On obligations

Abstract. Access control is concerned with granting access to sensitive data based on conditions that relate to the past or present, so-called provisions. Expressing requirements from the domain of data protection necessitates extending this notion with conditions that relate to the fu-ture. Obligations, in this sense, are concerned with commitments of the involved parties. At the moment of granting access, adherence to these commitments cannot be guaranteed. An example is the requirement \do not re-distribute data", where the actions of the involved parties may not even be observable. We provide a formal framework that allows us to precisely specify data protection policies. A syntactic classication of formulas gives rise to natural and intuitive formal denitions of provi-sions and obligations. Based on this classication, we present dierent mechanisms for checking adherence to agreed upon commitments.