Denotational Semantics for ODRL: Knowledge-Based Constraint Conflict Detection

Abstract: ODRL's six set-based operators -- isA, isPartOf, hasPart, isAnyOf, isAllOf, isNoneOf -- depend on external domain knowledge that the W3C specification leaves unspecified. Without it, every cross-dataspace policy comparison defaults to Unknown. We present a denotational semantics that maps each ODRL constraint to the set of knowledge-base concepts satisfying it. Conflict detection reduces to denotation intersection under a three-valued verdict -- Conflict, Compatible, or Unknown -- that is sound under incomplete knowledge. The framework covers all three ODRL composition modes (and, or, xone) and all three semantic domains arising in practice: taxonomic (class subsumption), mereological (part-whole containment), and nominal (identity). For cross-dataspace interoperability, we define order-preserving alignments between knowledge bases and prove two guarantees: conflicts are preserved across different KB standards, and unmapped concepts degrade gracefully to Unknown -- never to false conflicts. A runtime soundness theorem ensures that design-time verdicts hold for all execution contexts. The encoding stays within the decidable EPR fragment of first-order logic. We validate it with 154 benchmarks across six knowledge base families (GeoNames, ISO 3166, W3C DPV, a GDPR-derived taxonomy, BCP 47, and ISO 639-3) and four structural KBs targeting adversarial edge cases. Both the Vampire theorem prover and the Z3 SMT solver agree on all 154 verdicts. A key finding is that exclusive composition (xone) requires strictly stronger KB axioms than conjunction or disjunction: open-world semantics blocks exclusivity even when positive evidence appears to satisfy exactly one branch.

• The paper introduces a denotational ODRL semantics that models constraints as knowledge-base concept sets and returns Conflict, Compatible, or Unknown, with soundness under accurate but incomplete knowledge.
• The framework is mechanically verified through 44 Isabelle/HOL results and validated by unanimous Vampire and Z3 agreement across 154 benchmarks covering operators, logical composition, alignment, and runtime behavior.
• The paper proves that cross-knowledge-base alignment can preserve conflicts or safely degrade results to Unknown, while exclusive disjunction requires stronger negative evidence than conjunction or disjunction.

The Open Digital Rights Language (ODRL) defines set-based constraint operators—isA, isPartOf, hasPart, isAnyOf, isAllOf, isNoneOf—whose evaluation requires external domain knowledge that the W3C specification deliberately leaves unspecified. In the absence of such knowledge, every cross-dataspace policy comparison defaults to Unknown, producing a de facto "default deny" posture that blocks legitimate data sharing. This paper develops a denotational semantics for ODRL constraints in which conflict detection reduces to intersection of constraint denotations, yielding a three-valued verdict—Conflict, Compatible, or Unknown—that is provably sound under incomplete knowledge. The framework is mechanically verified in Isabelle/HOL and validated empirically with 154 benchmarks on which the Vampire theorem prover and the Z3 SMT solver agree on every verdict.

Motivating challenges

The paper grounds its contribution in a running scenario from the German cultural dataspace (Datenraum Kultur): the Bayerische Staatsbibliothek permits access to digitized German-language manuscripts for non-commercial use within Europe, and a French national archive requests access from France, in French, for scientific research. Four escalating challenges arise:

• Single-KB grounding: without a knowledge base (KB), the ODRL engine sees incomparable strings. Grounding against GeoNames, BCP 47, and W3C DPV yields per-dimension verdicts—Compatible (France $\preceq$ Europe), Unknown (DPV classifies scientific research under R&D without committing to the commercial/non-commercial distinction), and Conflict (French $\not\sqsubseteq$ German).
• Cross-dataspace composition: three constraint dimensions must overlap simultaneously under conjunction; a single Conflict blocks the request, and the framework must identify which dimension caused the failure.
• Cross-standard alignment: the two parties use different KB standards (GeoNames/DPV/BCP 47 vs. ISO 3166/GDPR-derived taxonomy/ISO 639-3). Conflicts detected in one KB must be preserved under translation; unmapped concepts must degrade to Unknown, never to false Conflicts.
• Policy quality assurance: self-contradictions (e.g., a purpose required to be simultaneously commercial and academic) and redundancies (requiring France and Europe, since France $\preceq$ Europe) must be detectable at design time.

