The Abstract Accountability Language: its Syntax, Semantics and Tools

Accountability is the driving principle for several of regulatory frameworks such as the European Union's General Data Protection Regulation (EU GDPR), the Health Insurance Portability and Accountability Act (HIPAA) and the Corporate and Auditing Accountability and Responsibility Act, thus influencing how organizations run their business processes. It is a central concept for enabling trust and assurance in cloud computing and future internet-based services that may emerge. Nevertheless, accountability can have different interpretations according to the level abstraction. This leads to uncertainty concerning handling and responsibility for data in computer systems with outsourcing supply-chains, as in cloud computing. When defining policies to govern organizations, we need tools to model accountability in rich contexts, including concepts like multiple agents, obligations, remediation actions and temporal aspects. The Abstract Accountability Language (AAL) is built on logical foundations allowing to describe real-world scenarios involving accountability concerns. Its semantic principles provide us means to answer whether the conditions to reach accountability in a given context are met. Moreover, we created a tool support to verify and monitor accountability policies