RSS Feed Gorgias B Facebook page

Data Access Policy

This tutorial has been done using version 1.3.5 of Gorgias-B. It aims to show the SoDA - compatible approach to developing data access policies using Gorgias-B. Data access is important especially in the development of medical file access policies in hospitals and public/insurance organizations. A data access policy is influenced by user preference, legislation, and stakeholders' business models.

We will present the various modeling steps. At the end of each tutorial you can download the generated files.

-> Return to the main tutorials web-page.

An Artificial Data Access AssistantTop of Page


This is a data access policy for deciding whether to allow full, partial, or no access to data requests from various users.

Normally deny access to data from any user. The doctor of a user is allowed partial access to the medical records of the user. When the user gives his/her consent the doctor is allowed full access to the user�s medical records.

Development process

The development process is shown in a series of screenshots from Gorgias-B operation.


Figure 1. The modeling process starts with the Options view. The agent has three options: allow_full, allow_partial and deny access to data requested by an agent. The data and agent are modelled as parameters, thus they are written with the first character in uppercase. All are mutually exclusive.

The options view


Figure 2. Then, the user adds arguments in the Arguments view. Normally access is denied for all data. The doctor of a user can have partial or full access to the medical records of the user. The user adds the needed predicates as supporting information (all as non-defeasible knowledge).

The arguments view


Figure 3. Then, in the "Argue at higher levels" view the user argues. The first scenario is about the doctor of a requesting to access to the medical records of the user. The user just selects allow_partial_access and adds the model.

The arguments view


Figure 4. The second scenario is about the doctor of a requesting to access to the medical records of the user. This time the allow_full_access option is competing with the deny option. In this case deny wins. The user just selects deny and adds the model. However, there is a special context that the user gives consent when full access is allowed. The user selects allow_full_access and adds a new predicate (consent). Then the user hits the add model button again.

The arguments view


Figure 5. In the third level there is only one scenario, the doctor of a requesting to access to the medical records of the user, and the latter consents. The user just selects allow_full_access and adds the model.

The arguments view


You can test your policy using the following scenaria

<1, {request(ag,data)}, deny(ag,data)>

<2, {request(ag,data), doctor(ag)}, deny(ag,data)>

<3, {request(ag,data), doctor(ag),medical(data)}, allow_partial(ag,data)>

<4, {request(ag,data), doctor(ag),medical(data),consent},allow_partial(ag,data), allow_full(ag,data)>


Figure 6. In the Execute view the user can test the decision policy. In the figure, the fourth test scenario is put to test.

The arguments view


ChallengeTop of Page

Once you have finished, extend your program with the additional policy requirement: When the user decides to protect his/her medical records the doctor is not allowed any access (i.e. is denied access) to the medical records.

Download filesTop of Page

You can download this tutorial's file (and the extended version answering the challenge) from the following link:,

Then, start Gorgias-B and select File->Import Gorgias File and open the desired file. The file assumes that you have unzipped the Gorgias-B system in C:\ and that you stored the downloaded files in the C:\GorgiasB folder. If something is different in your system then, after importing the Gorgias file, select File->Gorgias Lib Folder and select the gorgias-src-0.6d folder (it is located in the GorgiasB installation folder). Now you are ready to work with this project...