# Purpose-based access policy on provenance and data algebra

arXiv: https://arxiv.org/abs/1912.00445 · HTML: https://mlsanity.com/paper/1912.00445/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Dec 2019.

## Built on by (most cited first, 1 of 1)

- [Lawful and Accountable Personal Data Processing with GDPR-based Access and Usage Control in Distributed Systems](https://mlsanity.com/paper/2503.07172/) (2025)

## Abstract (arXiv)

It is a crucial mechanism of access control to determine that data can only be accessed for allowed purposes. To achieve this mechanism, we propose purpose-based access policies in this paper. Different from provenance-based policies that determine if a piece of data can be accessed or not, purpose-based access policies determines for what purposes can data be accessed. Particularly, the purposes can be classified as different sensitivity levels. For the first time, We tailor policy algebras to include internal and external policy operators for hierarchical purposes, in order to merge purpose sets generated by individual policies. We also created external policy algebras to merge policies from multi-parties. With different types' testing experiments, our model is proved to be feasible and practical.