Yassir Sellami, Software Engineer at Gaia-X
Published in the June edition of the Gaia-X Magazine
From Static Access Rules to Automated Trust-Based Contract Negotiation
As data spaces mature from conceptual frameworks into operational ecosystems, one challenge continues to limit large-scale adoption: how can organisations automatically verify that another participant satisfies access requirements before sharing data, while preserving sovereignty, privacy, and interoperability?
This question sits at the heart of modern data sharing initiatives. In sectors ranging from manufacturing and energy to healthcare and mobility, organisations need to exchange data across institutional boundaries without relying on pre-existing trust relationships. They must be able to prove eligibility, enforce governance rules, and demonstrate compliance in a manner that is transparent, auditable, and machine-processable.
A recent research contribution by Gaia-X Lab Tech Lead Yassir SELLAMI, Policy-Driven Data Space Contract Negotiation using the ODRL Verifiable Credential Profile and OpenID4VP, proposes a practical answer. The paper introduces a standards-based protocol that combines policy reasoning, Verifiable Credentials, OpenID for Verifiable Presentations (OpenID4VP), and the Dataspace Protocol (DSP) into a coherent negotiation flow. The result is a mechanism that allows data providers to express access requirements as machine-readable policies and enables consumers to automatically prove compliance using credentials stored in digital wallets.
Beyond its technical contribution, the work is particularly relevant to Gaia-X because it operationalises several core principles of the Gaia-X Trust Framework: trust, interoperability, verifiability, data sovereignty, and compliance-by-design.
Why Data Space Negotiation Remains a Challenge
Data spaces are founded on the idea that data should be shared under conditions defined by the data rights holder. Access is therefore not granted solely based on identity but on whether a participant satisfies specific eligibility criteria.
A provider may wish to share data only with:
- Organisations located within specific jurisdictions.
- Certified participants belonging to a recognized ecosystem.
- Companies holding particular compliance certifications.
- Entities operating under specific contractual obligations.
While such requirements are common, implementing them consistently remains difficult. Policies often describe what must be proven, but they rarely define how proof should be requested, presented, and validated in an interoperable manner.
This creates a gap between policy definition and enforcement.
Organisations frequently rely on manual verification, proprietary integrations, or custom identity systems. Such approaches are difficult to scale and undermine one of the primary objectives of data spaces: enabling automated interactions among previously unknown participants.
The proposed protocol addresses this challenge by establishing a direct connection between policy requirements and verifiable digital evidence.
The Gaia-X Foundation: Trust Through Verifiable Claims
The relevance of this work becomes clearer when viewed through the lens of Gaia-X.
The Gaia-X Trust Framework establishes a common baseline of trust, governance, and interoperability across participating ecosystems. It relies heavily on Verifiable Credentials and machine-readable claims to enable trustworthy digital interactions. Rather than depending on centralised authorities or proprietary trust models, Gaia-X promotes a federated architecture in which trust can be established through cryptographically verifiable assertions.
The Gaia-X Trust Framework explicitly identifies Verifiable Credentials as a cornerstone technology for building trustworthy and interoperable digital ecosystems. These credentials enable organisations to prove attributes, certifications, and compliance claims in a verifiable and decentralised manner.
This aligns perfectly with the protocol proposed in the paper. Instead of asking a participant to submit documents or complete manual onboarding procedures, a provider can simply request cryptographically verifiable evidence corresponding to policy requirements.
The negotiation process therefore becomes an exercise in automated trust evaluation.
ODRL as the Language of Data Governance
A key element of the proposed approach is the use of the W3C Open Digital Rights Language (ODRL).
ODRL has emerged as a foundational policy language for data spaces because it enables organisations to express permissions, prohibitions, obligations, and constraints in a machine-readable format.
The Data Spaces Support Centre (DSSC) and Gaia-X both recognise ODRL as a central technology for expressing usage conditions and governance requirements.
However, standard ODRL alone does not specify how claims about participants should be verified.
This limitation led to the creation of the Gaia-X ODRL Verifiable Credential Profile (ODRL-VC Profile), which extends ODRL by allowing policy constraints to directly reference claims contained within Verifiable Credentials.
For example, a provider can specify that access is allowed only when a credential contains a country code corresponding to France, Belgium, or Spain. The policy no longer refers to abstract concepts but directly to verifiable data contained within credentials.
This transforms ODRL from a policy language into a practical attribute-based access control mechanism suitable for modern data spaces.
Relevant specification:
- Gaia-X ODRL Verifiable Credential Profile: ODRL-VC Profile Specification
Connecting Policy and Proof
One of the most significant innovations presented in the paper is the automatic transformation of policy constraints into credential requests.
