# The Need for Machine-Processable Agreements in Health Data Management +
## 5 A Policy Language for Multi-Privilege Consent  
A resource, \(d_{n}\), is a physical or digital object. For instance, a Database may be a collection of resources, or a resource itself. A resource has a set of properties, which are key-value pairs such as: id, name, anonymized_version, etc. A resource has a set of owners, \(O\) where \(o_{i}\) relates to a single individual who has ownership of the resource. Each owner can express the sharing allowances, or consent, for the resource, \(c_{i}\). Figure 3 shows a high-level grammar for a single policy defined in our policy language which operates over the resources and owners described above. Parts below that are written in bold are the language keyword. When defining the policy we need to state who is the owner of this policy, which is achieved by stating the policy owner or author in the place of authorId. A policy is not limited to a single resource, but can be attached to a set of resources. The resources to associate with a given policy should go within [URIs], where resources would be separated by delimiter \",\". Figure 3: High-level grammar for multi-owner data sharing. The body of the policy includes two blocks: Share and Restrict. Those two blocks include rules that are applied to the resource of the policy. Relations and conditions are included in both blocks which define the rules. The first part of a rule is the relation, which can encompass generic relationships and specific identities, such as: parents(), sisters(), firstDegree(), children([PERSON]), Uncle([PERSON]). The second part of a rule is the _conditions_, using individual properties of the individuals contained by the relationships such as: age \(\leq\) 15, gender==M, and age \(\leq\) 112 and gender==F. Semantics of the policy language is simple and intuitive. The id next to author declares the policy author and there can only be a single author for policy, although multiple policies can exist for a given resource, one for each associated owner. Next, the list of resources that are associated with policy are stated within URIs. The body of the policy includes share and restrict blocks: rules in _share_ state the set of people who the author wants to share the resources with. Rules in _restrict_ state the set of people that the author does not want to have the associated resource. Each of the rules in share and restrict include _relations_ and _conditions_. Relations evaluate to the list of individuals that the policy author has the relation with. For instance, brothers() would return the policy author's brothers. The conditions filter the people retrieved based on the relation. Filtering can be done by comparing individuals' properties such as age and gender. Boolean operators _and_ and _or_ can be used in order to combine several conditions. Conditions can be empty which indicates that there is no condition. Rules within share need to have a relation and conditions. An example of share rule is children():age > 15 and gender==F which means share with all policy author's daughters that are older that 15. Meanwhile, maternalUncles(): indicates the author wishes to share with the complex class of all maternal uncles, defined as a rule in the previous section. Restrict rules return list of individuals which the policy' author does not want to gain access. There are three parts of a restrict rule. The relationship and conditions parts behave in the same manner as described above. However, the third part is called _instead_. The instead clause allows the policy author to state a list of individuals to gain access instead of the individuals retrieved by the semantics of relation and condition for the rule. The instead part itself includes list of rules which are identical to the share rules. Instead part is complete optional and can be left empty without including the '[]'. An example of a restrict rule is nephews():age<15[parents();Grandparents():] This is restrict rule states not to share with all nephews that are younger than 15 years old and instead share with their parents and grandparents.