Re: [GNAP] generic HTTP resource type

[Jamey Sharp <[e-mail]>]

On Tue, Jul 27, 2021 at 06:54:31PM -0400, Adrian Gropper wrote:
> Hi Jamey,
> I'm grateful for your conversation because you are helping me tease 
> out which aspects of GNAP are essential for my (fairly common) 
> use-case.

I'm glad it's helping! Just keep in mind that I read the GNAP draft for 
the first time yesterday. 🤣

I think I have a better understanding of your concern now. I was 
somewhat confused because if the resources in question are electronic 
health records, then the RO is the party that needs protection the most, 
while in the cases I usually think about, it's the end-user's privacy 
that is most at risk.

I don't believe anything I'm proposing affects your use case, because 
I'm only proposing a resource rights type and possibly some end-user 
behavior. As far as I can tell,

- GNAP's privacy and security promises should not depend on the 
   specifics of any rights type;

- your application wouldn't use this rights type and so would not be 
   affected regardless;

- and any protections which GNAP offers an RO should apply regardless of 
   the behavior of any end-user.

Jamey