OPAL2026: Papers with Abstracts

Abstract. The "Deutsches Kunstarchiv" at the "Germanisches Nationalmuseum" in Nuremberg applied for funding of a two-year pilot project by the "Deutsche Forschungsgemeinschaft", which focuses on objects that are "(still) subject to legal restrictions". The aim of the project is to expand the current archival technical infrastructure, based on the "CIDOC Conceptual Reference Model", by integrating a Rights Expression Language such as the "Open Digital Rights Language". This integration provides a technical framework to record the outcome of a case-by-case rights assessment in a machine-readable format.

Abstract. The Open Digital Rights Language (ODRL) has emerged as a versatile policy representation framework extending well beyond its origins in digital rights management, finding application in GDPR compliance, data-space governance, and regulatory policy expression. Yet a significant source of real-world normative content remains untapped by the ODRL ecosystem: the billions of business process models that organisations maintain as operational documentation. This paper demonstrates that well-formed BPMN (Business Process Model and Notation) models are structural carriers of deontic content, namely obligations, permissions, and prohibitions, and proposes a methodology for automatically extracting this content as valid ODRL policies. We establish a formal mapping between BPMN constructs and ODRL primitives, grounded in the observation that BPMN control flow encodes deontic modalities by construction: mandatory sequence paths imply obligations, gateway alternatives imply permissions, and role-based lane assignments imply party constraints directly expressible in ODRL's assignee/assigner model. We implement this mapping as a graph traversal algorithm over BPMN XML, producing ODRL policies in JSON-LD, and evaluate it on a corpus of publicly available process models. We discuss ODRL's expressiveness relative to the full range of BPMN constructs, identify temporal sequencing and iteration as the primary open problems, and argue that ODRL's profile mechanism provides a principled extension path for addressing them. The contribution positions BPMN as a novel and practically significant input modality for ODRL policy generation, opening a route to compliance-by-extraction: deriving auditable, interoperable ODRL artefacts directly from existing organisational process documentation.

Abstract. The Open Digital Rights Language (ODRL) has emerged as a key policy language for governing data usage in data spaces and decentralized digital ecosystems. While ODRL enables machine-readable representation and enforcement of permissions, prohibitions, and obligations, automated negotiation under ODRL constraints remains insufficiently addressed. Autonomous agents should uphold these constraints on top of negotiating heterogeneous policy terms under incomplete information. This paper presents a policy-aware negotiation agent that operates directly on ODRL policy constraints while ensuring the semantic interpretability of negotiated offers. The proposed framework combines per-issue Bayesian belief models capable of handling mixed-type policy constraints, strict enforcement of non-negotiable constraints, and adaptation mechanisms that guide acceptance decisions and counter-offer generation. Unlike utility-driven or reinforcement learning approaches, the proposed agent enforces non-negotiable constraints by construction and restricts exploration to the feasible policy space. We position this framework as a practical step toward regulating autonomous agents with ODRL in open systems, such as data spaces, and report implementation insights from translating ODRL constraint semantics into executable negotiation logic.

Abstract. The increasing use of automated, machine-readable policy systems for governing digital content and data usage has made robust and interoperable policy languages increasingly important. The Open Digital Rights Language (ODRL) aims to support such use cases but faces practical limitations in real-world applications. ODRL 2.2 lacks formal semantics and exhibits ambiguities in its conceptual model, limiting its scalability, interoperability, and reliable automated evaluation. This work analyzes ODRL 2.2 through a music distribution use case to identify conceptual and operational shortcomings. It examines limitations in ODRL’s conceptual model – such as collections, actions, and extensibility – as well as operational aspects including constraints, evaluation, and the representation of the state of the world, and proposes potential improvements. Overall, the article concludes that a formal semantic foundation and clearer model are essential for ODRL to enable consistent and interoperable policy evaluation. Future work toward ODRL 3.0 should therefore focus on formal semantics, simplified abstractions, and standardized evaluation mechanisms to support scalable policy-driven systems.

Abstract. The availability of datasets containing machine-readable policies is essential for evaluating policy modelling approaches and policy decision engines. However, publicly available datasets that provide policies expressed using the Open Digital Rights Language (ODRL) remain scarce, particularly in domains requiring complex contextual information and operational constraints. This paper presents the CORAL-AC dataset, a curated collection of access control policies derived from a hospital information system scenario. The dataset includes fifteen policies represented at three complementary levels: natural language descriptions, SQL Row-Level Security (RLS) policies, and semantically equivalent policies expressed using ODRL. In addition, the dataset provides structured evaluation artefacts including states of the world, evaluation requests, and expected outcomes aligned with the ODRL formal semantics. The construction of the dataset follows a systematic methodology that starts from operational requirements and progressively externalises them into machine-readable policy representations. During this process, several modelling challenges were identified when representing operational access control rules using ODRL, particularly regarding role resolution, filtered assets, dynamic contextual information, and temporal constraints. The paper discusses these challenges and analyses how they can be addressed using extensions based on the ODRE approach. The resulting dataset aims to support research on policy modelling, semantic policy translation, and policy engine evaluation, providing a reusable resource for the ODRL community.