The protocol introduces a deterministic mapping between ODRL-VC policies and the Digital Credentials Query Language (DCQL), a standard developed within the OpenID ecosystem.
The process works as follows:
- A provider publishes an ODRL Offer containing VC-based constraints.
- A consumer initiates contract negotiation.
- The provider extracts all policy constraints.
- These constraints are automatically converted into a DCQL query.
- The consumer’s wallet receives the request.
- Matching credentials are selected.
- The wallet presents only the required claims.
- The provider verifies the credentials and evaluates the policy.
- If all conditions are satisfied, a binding agreement is issued.
This approach eliminates manual configuration and ensures that the proof request always remains aligned with the governing policy.
Whenever a policy changes, the credential request automatically changes as well.
The result is a powerful reduction in operational complexity and configuration errors.
OpenID4VP: The Missing Operational Layer
OpenID4VP enables a verifier to request credentials from a digital wallet and receive cryptographically protected presentations in response.
The protocol proposed in the paper positions the data provider as an OpenID4VP verifier. During contract negotiation, the provider generates a credential request derived from the policy and sends it to the consumer.
The consumer’s wallet then performs credential matching and presents only the information required to satisfy the policy.
This creates a seamless bridge between governance rules and identity technologies.
Privacy by Design and Data Sovereignty
One of the strongest aspects of the proposed protocol is its alignment with privacy and sovereignty principles.
Gaia-X promotes the notion that participants should remain in control of their data and determine when and under which conditions it is shared. The Trust Framework emphasizes transparency, control, and compliance as fundamental ecosystem requirements.
The protocol directly supports these goals through selective disclosure.
Instead of sharing an entire credential, a participant reveals only the claims explicitly required by the policy.
For example, if a policy requires proof that an organisation is located in France, the wallet can disclose only the country code claim rather than the complete organisational profile.
This supports GDPR data minimisation requirements while simultaneously reducing information exposure.
From a sovereignty perspective, the consumer retains control over what to disclose. The wallet presents the requested information only after explicit consent, and the participant remains aware of exactly what information is being shared.
This model represents a significant improvement over traditional onboarding processes that often require excessive disclosure of information.
Integrating with the Dataspace Protocol
Another important contribution of the paper is the integration with the Dataspace Protocol.
DSP already defines how providers and consumers negotiate agreements, exchange offers, and establish contractual relationships. What DSP does not prescribe is how credential-based eligibility verification should occur during negotiation and expecially a common way to express such policies.
The proposed protocol fills that gap.
The authors define a fourteen-step sequence that integrates Verifiable Credential presentation directly into the DSP contract negotiation state machine.
As a result, eligibility verification becomes a native part of contract negotiation rather than a separate external process.
This is particularly relevant for Gaia-X Data Exchange initiatives and future Data Usage Agreement implementations, where contractual obligations and policy compliance must be evaluated before data access is granted.
Governance and Trust Framework Implications
The protocol deliberately separates policy evaluation from trust framework governance.
The ODRL-VC Profile defines what claims are required, but governance authorities must still determine:
- Which issuers are trusted.
- Which credential schemas are accepted.
- How revocation is managed.
- Which trust registries are authoritative.
This separation is particularly important for Gaia-X.
The Gaia-X Trust Framework provides the governance foundation needed to answer these questions. By combining the proposed protocol with Gaia-X trust services and governance rules, ecosystems gain a complete end-to-end model for trustworthy and interoperable access control.
Looking Ahead
The paper arrives at an important moment for the data space ecosystem.
The industry has largely solved the problem of expressing policies. Significant progress has also been made in digital identity standards, Verifiable Credentials, and wallet technologies.
What has been missing is a standardised mechanism that connects these pieces into an operational workflow.
By combining ODRL, Verifiable Credentials, OpenID4VP, DCQL, and DSP, the proposed protocol demonstrates how policy-driven contract negotiation can become fully automated while remaining interoperable and compliant with governance requirements.
For Gaia-X, the implications are significant. The approach offers a concrete path toward automated trust establishment, machine-verifiable compliance, and privacy-preserving access control. It operationalises the principles of sovereignty and interoperability that have guided Gaia-X since its inception and provides a blueprint for future data space implementations in which access decisions are driven not by manual processes but by verifiable evidence and transparent policy evaluation.
As data spaces continue to evolve, solutions that bridge governance, identity, and automation will become increasingly important. This work represents a meaningful step toward that future, bringing the Gaia-X vision of trusted and sovereign digital ecosystems closer to practical reality.