Download PDFOpen PDF in browserExtracting ODRL Policies from Business Process Models: A Graph Traversal Approach to Compliance-by-Extraction11 pages•Published: October 28, 2026AbstractThe Open Digital Rights Language (ODRL) has emerged as a versatile policy representation framework extending well beyond its origins in digital rights management, finding application in GDPR compliance, data-space governance, and regulatory policy expression. Yet a significant source of real-world normative content remains untapped by the ODRL ecosystem: the billions of business process models that organisations maintain as operational documentation. This paper demonstrates that well-formed BPMN (Business Process Model and Notation) models are structural carriers of deontic content, namely obligations, permissions, and prohibitions, and proposes a methodology for automatically extracting this content as valid ODRL policies. We establish a formal mapping between BPMN constructs and ODRL primitives, grounded in the observation that BPMN control flow encodes deontic modalities by construction: mandatory sequence paths imply obligations, gateway alternatives imply permissions, and role-based lane assignments imply party constraints directly expressible in ODRL's assignee/assigner model. We implement this mapping as a graph traversal algorithm over BPMN XML, producing ODRL policies in JSON-LD, and evaluate it on a corpus of publicly available process models. We discuss ODRL's expressiveness relative to the full range of BPMN constructs, identify temporal sequencing and iteration as the primary open problems, and argue that ODRL's profile mechanism provides a principled extension path for addressing them. The contribution positions BPMN as a novel and practically significant input modality for ODRL policy generation, opening a route to compliance-by-extraction: deriving auditable, interoperable ODRL artefacts directly from existing organisational process documentation.Keyphrases: business process compliance, compliance by extraction, deontic bpmn, graph traversal, odrl policy extraction In: Andrea Cimmino Arriaga, Beatriz Esteves, Nicoletta Fornara and Víctor Rodríguez Doncel (editors). Proceedings of 2nd Workshop ODRL and Beyond: Practical Applications and challenges for poLicy-base access and usage control, OPAL 2026, vol 113, pages 5-15.
|
