Hi EEA COP PGB – I have a proposal of sorts that I’d like to bring up in the next meeting to evaluate is this is something EEA should/wants to be involved in:

Token Ownership Derived Authorization:

TL;DR:  We need a standard way to access off-chain metadata using token ownership as the authorization.

Background: In the context of a token that represents a physical product a given token will have a lifecycle that begins when the product is produced and ends when the product is consumed.  Along this lifecycle the token will change hands (be transferred from one wallet to another) several, or perhaps many, times.  In addition to the transaction history for a given token (which is on-chain), “data” about the product will be stored as metadata in various off-chain databases.  These may be traditional databases or decentralized data storage such as IPFS or the OpenDSU used by PharmaLedger, regardless of where it is stored, the Token URI in a given transaction will contain a pointer to where the metadata is stored in reference to that transaction (note that the URI will change upon each metadata update, and so getting a complete record of the metadata may require following multiple URIs).  In general, the metadata should not be publicly available.

Approach: To enable transparency within a supply chain any current or previous owner of a token will require access to the off-chain metadata which will likely be stored in multiple data sources. Token Ownership Derived Authorization (TODA) is an attempt to eliminate the need for a separate access control layer to be built on top of the network which automates that authorization of a user to access off-chain data.  It is not dissimilar to the idea of token gating access to certain resources, except that TODA will facilitate the return of specific data from a database for a specific token.

The actual structure of the data is likely to be industry specific and is outside of the scope of this effort, though there is likely to be some requirement to encapsulate the data with the token ID.

Ask of EEA PGB: We believe that in order for enterprise supply chain use cases to be scalable a generally accepted standard for performing TODA via an API will be necessary.  Similar to the work that Spruce Labs is leading through Sign-In with Ethereum (SIWE), we believe that this needs to be an opensource public good.  In-fact we believe this should be an extension of SIWE that is focused toward enterprise use cases and therefore should be an EEA community effort in conjunction with Spruce Labs (FYI, I have not contacted Spruce Labs about this yet).