Data access control system with a declarative policy framework

A computing system comprising:

• one or more policy rules, wherein each policy rule of the one or more policy rules, by reference to at least one class and/or at least one property of one or more classes of a common data model, specifies a corresponding data set within data stored to a data system and specifies whether the corresponding data set is shareable or is not shareable,
• wherein the common data model defines a knowledge structure for a domain of knowledge of the data stored to the data system;
• a policy engine comprising processing circuitry coupled to a memory storing instructions,
• wherein the policy engine is configured to receive a data request to access a requested data set stored to the data system, wherein the data request specifies the requested data set using at least one class and/or at least one property of the one or more classes of the common data model,
• wherein the policy engine is configured to apply a shareability model to the one or more policy rules to determine a matching policy rule of the one or more policy rules in which at least some of the requested data set is entailed by the corresponding data set specified by the matching policy rule,
• wherein the shareability model includes one or more axioms that each specifies the shareability of a class or property in relation to another class or property, and
• wherein the policy engine is configured to, based on the matching policy rule, output a data sharing decision for the data request that indicates whether the at least some of the requested data set is shareable or is not shareable.

A non-transitory computer-readable storage medium comprising instructions which, when executed by one or more processors, cause a computing system to perform operations comprising:

• storing one or more policy rules, wherein each policy rule of the one or more policy rules, by reference to at least one class and/or at least one property of one or more classes of a common data model, specifies a corresponding data set within data stored to a data system and specifies whether the corresponding data set is shareable or is not shareable,
• wherein the common data model defines a knowledge structure for a domain of knowledge of the data stored to the data system;
• receiving a data request to access a requested data set stored to the data system, wherein the data request specifies the requested data set using at least one class and/or at least one property of the one or more classes of the common data model;
• applying a shareability model to the one or more policy rules to determine a matching policy rule of the one or more policy rules in which at least some of the requested data set is entailed by the corresponding data set specified by the matching policy rule,
• wherein the shareability model includes one or more axioms that each specifies the shareability of a class or property in relation to another class or property;
• and
• based on the matching policy rule, outputting a data sharing decision for the data request that indicates whether the at least some of the requested data set is shareable or is not shareable.