Refactor trusted access and access grants

proposals/specification/agent.bs

@@ -98,7 +98,9 @@ assigned to each [=Registry Set=], depending on the sensitivity of the
     interop:hasRemoteDataRegistrySet <https://alice.pod.example/profile/remote#set> ;
     ######## Inboxes ########
     interop:hasInbox <https://alice.pod.example/inbox/general> ;
-    interop:hasAccessInbox <https://alice.pod.example/inbox/access> .
+    interop:hasAccessInbox <https://alice.pod.example/inbox/access> ;
+    ######## Options ########
+    interop:receivesAccessReceipt interop:ReceiptInMessage .
   </pre>
 </figure>
 
@@ -159,6 +161,14 @@ of software with an [=identity=] that can be strongly authenticated.
       <td>ldp:inbox</td>
       <td>An inbox for access related messages sent to the [=Agent=]</td>
     </tr>
+    <tr>
+      <td>receivesAccessReceipt</td>
+      <td>interop:ReceiptInMessage,
+      interop:ReceiptInRegistration</td>
+      <td>Identifies whether [=Access Receipts=] should be sent directly
+      to the [=Application=] or provided in the [=Application Registration=]
+      if the [=Agent=] is also an [=Application=]</td>      
+    </tr>
   </tbody>
 </table>
 
@@ -174,7 +184,8 @@ The [AgentShape](#shexAgent) is used to validate an instance of the
   interop:hasAccessReceiptRegistrySet IRI ;
   interop:hasRemoteDataRegistrySet IRI ;
   interop:hasInbox IRI ;
-  interop:hasAccessInbox IRI
+  interop:hasAccessInbox IRI ;
+  interop:receivesAccessReceipt [ interop:ReceiptInMessage interop:ReceiptInRegistration ]
 }
 </pre>
 
@@ -186,8 +197,7 @@ is assigned to a resource to ensure it will validate against the
 <#AgentTree>
   a st:ShapeTree;
   st:expectsType st:ShapeTreeResource ;
-  st:validatedBy &lt;interops#AgentShape&gt; ;
-  st:matchesUriTemplate "{id}" .
+  st:validatedBy &lt;interops#AgentShape&gt; .
 </pre>
 
 ## Resource Hierarchy ## {#agents-hierarchy}

proposals/specification/application-registration.bs

@@ -72,10 +72,11 @@ via the [interop:hasRegistration](interop.ttl#hasRegistration) property.
   <pre highlight="turtle">
   <#registry>
     a interop:ApplicationRegistry ;
-    interop:hasRegistration &lt;705563552198b6fb3efc40717872aa2ec35d669c1095cc5d665f499ec5d7e23a/#registration&gt; ,
-                        &lt;ede6aa50cb9e5fc564fdb4f0dc661685825ee3178355214086be27f9830e2a42/#registration&gt; ,
-                        &lt;150dca42b3d5661ba10a28e0aff36f212e27b0f7463fe1ef3bf1b5a45b640673/#registration&gt; ,
-                        &lt;b3564e72a3877c9cfa9e4bc4d9e47e9b7c536ae9927407c8dd00ec3b0069f536/#registration&gt; .
+    interop:hasRegistration 
+      &lt;705563552198b6fb3efc40717872aa2ec35d669c1095cc5d665f499ec5d7e23a/#registration&gt; ,
+      &lt;ede6aa50cb9e5fc564fdb4f0dc661685825ee3178355214086be27f9830e2a42/#registration&gt; ,
+      &lt;150dca42b3d5661ba10a28e0aff36f212e27b0f7463fe1ef3bf1b5a45b640673/#registration&gt; ,
+      &lt;b3564e72a3877c9cfa9e4bc4d9e47e9b7c536ae9927407c8dd00ec3b0069f536/#registration&gt; .
   </pre>
 </figure>
 
