext | requires accessValidFrom and accessValidUntil; SPARQL constraint: accessValidUntil must be strictly after accessValidFrom. Violation |
DelegationShape | dpp-ac:Delegation | requires delegatedBy, delegatedTo, valid-from/until; delegationDepth ≤ 1 (no sub-delegation); SPARQL constraint: delegator must be the resource owner. Violation |
PurposeContextShape | dpp-ac:PurposeContext | exactly 1 declaredPurpose from the 8 GDPR-aligned purpose codes. Violation |
DataCategoryShape | dpp-data:DataCategory | ≥1 skos:prefLabel; exactly 1 resourceSensitivity from the sensitivity value set. Violation |
RoleShape | dpp-ac:Role | ≥1 skos:prefLabel. Violation |
GeographicContextShape | dpp-ac:GeographicContext | exactly 1 jurisdictionCode. Violation |
TrustContextShape | dpp-ac:TrustContext | exactly 1 trustAssuranceLevel ∈ {LOW, SUBSTANTIAL, HIGH} (eIDAS). Violation |
CertificationContextShape | dpp-ac:CertificationContext | ≥1 certificationScheme; exactly 1 boolean certificationIsValid. Violation |
AttributeConstraintShape | dpp-ac:AttributeConstraint | exactly 1 constraintAttribute; constraintOperator ∈ {EQ, NEQ, GT, LT, GTE, LTE, IN}; exactly 1 constraintValue. Violation |
The complete, authoritative definitions — including all sh:message texts,
sh:ignoredProperties and the embedded sh:sparql constraints —
are in the Turtle source.
Acknowledgments
This companion page follows the visual template produced by WIDOCO (Daniel Garijo) so that it is consistent with the vocabulary documentation generated for the other modules.