Add BNF Example 13 for DPP access by BirgitBoss · Pull Request #100 · admin-shell-io/aas-specs-security

BirgitBoss · 2026-08-18T13:34:08Z

added: example 13 in BNF for DPP access

ignore changes for other examples; they are in #99

+
+* the two specificAssetIds above used for selecting the AssetAdministrationShellDescriptors
+* and additionally all those specificAssetIds that are public, i.e. with externalSubjectId equal to "PUBLIC_READABLE"
+* and all specificAssetIds related to the autenticated user, i.e. those with externalSubjectId equal to the BusinessPartnerNumber" of the user


+* the two specificAssetIds above used for selecting the AssetAdministrationShellDescriptors
+* and additionally all those specificAssetIds that are public, i.e. with externalSubjectId equal to "PUBLIC_READABLE"
+* and all specificAssetIds related to the autenticated user, i.e. those with externalSubjectId equal to the BusinessPartnerNumber" of the user
+* and all specificAssetIds with name "partInstanceid"


+== EXAMPLE 13: Example for access of DPP data points
+
+Delegated acts for digital product passport distinguish between different access roles. 
+For the Battery Passport there are for example "public", "persons with legitimite interest", "Notified bodies, market surveillance authorities and the Commission" or "persons with a legitimate interest and the Commission" (see BatteryPassport-ready DataAttribute Longlist V1.3).


+"public" has the same semantics as "ANONYMOUS" in AAS.
+The "battery category" or "battery mass" for example are allowed to be accessed by the public.
+
+In contrast "DateOfPuttingIntoService" is not made available to the public but only to persons with legitimite interest.


@@ -0,0 +1,50 @@
+
+DEFOBJECTS "BatteryPassport-TechnicalData-Public-DataPoints"


+  REFERABLE $sme(*).BatteryMass
+  ...
+
+DEFOBJECTS "BatteryPassport-TechnicalData-LegitimiteInterest-DataPoints"


+  ...
+
+DEFOBJECTS "BatteryPassport-TechnicalData-LegitimiteInterest-DataPoints"
+  USEOBJECTS "BatteryPassport-TechnicalData-Public-DataPoints"


+  REFERABLE $sme(*).DateOfPuttingIntoService
+  ...
+
+ACCESSRULE:


…legitimate interest

Martin187187

The ci currently fails because it enforces that for each example there is a bnf and json. but for the newly introduced bnf example the json variant is missing.
Here is my translation to json. Note I found a bug that didnt allow objects and referables in one object. so coulnt translate it 1 to 1. I already create a bugfix pr #101:

{
  "AllAccessPermissionRules": {
    "DEFOBJECTS": [
      {
        "name": "BatteryPassport-TechnicalData-Public-DataPoints",
        "objects": [
          {
            "REFERABLE": "$sme(\"*\").BatteryCategory"
          },
          {
            "REFERABLE": "$sme(\"*\").BatteryMass"
          }
        ]
      },
      {
        "name": "BatteryPassport-TechnicalData-LegitimiteInterest-DataPoints",
        "USEOBJECTS": [
          "BatteryPassport-TechnicalData-Public-DataPoints"
        ]
      },
      {
        "name": "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update",
        "objects": []
      },
      {
        "name": "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Additional",
        "objects": [
          {
            "REFERABLE": "$sme(\"*\").DateOfPuttingIntoService"
          }
        ]
      },
      {
        "name": "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints",
        "USEOBJECTS": [
          "BatteryPassport-Nameplate-Public-DataPoints",
          "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update",
          "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Additional"
        ]
      }
    ],
    "rules": [
      {
        "ACL": {
          "ATTRIBUTES": [
            {
              "GLOBAL": "ANONYMOUS"
            }
          ],
          "RIGHTS": [
            "READ"
          ],
          "ACCESS": "ALLOW"
        },
        "USEOBJECTS": [
          "BatteryPassport-TechnicalData-Public-DataPoints"
        ],
        "FORMULA": {
          "$eq": [
            {
              "$field": "$sm#semanticId"
            },
            {
              "$strVal": "semanticId-BatteryTechnicalData"
            }
          ]
        }
      },
      {
        "ACL": {
          "ATTRIBUTES": [
            {
              "CLAIM": "Role"
            }
          ],
          "RIGHTS": [
            "READ"
          ],
          "ACCESS": "ALLOW"
        },
        "USEOBJECTS": [
          "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints"
        ],
        "FORMULA": {
          "$and": [
            {
              "$eq": [
                {
                  "$attribute": {
                    "CLAIM": "Role"
                  }
                },
                {
                  "$strVal": "person with legitimate interest"
                }
              ]
            },
            {
              "$eq": [
                {
                  "$field": "$sm#semanticId"
                },
                {
                  "$strVal": "semanticId-BatteryNameplate"
                }
              ]
            }
          ]
        }
      },
      {
        "ACL": {
          "ATTRIBUTES": [
            {
              "CLAIM": "Role"
            }
          ],
          "RIGHTS": [
            "READ",
            "UPDATE"
          ],
          "ACCESS": "ALLOW"
        },
        "USEOBJECTS": [
          "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update"
        ],
        "FORMULA": {
          "$and": [
            {
              "$eq": [
                {
                  "$attribute": {
                    "CLAIM": "Role"
                  }
                },
                {
                  "$strVal": "person with legitimate interest"
                }
              ]
            },
            {
              "$eq": [
                {
                  "$field": "$sm#semanticId"
                },
                {
                  "$strVal": "semanticId-BatteryNameplate"
                }
              ]
            }
          ]
        }
      }
    ]
  }
}