@@ -144,8 +145,7 @@ is assigned to a resource to ensure it will validate against the
 <#ApplicationRegistrySetTree>
   a st:ShapeTree;
   st:expectsType st:ShapeTreeResource ;
-  st:validatedBy &lt;interops#ApplicationRegistrySetShape&gt; ;
-  st:matchesUriTemplate "application" .
+  st:validatedBy &lt;interops#ApplicationRegistrySetShape&gt; .
 </pre>
 
 ### Application Registry ### {#datamodel-application-registry}
@@ -294,8 +294,7 @@ added, it is validated against [AccessReceiptTree](#treeAccessReceipt).
   st:expectsType st:ShapeTreeContainer ;
   st:validatedBy &lt;interops#ApplicationRegistrationShape&gt; ;
   st:contains <#AccessReceiptTree> ,
-                st:AllowAll ;
-  st:matchesUriTemplate "{id}" .
+                st:AllowAll .
 </pre>
 
 ## Resource Hierarchy ## {#appreg-hierarchy}
@@ -653,3 +652,9 @@ This operation creates a new [=Application Registration=], and
 1. Assign permissions for `REG` per the [[#appreg-permissions]]
 1. Link `REG` to `REGISTRY` via `REGISTRY hasRegistration`
 1. Return `REG`
+
+## Application Services ## {#appreg-services}
+
+### Register Application ### {#appreg-service-registerapp}
+
+Issue: Define app registration service

proposals/specification/application.bs

@@ -39,7 +39,8 @@ by linking to [=Access Need Groups=] via the
     interop:applicationAuthor <https://app.example/org/id#agent> ;
     interop:applicationAuthorName "Example Organization" ;
     interop:applicationThumbnail <https://app.example/profile/thumb.svg> ;
-    interop:hasAccessNeedGroup <#exampleAccessNeedGroup> .
+    interop:hasAccessNeedGroup <#exampleAccessNeedGroup> ;
+    interop:receivesAccessReceipt interop:ReceiptInRegistration .
   </pre>
 </figure>
 
@@ -97,6 +98,13 @@ they've been granted access to.
       <td>[=Access Need Group=] representing types of data the
       [=Application=] needs to operate</td>
     </tr>
+    <tr>
+      <td>receivesAccessReceipt</td>
+      <td>interop:ReceiptInMessage,
+      interop:ReceiptInRegistration</td>
+      <td>Identifies whether [=Access Receipts=] should be sent directly
+      to the [=Application=] or provided in the [=Application Registration=]</td>      
+    </tr>
   </tbody>
 </table>
 
@@ -112,6 +120,7 @@ The [ApplicationShape](#shexApplication) is used to validate an instance of the
   interop:applicationAuthorName xsd:string ;
   interop:applicationThumbanil IRI? ;
   interop:hasAccessNeedGroup IRI* ;
+  interop:receivesAccessReceipt [ interop:ReceiptInMessage interop:ReceiptInRegistration ]
 }
 </pre>
 
@@ -123,8 +132,7 @@ is assigned to a resource to ensure it will validate against the
 <#ApplicationTree>
   a st:ShapeTree;
   st:expectsType st:ShapeTreeResource ;
-  st:validatedBy &lt;interops#ApplicationShape&gt; ;
-  st:matchesUriTemplate "{id}" .
+  st:validatedBy &lt;interops#ApplicationShape&gt; .
 </pre>
 
 ## Resource Hierarchy ## {#app-hierarchy}
@@ -232,3 +240,18 @@ The permission model for the resources detailed in
     </tbody>
   </table>
 </figure>
+
+## Application Services ## {#app-services}
+
+### Load Application Service ### {#load-application-service}
+
+Issue: Detail how an application service is looked up in the
+[=Application=] Profile.
+
+### Redirect to Application Service ### {#redirect-to-application-service}
+
+Issue: Detail how an [=Agent=] can be redirected to an application service 
+
+### Return from Application Service ### {#return-from-application-service}
+
+Issue: detail how an [=Agent=] is returned back from an application service