Architecture decisions¶
The decision log holds every architecture decision of GBO in MADR format. It contains the decisions of the archived reference architecture v0.6.2. It also contains the decisions that the GBO team made during the build of the demo.
Each ADR names the PSA or GO constraint that it satisfies and the deliberation that produced it. Each ADR also links to its implementation in gbo-demo at release v0.9.0. A "Traceability" section at the end of each ADR lists the requirements, findings, open questions, and demo increments that the ADR depends on.
If a later decision replaces an earlier one, both stay in the log. At the top of its body, the superseded ADR gives the reason. It keeps its text as history.
The column "Serves" names the main requirements of each decision. The full list is in the ADR.
Accepted¶
These decisions are accepted:
| ADR | Decision | Serves | Notes |
|---|---|---|---|
| 0001 | GraphQL as the source access interface | REQ-08, REQ-17 | |
| 0002 | OPA/Rego in OpenFTV, the FSC Inway as PEP, AuthZEN with the FTV GraphQL profile | REQ-04, REQ-42 | Includes the decision "the FSC Inway is the PEP" |
| 0003 | FSC for all domestic connectivity | REQ-46 | |
| 0004 | Five authorization concerns, federated evaluation, no central authorization server | REQ-18, REQ-48 | The legal-basis path is not implemented |
| 0005 | BSNk PP polymorphic pseudonyms for private-sector access | REQ-20, REQ-80, REQ-82 | BSNk is called only at consent time. The mock follows the BSNk interface and does not encrypt |
| 0009 | Closed-world per-field rules: the rule is the catalog | REQ-48, REQ-97 | Supersedes 0008. Rules are bound by regime and service |
| 0013 | GraphQL request mapping in the PDP ahead of policy evaluation | REQ-17, REQ-42 | Supersedes 0012. The mapper only maps |
| 0015 | FSC contract acceptance by policy | REQ-61, REQ-62, REQ-63 | Eight ordered refusal codes |
| 0016 | Source-owned metadata and reconciliation-based onboarding | REQ-64, REQ-65, REQ-66 | The mechanism is accepted. The document format is a proposal for PSA S10 |
| 0017 | gbo-simple-v1 as the attestation mapping profile | REQ-116, REQ-124 | Applies to the eudi capability only |
| 0018 | EUDI issuance through disclosure-based OpenID4VCI on the nl-wallet stack | REQ-45, REQ-57, REQ-78 | |
| 0020 | AS4 bridge for SDG-OOTS | REQ-44 | Not implemented in gbo-demo v0.9.0 |
| 0021 | Policy management and distribution per bronhouder | RL-01 to RL-05 | Rewritten. Signing applies only across an organization boundary |
| 0023 | Organization identity from the certificate, and separate EUDI certificate roles (part A: organization identity) | REQ-67, REQ-46 | Part B is proposed |
| 0026 | Each controller logs its own processing in an LDV logbook | REQ-72 | Rewritten |
| 0031 | The authorization regime follows from the evidence a request carries | REQ-74 | Supersedes 0030 |
| 0032 | The consent proof: signed, a value per source, a placeholder in the query, status online over FSC, verified in policy | REQ-68, REQ-79, REQ-80 | Supersedes 0007 |
| 0033 | The source gateway decrypts its own value after the allow, and only the Inway reaches it | REQ-21, REQ-81 | Supersedes 0011 |
| 0034 | An integrator connects under FSC delegation, and the consent binds the represented party | REQ-106 | |
| 0035 | W3C Trace Context is the correlation key, and the FSC transaction ID is recorded next to it | REQ-55 | Supersedes 0019 |
| 0036 | The ADL is the authoritative record of authorization decisions | REQ-71 | |
| 0037 | Authentic Source Interface as an OAuth front door per ETSI TS 119 478 clause 6.1 | REQ-112, REQ-87, REQ-102 | Supersedes 0029. Demo grade |
| 0038 | One data service per authentic source, one token per data service | REQ-94, REQ-95, REQ-99 | |
| 0039 | ASI attributes described by the source (asi capability in source metadata) |
REQ-64, REQ-92 | Partly implemented (#592) |
Proposed¶
A proposed ADR waits for an open question, a PSA decision, or demo work. These decisions are proposed:
| ADR | Proposal | Serves | Waits for |
|---|---|---|---|
| 0023 | Organization identity from the certificate, and separate EUDI certificate roles (part B: EUDI certificate roles) | REQ-58 | Part A is accepted |
| 0024 | Canonical semantic models per bronhouder | — | |
| 0025 | GraphQL as a recognized data service (datadienst) type of the Federatief Datastelsel (FDS) | REQ-08 | |
| 0027 | Bronhouder onboarding toolkit | REQ-64, AV-07 | Q-74 |
| 0028 | PuB-EAA Provider productization | REQ-58, REQ-77 | |
| 0040 | Citizen recognition and the BSNk participant: route D | REQ-69, REQ-23 | Q-49 |
| 0041 | Seal format of ASI results | REQ-83 | Q-32 |
| 0042 | Optional per-attribute token binding for ASI tokens | REQ-103 | Q-33 |
| 0043 | Keep identifiers out of the PDP input instead of masking decision logs | REQ-60 | Demo #368 |
Superseded¶
These decisions are superseded:
| ADR | Decision | Serves | Superseded by |
|---|---|---|---|
| 0006 | Consent register (toestemmingsregister) as runtime PIP | REQ-68 | 0007, then 0032 |
| 0007 | Consent as a signed token with a live status check | REQ-68 | 0032 |
| 0008 | Service catalog (dienstencatalogus) as a data-driven policy ceiling | REQ-08 | 0009 |
| 0010 | BSN resolution inside the PEP | REQ-21 | 0011, then 0033 |
| 0011 | Source-owned source gateway resolves pseudonyms, and the PDP never sees a BSN | REQ-21 | 0033 |
| 0012 | Query AST inspection with OPA's graphql.parse_query |
REQ-17 | 0013 |
| 0014 | Flow and subject identifier semantics through a provider-side Additional Claims service | REQ-74 | 0030, then 0031 |
| 0019 | FSC transaction ID as the end-to-end correlation key | REQ-55 | 0035 |
| 0029 | Authentic Source Interface per ETSI TS 119 478 | REQ-112 | 0037 |
| 0030 | Flow and subject identifier semantics as FSC grant properties | REQ-74 | 0031 |
Rejected or deferred¶
This decision is deferred:
| ADR | Proposal | Serves | Status |
|---|---|---|---|
| 0022 | Sector-level grants with organizational attribute verification | REQ-61 | Deferred. Admission runs through the admission register (toelatingsregister). The demo removed sector-pip (#378) |