Change Notes

Changes w.r.t. V3.2 vs. V3.1

Major Changes:

  • added: CLAIMPATH selects nested JWT claim values using RFC 6901 JSON Pointer syntax. Direct $eq supports scalar-string equality, direct $contains supports exact string-array membership, and strict explicit casts make scalar claim values available to other typed operations. Missing or wrongly typed values are indeterminate and final authorization uses deny-unless-permit combination.

  • added: Expanded the informative DPP annex with AAS security mappings and Battery Passport access examples covering claim conventions, paid diagnostics, and delegated element updates. Added linked workflows and a proposed HTTP response-signing approach.

Minor Changes:

  • Aligned the JSON Schema for DEFOBJECTS with the BNF grammar so object groups can combine direct REFERABLE objects and USEOBJECTS references.

  • Clarified fail-closed formula evaluation and three-valued handling of runtime evaluation errors [#96](https://github.com/admin-shell-io/aas-specs-security/issues/96).

  • Clarified that all CLAIM and GLOBAL attributes used by a FORMULA or filter CONDITION must be listed in the applicable ACL’s ATTRIBUTES, directly or through USEATTRIBUTES, including when formulas are reused. An evaluated operation using an undeclared operand is indeterminate and combines with other subexpressions according to the three-valued truth tables; REFERENCE operands can be used directly. Updated the time-based BNF and JSON examples accordingly [#97](https://github.com/admin-shell-io/aas-specs-security/issues/97).

  • Clarified the FORMULA evaluation context for CREATE and UPDATE operations, including evaluation of both the current and prospective state for UPDATE [#98](https://github.com/admin-shell-io/aas-specs-security/issues/98).

  • Improved documentation of access rule examples

  • new access rule examples for DPP related rules, access rule 10 updated to better reflect the purpose

  • Added a Battery Passport/DPP data-point access example (Example 14) in BNF and JSON, illustrating public access and access for persons with legitimate interest [#100](https://github.com/admin-shell-io/aas-specs-security/pull/100).

Changes w.r.t. V3.1 vs. V3.0.2

Major Changes:

  • changed: <ReferenceAttribute> with more detailed definition in BNF Grammar and JSON Schema

  • changed: <IdentifiableObject>, <ReferableObject>, <FragmentObject>, <DescriptorObject> with more detailed definition in BNF Grammar and JSON Schema

  • changed: DateTime and Time literals in access rules now use explicit patterns based on AAS core meta MatchesXsDateTime and MatchesXsTime, which correspond to the XSD-based data types defined by the IDTA 01001 Part 1 Metamodel and are based on XML Schema xs:dateTime/xs:time/ISO 8601 lexical forms. Values require seconds, may include fractional seconds and timezone offsets, Time values without timezone information are interpreted as UTC, and incomplete values such as 09:00 need to be completed before serialization, e.g. 09:00:00Z. Calendar-specific invalid dates still need semantic validation beyond the lexical day, month and year ranges. [#63](https://github.com/admin-shell-io/aas-specs-security/issues/63)

  • added: Query Filter and FragmentFieldIdentifiers (https://github.com/admin-shell-io/aas-specs-api/issues/517)

  • added: new section in the annex on access control management and data authentification for implementing the digital product passport (DPP)

  • added: Added chapter requirements.adoc and annex/requirements_mapping.adoc

  • changed: Avoided provisional verbs in introduction.adoc, essential provision text has been moved to acccess-rule-model.adoc

Minor Changes:

  • update: Revised description text to replace 'may include signing' / 'will be' with 'is signed' / 'be signed' for clarity and consistency.

  • added: Support for supplementalSemanticIds in Access Rule FieldIdentifiers and FragmentFieldIdentifiers, including BNF, JSON Schema, and examples [#77](https://github.com/admin-shell-io/aas-specs-security/pull/77)

  • added: Access control examples for REFERENCE & along with rules for creating only specific models, defined using BNF and JSON.

  • added: Clarified <ReferenceAttribute> semantics and added a state-dependent filtering example where maintenance documents are filtered using machine state read via REFERENCE from another Submodel.

  • added: Clarified ROUTE semantics for AAS HTTP/REST path matching and added informative ROUTE and request examples [#58](https://github.com/admin-shell-io/aas-specs-security/issues/58)

  • added: Expanded the explanation of RIGHTS with a mapping to operation verbs and HTTP methods, including an illustrative table and diagram [#56](https://github.com/admin-shell-io/aas-specs-security/issues/56)

  • moved: Moved and revised protection goals from introduction to own chapter

  • updated: Editorial changes to the explanation of the access rule BNF

  • added: Clarification of semver usage

Bugfixes:

  • fix: Fixed direct FieldIdentifier operands in typed hex, bool, DateTime and time comparisons in BNF and JSON Schema, including implicit conversion semantics.

  • fix: Disallowed direct FieldIdentifier-to-FieldIdentifier comparisons in BNF and JSON Schema. Comparing two fields requires an explicit cast around at least one operand.

  • fix: Aligned date/time extraction functions ($dayOfWeek, $dayOfMonth, $month, $year) in JSON Schema to accept all dateTimeOperand types per BNF grammar.

  • fix: Aligned comparison and cast operands in JSON Schema with BNF semantics, including boolean equality-only comparisons, ordered comparisons without boolean operands, restricted $dateTimeCast/$timeCast inputs, and no raw $boolean inside $match.

  • changed: Fixed incorrect Fragment Field Identifiers in examples [#44 of Security Spec](https://github.com/admin-shell-io/aas-specs-security/issues/44)

  • fix: access rule BNF

Changes w.r.t. V3.0.2 vs. V3.0.1

Bugfixes:

Changes w.r.t. V3.0.1 vs. V3.0

Bugfixes:

Minor Changes:

  • changed: correct example in Annex

  • removed: remove <FieldIdentifierString> in grammar and use <FieldIdentifier> directly

Changes V3.0

This is the first release