Rights Expression Language (REL)

Transforms a simple grant into an enforceable contract by attaching obligations and restrictions that must be fulfilled before, during, or after access.

• Temporal Constraints: License validity periods with precise start and end timestamps
• Attribution Duty: A mandatory requirement to cite the source using a canonical DOI or URL
• Compensation Duty: A payment event triggered at a defined payAmount before access is granted
• Usage Metering: Constraints that cap total data volume, such as odrl:count limiting ingestion to 10,000 records

Manages complex scenarios where multiple policies apply to a single asset by defining a deterministic conflict resolution strategy. This prevents ambiguous authorization states in automated systems.

• Precedence: An explicit conflict property that sets a priority order (e.g., perm overrides prohibit)
• Inheritance: A child asset inherits the policy of its parent collection unless an explicit rule overrides it
• Agreement Scoping: A master agreement policy can reference and incorporate multiple asset-specific sub-policies

A core REL standard like ODRL is intentionally abstract. A Profile extends the core vocabulary with domain-specific terms to create a concrete, interoperable schema for a particular industry.

• AI Training Profile: Defines terms like aim:useForTraining, aim:fineTuning, and aim:inference
• Semantic Precision: Eliminates ambiguity by binding a community-defined URI to a specific concept
• Validation: Allows a policy to be automatically validated against a profile's JSON Schema to ensure structural compliance before enforcement

A REL is an abstract information model that must be serialized into a concrete data format for transmission via an API. The serialization choice impacts parsing efficiency and ecosystem compatibility.

• JSON-LD: The most common format, embedding the REL's graph model into standard JSON for web APIs
• Turtle/RDF: A terser, triple-based format used for bulk data exchange and graph database ingestion
• JWT Embedding: Encoding a compact serialized policy directly into a JSON Web Token claim for decentralized enforcement at the Policy Enforcement Point

Ensures that a machine-readable license is tamper-proof and its origin is verifiable, creating a chain of trust from the rights holder to the automated enforcement point.

• Digital Signatures: A licensor signs the serialized policy using a private key, allowing any party to verify its authenticity with the corresponding public key
• Hash Linking: The policy contains a cryptographic hash of the asset it governs, binding the license immutably to a specific Dataset Fingerprint
• Revocation Check: The policy includes a URL for a Revocation Endpoint that an enforcement service must query at runtime to ensure the license is still active

The architectural component in an access control system that evaluates authorization requests against defined REL policies at runtime. The PDP consumes a structured rights expression, assesses the attributes of the requesting entity, and issues a binary Permit or Deny decision. It is the computational brain that interprets REL logic, separating policy evaluation from enforcement to enable centralized rights management across distributed systems.

The architectural component, typically an API Gateway, that intercepts access requests to a protected content resource. The PEP forwards the request context to the PDP and rigidly enforces the returned decision. It is the execution arm of a REL-based authorization system, responsible for blocking unauthorized ingestion attempts and ensuring that every data access event is governed by a valid, evaluated rights expression.

A behavioral model defining the lifecycle of a license agreement as a finite set of states and valid transitions. A REL expresses the static permissions, but the state machine governs dynamic enforcement:

• Active: Rights are currently granted and data ingestion is permitted.
• Suspended: Temporary revocation due to a billing or compliance event.
• Revoked: Permanent termination of all access rights.
• Expired: License term has naturally concluded.

A centralized service that acts as a runtime policy decision point, evaluating a licensee's attributes against the REL-defined rules to determine if they are authorized for a specific content resource. Unlike a generic PDP, an entitlement service is often tightly coupled with subscription billing and quota management systems, translating commercial agreements into technical access decisions. It answers the question: 'Does this specific customer have the right to ingest this specific dataset right now?'

The use of self-executing code on a blockchain to programmatically enforce the terms defined in a Rights Expression Language. A REL policy can be encoded as a smart contract, automating royalty payments and access grants without intermediaries. When a training data consumer pays the required fee, the contract autonomously issues a cryptographically signed JSON Web Token (JWT) granting scoped, time-bound access, creating an immutable audit trail of all licensing transactions.