July 2019 - WG-UMA - mailman.kantarainitiative.org

Notes from 2019-07-30 UMA business-legal telecon
by Eve Maler 06 Aug '19

06 Aug '19

(Sorry for the delay! Hmm, the table contents don't seem to be showing here, so please follow the link to see them.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-07-30 Attending: Eve, Andi, Cigdem, Nancy, Vladimir Prihodko (works at Lush Group, has implemented UMA1 there), Domenico, Colin, Tim; regrets from Lisa We examined the outputs of the ad hoc meeting of last week (in slides <https://kantarainitiative.org/confluence/download/attachments/77300164/UMA_…> form). The use cases drive the state machine. So you enter it at whatever point depending on the real-world circumstances. There's a question about which system you're interacting with in each use case. E.g., an employee system is an RS that holds hours worked, paid time off, etc., and personal data management is divided up between RS's. We may have to try this with use cases from different industries and see how it comes out. But presumably any single "run" of the UMA protocol only involves a single cohesive system that interoperates. If you're operating at the technical layer, by definition it sort of all "works out" because the protocol defines how things work, but at the policy layer, questions creep in: having multiple ROs (RRAs) is like science fiction (the multiple-worlds hypothesis [image: (smile)] ). If multiple RRAs can set policy, does one's policy override another's, or do they combine, or do they get "shares" in the policy in aggregate, or what? These could all be different use cases. We know of some common ones, like where the parents (or set of guardians) for a child have to all agree to release the medical records of a child. But we don't have to figure out how to implement this, just acknowledge that ASOs need to be free to meet the needs of their users. We could leverage a table as well for describing the states. That might be a useful way to discuss those two factors in common for a lot of the scenarios. We're not sure if there is a third dimension. Could any one resource have RRAs that have to "split" along these lines? E.g., *Joe* and *Jane* have a joint bank account. *Joe* is competent to self-manage it, but *Jane* becomes ill and wants to designate a third party, not *Joe* but her attorney *Jim*, to manage the account for her. And *then* something happens to *Jim*... It's delegation turtles all the way down. How realistic are some of these? There are legal constraints on continuing to add further and further delegates. But at some level, US laws such as RUFADAA (which is more widely adopted than ever – later Tim provided adoption status in email <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/vDl5Q3czO…>) could provide a basis for at least the first layer – or maybe as far as two layers? – of delegation to be handled at a "policy layer expressed by technical means" with UMA's help. Is "policy layer" the right name? The overall generic name has been "business-legal" but that may be too awkward. Let's continue this topic. Would it be possible to define the policies themselves to make them interoperable? To be discussed. Questions we still need to discuss as outlined in the slides: For the care scenarios, do we need a primary carer/super admin type of role or are all entities in RRA equal? Federated authorization or not? Arguably, personas of a DS and a single DS have the same identity verification risk. If personas, then ”DS” in the state machine is replaced with “persona”. The key assumption: KYC works – if that fails, all the rest fails. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2019-08-01
by Eve Maler 01 Aug '19

01 Aug '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-08-01 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-06-20 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-06-20> - IETF 105 recap and next steps - OAuth.net/2 <https://oauth.net/2/> needs UMA revision - Business-legal framework update - Nominations for chair and vice-chair - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 2

Reminder: UMA business-legal telecon tomorrow
by Eve Maler 31 Jul '19

31 Jul '19

8am PT on Tuesday at https://global.gotomeeting.com/join/857787301 Previous notes are here. Our spreadsheet is here. Trying to access this link will send me a notification to share it with you with your preferred ID, if I haven't already given you access. Agenda item: Working on our use case/design pattern calculus (with updates from last week’s ad hoc meeting) And an extra reminder that, yes, we will finally have a proper “quorate” meeting on Thursday. Stay tuned for a separate note on that. Eve Maler (sent from my iPad) | cell +1 425 345 6756

3 3

Support for legal persons within identity assurance work
by George Fletcher 18 Jul '19

18 Jul '19

Hi Umanitarians, This issue (most likely deferred post implementors-draft) is open for our OpenID Connect Identity Assurance work. https://bitbucket.org/openid/connect/issues/1097/include-legal-persons It is addressing how to support "legal persons" within this framework. Given all the work that UMA has done around "legal persons" I wanted to reach out and see if there are any suggestions/recommendations. Thanks, George

