Notifications: meta-data and link back

Data sovereignty within the BDI Framework ensures that the data owner retains full control over data access. The principle of data sovereignty mandates that control over data access always remains with the data owner. When an event occurs, the “owner” of that event and its corresponding data generates notifications. These notifications, containing only meta-data, are distributed to a selective group of entities, authorised by the owner. Included within each notification is a link that allows the recipient to request specific data directly from the original data source.

Control by data at the source

If and when a party that has received a notification follows the link back and requests data, it allows the data owner to:

• Track Access (when): Monitor which entity has requested access and when.
• Authenticate (who): Verify the identity of the requesting entity.
• Assess Trust (why): Evaluate the trustworthiness of the entity within the given context (why and if access should be granted).
• Authorize Access (What): Grant selective access to specific data elements as appropriate.
• Record Access: Log all access events for accountability and traceability.

This principle makes the distribution of notifications low-risk and effective:

• The same notifications can be distributed to very different entities with different roles
• Forwarding notifications without permission has a limited risk since limited to the information in the meta-data

Implications

The implication is that a more or less common identification, authentication, trust assessment and authorization mechanism is needed. This mechanism should integrate seamlessly with a “Zero Trust” API or interface to ensure secure and controlled data exchanges.