The semantic grounding framework

A constraint is a triple $(\ell, \bowtie, v)$ of left operand, operator, and right operand value. A KB for operand $\ell$ is a structure $$\mathcal{KB}_\ell = (C, \leq, \perp\!\!\!\perp, \gamma)$$: a finite concept set, a reflexive transitive order, a symmetric irreflexive disjointness relation with downward closure, and a partial grounding map $\gamma$ from operand values to concepts. The framework requires only $\leq$ and $\perp\!\!\!\perp$; the paper classifies ODRL's 14 KB-dependent left operands into three semantic domains—taxonomic (purpose, language, etc.), mereological (spatial, virtualLocation), and nominal (device, event, etc.)—with the nominal case reducing $\leq$ to identity and $\not\sqsubseteq$0 to distinctness. A lemma establishes disjointness–order consistency: if $\not\sqsubseteq$1 then $\not\sqsubseteq$2.

Each constraint maps to a denotation—the set of KB concepts satisfying it. Equality operators yield singleton and complement denotations; isA and isPartOf both yield downward closure $\not\sqsubseteq$3 (the operator label is redundant; the semantic distinction is carried by KB selection), hasPart yields upward closure, and the set-valued operators combine these closures via union and intersection. An ungroundable value yields the epistemic indeterminate $\not\sqsubseteq$4, distinct from the universal concept. Conflict detection applies a conservative intersection under which a provably empty denotation yields Conflict regardless of the other operand, while any $\not\sqsubseteq$5 yields Unknown. The soundness theorem states that a Conflict verdict entails that no value simultaneously satisfies both constraints; the proof rests on an explicit KB correctness assumption—KBs may be incomplete but contain no incorrect positive or negative assertions. This is a substantive assumption: the guarantee holds only for KBs whose subsumption and disjointness assertions are accurate.

Composition across ODRL's three modes follows strong Kleene ($\not\sqsubseteq$6) three-valued semantics, chosen over supervaluations (incompatible with decidable EPR), Bochvar (too conservative), and paraconsistent logics (which address inconsistency rather than incompleteness). The paper's most notable theoretical finding is that exclusive disjunction (xone) requires strictly stronger KB axioms than and or or: compatibility under xone demands provable non-overlap of all but one branch—via explicit $\not\sqsubseteq$7 axioms, contradictory operators, or structural impossibility. Open-world semantics forces Unknown even when positive evidence appears to satisfy exactly one branch. Composition soundness additionally relies on an operand independence assumption: KB axioms are operand-local and witnesses for distinct operands are drawn from disjoint domains, which justifies decomposing multi-operand verdicts into independent per-operand tests.

The framework also supports constraint subsumption (refinement), with a conflict propagation lemma: if $\not\sqsubseteq$8 and $\not\sqsubseteq$9 conflicts with $\preceq$0, then $\preceq$1 conflicts with $\preceq$2.

Cross-KB alignment

For interoperability between dataspaces using different KB standards, the paper defines an alignment as an injective partial function between concept spaces preserving the order biconditionally and disjointness one-directionally, plus a witness completeness condition: all concepts below a mapped grounding value must themselves be mapped. The necessity of this condition is demonstrated by a counterexample in which an order- and disjointness-preserving alignment lacking witness completeness fabricates a Conflict from a Compatible verdict by dropping the shared witness. Three alignment configurations arise—total (verdicts fully preserved), partial (degradation toward Unknown), and empty (all verdicts default to Unknown). Under witness completeness, the central safety property holds: alignment can only weaken verdicts toward Unknown and never fabricates conflicts. A KB monotonicity proposition further guarantees that extending $\preceq$3 or $\preceq$4 never reverses definite verdicts, though Unknown may resolve in either direction—soundness is not completeness, and Unknown may conceal conflicts that only manifest at runtime.