1 0

Notes from UMA business-legal telecon 2019-07-16
by Eve Maler 16 Jul '19

16 Jul '19

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… The spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> . 2019-07-16 Attending: Eve, Lisa, Domenico, Cigdem, Mark, Tim (regrets: Andi, Colin) FYI, Eve can't make IETF 105 in person after all. She may try to attend the OAuth.XYZ portion of it remotely (it's being presented on Tuesday next week). The chosen term Representative is now in the Legal Parties tab. *AI:* Tim: Develop a suitable definition for Representative, sourced to any legal sources as he sees fit (akin to how other definitions are done in the original report). What do we say about consent? We bundle a series of actions that the RRA is "authorized to delegate" to the ASO, including "access control, consent, and licensing functions". What does our repeated phrase "manages the sharing of X's resources" in our use cases? With respect to UMA, it specifically means the actions of the AS. Thinking about something like a "vault" or "wallet", UMA doesn't have a technical entity like this, though we know of at least one extension that does, so maybe this could come into play officially eventually. What is the "state" language about? It's techie language. Many of the use cases would reflect life cycle changes, as in literally a human's life cycle (connected to parties). These tend to be relatively slow and predictable in the scheme of things. Permissions might need to change in response to this. Some might be much faster and more dynamically changing, like temperature changes or associations between people that are more short-lived, like Uber rides or similar. Why is UMA itself insufficient for this relationship work? UMA-based sharing manages only what a resource owner can control. Adding the "IRM" layer enables us to capture both all the steady states where the "endpoints" aren't the ultimate "end parties", and all the transitions between steady states. So our next significant work here is to define this state machine. *AI:* Lisa and Cigdem: Press ahead on the state machine depiction approach. A "task force" will work on this and we will next meet two weeks from now. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal framework telecom tomorrow
by Eve Maler 15 Jul '19

15 Jul '19

8am PT on Tuesday at https://global.gotomeeting.com/join/857787301 Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>. Trying to access this link will send me a notification to share it with you with your preferred ID, if I haven't already given you access. Agenda item: - Working on our use case/design pattern calculus. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Canceling the July 11 UMA WG telecon / chair and vice-chair elections coming
by Eve Maler 10 Jul '19

10 Jul '19

Let’s cancel tomorrow’s meeting. I’d like us to meet post-IETF 105 (in August) in our Thursday meeting series for sure, and also to consider profiles and extensions that get submitted. If you have written such a spec or might be candidate for doing such, please expect a targeted note from me about this topic. For now, it looks like our Tuesday meeting series (business-legal) will be more consistent. If you have any questions, please let me know. Because I have an Internet outage at my house, I won’t be able to cancel tomorrow’s meeting in the official calendar for a little while yet! Also please note: The chair and vice-chair positions are coming up for (re)election. If you are a voting participant and would like to stand for one of the positions or nominate someone, please let me know. I’m going to construct an e-ballot. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

UMA business-legal telecon notes 2019-07-09
by Eve Maler 09 Jul '19

09 Jul '19

(If you want to discuss particular points, please consider starting a new email thread with a different subject line.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-07-09 Attending: Eve, Lisa, Adrian, Domenico, Andi, Thomas, Tim, Colin (regrets: Cigdem, Nancy) Eve briefly walked through the paper that she and Lisa have submitted to the IEEE ComSoc CfP <https://www.comsoc.org/publications/magazines/ieee-communications-standards…>. It's called Beyond Consent: A Right-to-Use Licensing Agreement for Mutual Agency. The argument made by the paper is that digital consent and Terms acceptance (perceived as consent) are failing and don't meet a strict definition of consent (Nancy Kim's *Consentability <https://www.amazon.com/Consentability-Consent-Nancy-S-Kim-ebook/dp/B07N45GF…>* framework is used), and using a Me2B <https://www.me2b.us/> lens (centering on the user of the digital services) shows that a licensing agreement is more appropriate. A taxonomy for license agreement contents is proposed, and some challenges are discussed. The paper points to the UMA report where a license is already proposed, but starts "earlier" in the personal data usage chain to be more comprehensive. What about consent receipts? They record the results of consent. Lisa and Eve meant to cite them in the paper and hope to have a chance to add this. Adrian discusses a link between DIDs and standards such as UMA; the link is what's called the service endpoint. The DTD standards don't talk about what the service endpoint might be. They're trying to put a personal data store there. Thomas spoke with Microsoft's Ankur Patel (who was with Preeti Rastogi) at Identiverse about the challenge of getting personal data into wallets/personal data stores. There seems to be a lack of recognition of this challenge. It should be kept in mind that the paper treats personal data permission use cases that go beyond UMA. Tim recommends removing the "IANAL" disclaimer in the paper! Lisa and Eve have both worked with many lawyers and have sourced ideas from legal experts. We started to walk through the Right-to-Use License Agreement (Figure 5 in the paper) and analyze which would already be baked into some artifact, such as the RPT, and which might need to be captured separately. For example, the digital asset, grantee (licensee), and actions, would be captured as resource ID, requesting party and client, and scopes. But other information might need to be captured in some other structure, with perhaps a link off to it that is stored in the token. If a requesting party or client received and agreed to such a license, maybe by signing it, the result might be a "receipt". Trunomi has something called a "certificate", which sounds similar, as their consent receipt. Eve will email a copy of the paper to all interested to review. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Reminder: UMA business-legal framework telecom tomorrow
by Eve Maler 08 Jul '19

08 Jul '19

8am PT at https://global.gotomeeting.com/join/857787301 Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>. Trying to access this link will send me a notification to share it with you with your preferred ID. Agenda items: - Working on our use case/design pattern calculus. - Lisa and I have submitted a relevant paper to an IEEE journal, called "Beyond Consent: A Right-to-Use Licensing Agreement for Mutual Agency"; we can walk through our draft with y'all for its UMA implications. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0