7. Resource & Subclasses

More detail about the role of a resource in the Architecture document.

7.1 Resource

A resource that may be aggregated in a Service Offering or exist independently of it.

7.2 Physical Resource

A Physical Resource inherits from a Resource.
A Physical resource is, but not limited to, a datacenter, a bare-metal service, a warehouse, a plant. Those are entities that have a weight and position in physical space.

7.2.1 Sustainability

The list of the following attributes have to be linked to a service offering, physical resource or legal person.
The aim of the attributes is to allow a customer more educated and transparent decisions regarding the environmental impact.

7.3 Virtual Resource

A Virtual Resource inherits from a Resource.
A Virtual resource is a resource describing recorded information such as, and not limited to, a dataset, a software, a configuration file, an AI model. Special subclasses of Virtual Resource are SoftwareResource and DataResource.

classDiagram

VirtualResource <|-- SoftwareResource
VirtualResource <|-- DataResource 

The license refers to the license of the virtual resource - data or software, not the license of potential instance of that virtual resource.

If there is no specified usage policy constraints on the VirtualResource, the policy should express a simple default: allow intent.

7.4 Data Resource

A data resource is a subclass of virtual resource exposed through a service instance.
It’s also known as a Data Product as described in the Gaia-X Data Exchange specification document.

A data resource is extending the DCAT-3 Dataset class and primarily refers to an analytical dataset exposed via one or more InstantiatedVirtualResource service access points.

The data resource consists of the characterisation of the actual data as a description of the “contractual” part. At minimum, this self-description needs to contain all information so that a consumer can initiate a contract negotiation. All other attributes that are used to describe the data are optional. However, the provider has an interest to precisely describe the data so that it can be found and consumed. If the data resource is published in a catalogue, the data provider might precisely describe the data resource so that it can be found and consumed by data consumers.

Consistency rules

• the keypair used to sign the Data Resource claims must be traceable to the producedBy participant of the Data Resource.
• If the data are about data subjects as one or more Natural Persons, or sensitive data as defined in GDPR article 9, than dataController and consent are mandatory.
  To avoid data re-identification, this rule applies independently if the data is raw, pseudo-anonymized or anonymized. (Note: This is on purpose beyond GDPR requirements.)
• if dataController is specified, the keypair used to sign at least the Data Resource consent claims must be traceable to the dataController.
• Generic authorisation and purpose, not specific to PII nor consent should be expected inside the inherited policy attribut using ODRL Permission and ODRL Duty rules.

7.4.1 Legitimate Processing of Information Related to PII

Consistency Rules

• If legalBasis is in [6.1.a, 9.2.a], then either dataProtectionContactPoint and consentWithdrawalContactPoint are mandatory.
• If legalBasis is not in [6.1.a, 9.2.a], then purpose is mandatory.

{
  "consent": [
    {
      "consentDuration": "90d",
      "legalBasis": "6.1.b",
      "purpose": ["Account Management", "Identity Verification"]
    }
  ]
}