Background
- Data layer access in Synapse requires one or more approval steps.
- In Synapse granting data access is synonymous with providing the URL to the stored data.
(This URL may have an embedded access token.)
- Currently (i.e. as of Jan. 2012), the backend has a representation of EULAs and of Agreements (i.e. that a particular user agrees to a EULA)
- The work flow logic for creating the agreement is embedded in the Web client, so other clients would have to maintain duplicate logic.
- There is no provision in our permissions scheme for an "IRB role" which can grant or revoke 'download permission' to a user.
- Currently we've identified three tiers of access restriction/approval:
Tier 1: User agrees to a generic EULA that applies to all data layers available through Synapse.
Tier 2: (Tier 1) + User agrees to a second EULA specific to certain data layers.
Tier 3: (Tier 1) + (Tier 2) + User access must be requested/approved through an institutional review board (IRB).
Straw man design
Security Model
- A "role" is a collection of permissions.