Entity based access control

For HTTP

For each Entity:

• Can User read the Entity
  • Based on just the Entity
    • User can read Thing X
  • Based on a linked Entity
    • User can read Observations in Datastreams of Thing X
• Can User Create the Entity
  • Based on just the EntityType
    • User can only create Observations
  • Based on a linked Entity that already exists
    • User can only create Observations in Datastreams of Thing X
      • with the autogenerated FeatureOfInterest
      • with an existing FeatureOfInterest
      • with a new FeatureOfInterest
    • User can create a Datastream for Thing X, Sensor Y and ObservedProperty Z
• Can User link two Entities?
  • User can link Datastream X to ObservedProperty Y
  • User can link Observation X (currently linked to Datastream Y) to Datastream Z

If a user can not read an Entity, they can not link to the Entity. A user may be able to read an Entity, but not be allowed to link to that Entity.

For MQTT

Default: Check for each user for each entity