Abstract. Terms of Service (ToS) in Software as a Service (SaaS) ecosystems define the responsibilities of providers and customers. However, the monitoring and enforcement of these contracts is usually under the control of providers, creating risks of power asymmetry and limited transparency. Moreover, many clauses cannot be easily verified, operationalised or computationally interpreted in unequivocal manner, making it difficult for customers to determine whether an obligation has been fulfilled, a right can be effectively exercised, or a prohibition has been violated, leading to a lack of awareness of the risks associated with accepting such terms. In this paper, a semantic approach is presented to model and infer contractual risks derived from potentially unfair terms in ToS. The Open Digital Rights Language (ODRL) is used to represent contractual terms, while the Data Privacy Vocabulary (DPV) is used to describe the risks to which customers may be exposed when subscribing to SaaS services. We introduce a ToS risk specification to classify risk sources and mitigation measures associated with unfair terms. In addition, we describe a set of N3 rules to infer risks from ODRL policies and link them to DPV risk instances. The approach is implemented in a prototype and illustrated using abusive and non-abusive test cases.

Abstract. Data Space participants need to automate data access decisions across organizations without pre-established trust relationships while still meeting compliance, sovereignty, and data governance requirements. However, current implementations often leave a gap between what the policy requires (expressed as constraints) and how the Consumer can consistently select and present the right credentials in a standards-based way. We propose a concrete, interoperable approach to contract negotiation between a Consumer and a Provider in a Data Space where access to data or services is governed by an ODRL policy whose evaluated values are expressed as Verifiable Credential (VC) claims. The Provider publishes an ODRL Offer policy using the ODRL Verifiable Credential (ODRL-VC) Profile. During negotiation, the Consumer proves compliance by presenting the required credentials from a Wallet. To follow current widely adopted standards, the Provider acts as an OpenID for Verifiable Presentations (OpenID4VP) Verifier and requests the required credentials using Digital Credentials Query Language (DCQL). We define a protocol that: (i) derives DCQL requests from ODRL-VC constraints and (ii) binds presentations to the negotiation context.

Abstract. The EU's Data Governance Act (DGA) establishes two structurally distinct channels for voluntary data sharing: a civic pathway via a Data Altruism Organisation (DAO) for general-interest objectives, and a commercial channel via a Data Intermediation Service Provider (DISP) for economic exchange. Both channels impose permissions, prohibitions and duties, currently governed by prose. The DGA's promise of trustworthy data sharing depends on compliance decisions at machine speed. Although machine-readable vocabularies for some of these obligations exist, they remain a work in progress because of ever-evolving legislation. In this context, we modelled both channels as Open Digital Rights Language (ODRL) policy chains, using the Data Privacy Vocabulary (DPV)'s DGA extension to represent actors and obligations, and the Trust Envelope model to capture the intended usage of each exchange. This paper presents a complete lifecycle: from a discoverable shared data pool, through a donation or commercial listing offer, to a concrete usage agreement, and finally to an access request for each channel. The same data point produces structurally different policy chains – the destiny component of a Trust Envelope – depending on the sharing channel: purpose-bound under altruism, commercially scoped under intermediation. Machine-readable policy chains make trustworthy data sharing actionable by reducing legal and technical barriers. The patterns we establish are structurally transferable to successor and analogous frameworks, including the Data Act, as the EU's digital legislation landscape consolidates.

Abstract. Digital transformation and the adoption of Artificial Intelligence (AI) have significantly increased personal data processing and reuse at scale across various sectors. While used to drive efficiency and innovation, the use of AI models relying on sensitive data poses potential privacy risks, such as misuse, leaks, and violations of personal data protection compliance. Decentralized personal data platforms such as Solid have been proposed as an alternative to centralized data architectures by enabling individuals to store and manage their data within user-controlled pods. However, existing architecture primarily relies on access control mechanisms and lacks mechanisms to monitor how personal data is accessed and used after permission has been granted. This paper presents O-Prime, an ODRL-based privacy monitoring framework designed for decentralized environments. The framework introduces a monitoring gateway that intercepts data access requests between external applications and Solid Pods, enabling policy-based monitoring, semantic audit logging, and context-aware privacy enforcement. O-Prime integrates several Semantic Web standards, including the Open Digital Rights Language (ODRL) for expressing privacy policies, the Data Privacy Vocabulary (DPV) for semantic classification of personal data, and the PROV-O ontology for representing machine-readable provenance logs of data access events. Through this architecture, O-Prime enables transparent monitoring of personal data usage, detection of policy violations, and auditable provenance tracking within decentralized data ecosystems. A prototype implementation demonstrates how the framework can monitor third-party access to sensitive personal data stored in Solid Pods, detect policy violations in real time, and present auditable semantic logs through an interactive dashboard.