Martin187187 · 2026-08-24T06:23:50Z

@@ -0,0 +1,57 @@
+
+DEFOBJECTS "BatteryPassport-TechnicalData-Public-DataPoints"
+  REFERABLE $sme(*).BatteryCategory


Suggested change

REFERABLE $sme(*).BatteryCategory

REFERABLE $sme("*").BatteryCategory

Martin187187 · 2026-08-24T06:25:29Z

+   ...
+
+DEFOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints"
+  USEOBJECTS "BatteryPassport-Nameplate-Public-DataPoints"


BatteryPassport-Nameplate-Public-DataPoints is referenced but never defined. Is a DEFOBJECTS block missing, or should this reference point to another existing group?

maybe BatteryPassport-TechnicalData-LegitimiteInterest-DataPoints is meant? this is a definition that is not used.

No, i wanted a rule and DEFOBJECTS per Submodel, it is an undefined block

Martin187187 · 2026-08-24T06:26:01Z

+DEFOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints"
+  USEOBJECTS "BatteryPassport-Nameplate-Public-DataPoints"
+  USEOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update"
+  REFERABLE $sme(*).DateOfPuttingIntoService


The REFERABLE needs to come first unless the grammar is changed to allow arbitrary interleaving.

you mean before USEOBJECTS?

Martin187187 · 2026-08-24T06:28:09Z

+  REFERABLE $sme(*).BatteryMass
+  ...
+
+DEFOBJECTS "BatteryPassport-TechnicalData-LegitimiteInterest-DataPoints"


this definition is not used

Co-authored-by: Martin Stemmer <52048213+Martin187187@users.noreply.github.com> Co-authored-by: Birgit Boss <59824205+BirgitBoss@users.noreply.github.com>

BirgitBoss · 2026-08-25T12:09:18Z

+
+DEFOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints"
+  USEOBJECTS "BatteryPassport-Nameplate-Public-DataPoints"
+  USEOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update"


Suggested change

USEOBJECTS "BatteryPassport-Nameplate-LegitimiteInterest-DataPoints-Update"

USEOBJECTS "BatteryPassport-Nameplate-LegitimateInterest-DataPoints-Update"

Co-authored-by: Birgit Boss <59824205+BirgitBoss@users.noreply.github.com>

Add Example 13 for DPP access

7638233

BirgitBoss requested a review from Martin187187 August 18, 2026 13:34

github-advanced-security Bot found potential problems Aug 18, 2026

View reviewed changes

BirgitBoss marked this pull request as draft August 19, 2026 07:49

DPP example access rule: use claim Role instead of claim person with …

09a21dd

…legitimate interest

Martin187187 reviewed Aug 24, 2026

View reviewed changes