Examples of Access Rules in JSON serialization For an explanation of the examples, see Examples in text BNF. EXAMPLE 1: Allow READ access for Anonymous { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "GLOBAL": "ANONYMOUS" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "ROUTE": "*" } ], "FORMULA": { "$boolean": true } } ] } } EXAMPLE 2: Allow READ access for Anonymous to list of semanticIDs for submodels { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "GLOBAL": "ANONYMOUS" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "ROUTE": "*" } ], "FORMULA": { "$or": [ { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-Nameplate" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-TechnicalData" } ] } ] } } ] } } EXAMPLE 3: Allow EXECUTE of API operations only if machine not-running { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "GLOBAL": "ANONYMOUS" } ], "RIGHTS": [ "EXECUTE" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "ROUTE": "*" } ], "FORMULA": { "$eq": [ { "$attribute": { "REFERENCE": "$sme(\"SubmodelID-OperationalData\").machineState#value" } }, { "$strVal": "not-running" } ] } } ] } } EXAMPLE 4: Allow READ and UPDATE for specific authenticated users { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "email" } ], "RIGHTS": [ "READ", "UPDATE" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "IDENTIFIABLE": "$sm(\"*\")" } ], "FORMULA": { "$and": [ { "$or": [ { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-Nameplate" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-TechnicalData" } ] } ] }, { "$or": [ { "$eq": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "user1@company1.com" } ] }, { "$eq": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "user2@company2.com" } ] } ] } ] } } ] } } EXAMPLE 5: Allow READ and UPDATE for specific Submodel "submodel1" { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "email" } ], "RIGHTS": [ "READ", "UPDATE" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "IDENTIFIABLE": "$sm(\"https://submodel1.company1.com\")" } ], "FORMULA": { "$eq": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "user1@company1.com" } ] } } ] } } EXAMPLE 6: Reuse of ACL, OBJECT and FORMULA { "AllAccessPermissionRules": { "DEFACLS": [ { "name": "acl1", "acl": { "ATTRIBUTES": [ { "CLAIM": "email" }, { "GLOBAL": "UTCNOW" } ], "RIGHTS": [ "READ", "UPDATE" ], "ACCESS": "ALLOW" } } ], "DEFOBJECTS": [ { "name": "Properties", "objects": [ { "REFERABLE": "$sme(\"https://s1.com\").p1" }, { "REFERABLE": "$sme(\"https://s1.com\").p2" } ] } ], "DEFFORMULAS": [ { "name": "allowSubjectGroup1", "formula": { "$and": [ { "$eq": [ { "$timeCast": { "$attribute": { "GLOBAL": "UTCNOW" } } }, { "$timeVal": "15:00:00Z" } ] }, { "$or": [ { "$eq": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "user1@company1.com" } ] }, { "$eq": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "user2@company2.com" } ] } ] } ] } } ], "rules": [ { "USEACL": "acl1", "USEOBJECTS": [ "Properties" ], "USEFORMULA": "allowSubjectGroup1" } ] } } EXAMPLE 7:Example for authenticated users with a specific BusinessPartnerNumber { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "BusinessPartnerNumber" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "ROUTE": "*" } ], "FORMULA": { "$eq": [ { "$attribute": { "CLAIM": "BusinessPartnerNumber" } }, { "$strVal": "BPN1234" } ] } } ] } } EXAMPLE 8: Example for authenticated users of a company { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "email" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "IDENTIFIABLE": "$sm(\"*\")" } ], "FORMULA": { "$and": [ { "$or": [ { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-Nameplate" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-TechnicalData" } ] } ] }, { "$regex": [ { "$attribute": { "CLAIM": "email" } }, { "$strVal": "[\\w\\.]+@company\\.com" } ] } ] } } ] } } EXAMPLE 9: Example with access constraints { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "companyName" }, { "GLOBAL": "UTCNOW" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "IDENTIFIABLE": "$sm(\"*\")" } ], "FORMULA": { "$and": [ { "$or": [ { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-Nameplate" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "SemanticID-TechnicalData" } ] } ] }, { "$eq": [ { "$attribute": { "CLAIM": "companyName" } }, { "$strVal": "company1-name" } ] }, { "$regex": [ { "$field": "$sm#id" }, { "$strVal": "^https://company1.com/.*$" } ] }, { "$ge": [ { "$dayOfWeek": { "$attribute": { "GLOBAL": "UTCNOW" } } }, { "$numVal": 1 } ] }, { "$le": [ { "$dayOfWeek": { "$attribute": { "GLOBAL": "UTCNOW" } } }, { "$numVal": 5 } ] }, { "$ge": [ { "$timeCast": { "$attribute": { "GLOBAL": "UTCNOW" } } }, { "$timeVal": "09:00:00Z" } ] }, { "$le": [ { "$timeCast": { "$attribute": { "GLOBAL": "UTCNOW" } } }, { "$timeVal": "17:00:00Z" } ] } ] } } ] } } EXAMPLE 10: Example with allowing creation within Submodel { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "Role" } ], "RIGHTS": [ "CREATE" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "ROUTE": "/submodels/*/submodel-elements" } ], "FORMULA": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "Role" } }, { "$strVal": "person with legitimate interest" } ] }, { "$eq": [ { "$field": "$sme#semanticId" }, { "$strVal": "CertificateSet" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "semanticId-Circularity" } ] } ] } } ] } } EXAMPLE 11: Example with FILTER statement { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIM": "BusinessPartnerNumber" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "DESCRIPTOR": "$aasdesc(\"*\")" } ], "FORMULA": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "BusinessPartnerNumber" } }, { "$strVal": "BPNL00000000000A" } ] }, { "$match": [ { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].name" }, { "$strVal": "manufacturerPartId" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].value" }, { "$strVal": "99991" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].externalSubjectId" }, { "$strVal": "PUBLIC_READABLE" } ] } ] }, { "$match": [ { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].name" }, { "$strVal": "customerPartId" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].value" }, { "$strVal": "ACME001" } ] } ] } ] }, "FILTER": { "FRAGMENT": "$aasdesc#specificAssetIds[]", "CONDITION": { "$or": [ { "$match": [ { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].name" }, { "$strVal": "manufacturerPartId" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].value" }, { "$strVal": "99991" } ] } ] }, { "$match": [ { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].name" }, { "$strVal": "customerPartId" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].value" }, { "$strVal": "ACME001" } ] } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].name" }, { "$strVal": "partInstanceId" } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].externalSubjectId" }, { "$attribute": { "CLAIM": "BusinessPartnerNumber" } } ] }, { "$eq": [ { "$field": "$aasdesc#specificAssetIds[].externalSubjectId" }, { "$strVal": "PUBLIC_READABLE" } ] } ] } } } ] } } EXAMPLE 12: Example with Reference Attribute and state-dependent filtering { "AllAccessPermissionRules": { "DEFACLS": [ { "name": "maintenanceRead", "acl": { "ATTRIBUTES": [ { "CLAIM": "role" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" } } ], "DEFOBJECTS": [ { "name": "MaintenanceDocuments", "objects": [ { "REFERABLE": "$sme(\"SubmodelID-Maintenance\").maintenanceDocuments" } ] } ], "DEFFORMULAS": [ { "name": "maintenanceWhenRunning", "formula": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "role" } }, { "$strVal": "maintenance" } ] }, { "$eq": [ { "$attribute": { "REFERENCE": "$sme(\"SubmodelID-OperationalData\").machineState#value" } }, { "$strVal": "running" } ] } ] } }, { "name": "maintenanceWhenNotRunning", "formula": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "role" } }, { "$strVal": "maintenance" } ] }, { "$eq": [ { "$attribute": { "REFERENCE": "$sme(\"SubmodelID-OperationalData\").machineState#value" } }, { "$strVal": "not-running" } ] } ] } }, { "name": "matchingMaintenanceDocuments", "formula": { "$eq": [ { "$field": "$sme.maintenanceDocuments[].requiredMachineState#value" }, { "$attribute": { "REFERENCE": "$sme(\"SubmodelID-OperationalData\").machineState#value" } } ] } } ], "rules": [ { "USEACL": "maintenanceRead", "USEOBJECTS": [ "MaintenanceDocuments" ], "USEFORMULA": "maintenanceWhenRunning", "FILTER": { "FRAGMENT": "$sme.maintenanceDocuments[]", "USEFORMULA": "matchingMaintenanceDocuments" } }, { "USEACL": "maintenanceRead", "USEOBJECTS": [ "MaintenanceDocuments" ], "USEFORMULA": "maintenanceWhenNotRunning" } ] } } EXAMPLE 13: Nested and multi-valued access-token claims { "AllAccessPermissionRules": { "rules": [ { "ACL": { "ATTRIBUTES": [ { "CLAIMPATH": "/realm_access/roles" }, { "CLAIMPATH": "/department/name" }, { "CLAIMPATH": "/assurance/level" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "OBJECTS": [ { "REFERABLE": "$sme(\"*\").departmentData" } ], "FORMULA": { "$and": [ { "$contains": [ { "$attribute": { "CLAIMPATH": "/realm_access/roles" } }, { "$strVal": "admin" } ] }, { "$eq": [ { "$attribute": { "CLAIMPATH": "/department/name" } }, { "$strVal": "engineering" } ] }, { "$eq": [ { "$attribute": { "CLAIMPATH": "/department/name" } }, { "$strCast": { "$field": "$sme#value" } } ] }, { "$ge": [ { "$numCast": { "$attribute": { "CLAIMPATH": "/assurance/level" } } }, { "$numVal": 3 } ] } ] } } ] } } EXAMPLE 14: Example for access of DPP data points The empty objects arrays represent the public Nameplate and update data points omitted from the partial BNF example. Complete these groups with the appropriate data points before using the policy. { "AllAccessPermissionRules": { "DEFOBJECTS": [ { "name": "BatteryPassport-TechnicalData-Public-DataPoints", "objects": [ { "REFERABLE": "$sme(\"*\").BatteryCategory" }, { "REFERABLE": "$sme(\"*\").BatteryMass" } ] }, { "name": "BatteryPassport-TechnicalData-LegitimateInterest-DataPoints", "USEOBJECTS": [ "BatteryPassport-TechnicalData-Public-DataPoints" ] }, { "name": "BatteryPassport-Nameplate-Public-DataPoints", "objects": [] }, { "name": "BatteryPassport-Nameplate-LegitimateInterest-DataPoints-Update", "objects": [] }, { "name": "BatteryPassport-Nameplate-LegitimateInterest-DataPoints", "objects": [ { "REFERABLE": "$sme(\"*\").DateOfPuttingIntoService" } ], "USEOBJECTS": [ "BatteryPassport-Nameplate-Public-DataPoints", "BatteryPassport-Nameplate-LegitimateInterest-DataPoints-Update" ] } ], "rules": [ { "ACL": { "ATTRIBUTES": [ { "GLOBAL": "ANONYMOUS" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "USEOBJECTS": [ "BatteryPassport-TechnicalData-Public-DataPoints" ], "FORMULA": { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "semanticId-BatteryTechnicalData" } ] } }, { "ACL": { "ATTRIBUTES": [ { "CLAIM": "Role" } ], "RIGHTS": [ "READ" ], "ACCESS": "ALLOW" }, "USEOBJECTS": [ "BatteryPassport-Nameplate-LegitimateInterest-DataPoints" ], "FORMULA": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "Role" } }, { "$strVal": "person with legitimate interest" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "semanticId-BatteryNameplate" } ] } ] } }, { "ACL": { "ATTRIBUTES": [ { "CLAIM": "Role" } ], "RIGHTS": [ "READ", "UPDATE" ], "ACCESS": "ALLOW" }, "USEOBJECTS": [ "BatteryPassport-Nameplate-LegitimateInterest-DataPoints-Update" ], "FORMULA": { "$and": [ { "$eq": [ { "$attribute": { "CLAIM": "Role" } }, { "$strVal": "person with legitimate interest" } ] }, { "$eq": [ { "$field": "$sm#semanticId" }, { "$strVal": "semanticId-BatteryNameplate" } ] } ] } } ] } }