Runtime soundness and mechanical verification

The concept-level semantics is bridged to enforcement via execution contexts and a satisfaction relation in which runtime values without KB counterparts fail the constraint—a default-deny stance at enforcement complementing the conservative Unknown at analysis time. The runtime soundness theorem guarantees that a design-time Conflict verdict holds for every execution context, justifying static rejection of incompatible constraint combinations during policy authoring.

All meta-theorems—44 results with zero admitted proofs—are mechanically verified in Isabelle/HOL 2025 across three locales (knowledge_base, kb_extension, alignment), with all proofs discharged by automated tactics. This is a strong verification claim, and the fact that no manual proof scripts were required reflects that the definitions were deliberately kept within a fragment the simplifier handles natively.

Evaluation

The benchmark suite comprises 154 problems in 19 categories, each encoded in both TPTP and SMT-LIB and evaluated by two independent provers—Vampire (superposition calculus) and Z3 (DPLL(T))—which agree on all 154 verdicts, providing dual-prover concordance as a correctness check. Coverage includes:

• Operator coverage (90 problems): all eight operators across all three semantic domains, including complement-collapse edge cases ($\preceq$5), hasPart/isPartOf inversion, transitive closure over a depth-5 chain, diamond inheritance over a DAG, single-concept degenerate cases, and near-miss overlap. Nominal-domain tests confirm that isA degenerates to eq and isAllOf requires value coincidence, validating that operator semantics is determined by the KB relation rather than the operator name.
• Logical composition (21 problems): all three modes. The xone finding is demonstrated concretely: two structurally symmetric problems over xone(commercial, nonCommercial) yield different verdicts (Compatible vs. Unknown) depending on asymmetric negative-axiom coverage in the DPV KB. Notably, xone is evaluated at the meta-level by composing per-branch verdicts, since encoding it directly would require a $\preceq$6 prefix, breaking EPR and forfeiting decidability. A branch-aware refinement of the exclusivity test strictly reduces Unknown verdicts without affecting soundness.
• Cross-KB alignment (23 problems): three alignment pairs with complete coverage plus adversarial cases (unmapped witnesses, operator coverage across aligned KBs, simultaneous multi-domain degradation). Across all 23 tests, no false Conflict arises, and degradation tests include paired checks confirming that Unknown verdicts are genuinely indeterminate rather than accidentally resolved.
• Runtime semantics (6 problems): witness extraction, pointwise rejection, and an exhaustive finite-model check confirming that no BCP 47 concept satisfies both constraints in a conflict pair.

Limitations and open questions

The paper is explicit about several constraints on its results. The framework operates at the constraint level—it determines whether constraint denotations can co-exist, not whether a complete ODRL rule activates—and is therefore complementary to, rather than a replacement for, the W3C ODRL formal semantics' operational rule-activation semantics. Soundness depends on the KB correctness assumption (no incorrect positive or negative assertions) and on operand independence; violations of either would undermine the guarantees. The evaluation covers only 3 of the 14 KB-dependent operands in depth, with the remaining 11 left for future work. Rule-level conflict detection—composing constraint-level verdicts with permission/prohibition resolution—and a standardized KB registry for discovering verified alignments remain open. Related work discussion and empirical runtime analysis are deferred to an extended version, so the paper provides no runtime performance figures.

Conclusion

The paper contributes a denotational semantics for all eight KB-dependent ODRL operators under a three-valued verdict sound under incomplete knowledge, a decidable EPR encoding with bidirectional denotation rules and composition semantics for and, or, and xone, and cross-KB alignment with proven verdict preservation and graceful degradation. The mechanical verification of all 44 meta-results in Isabelle/HOL and the unanimous Vampire/Z3 agreement across 154 benchmarks provide unusually strong validation for a policy-semantics proposal. The demonstration that xone requires strictly stronger KB axioms than and/or—and that open-world semantics blocks exclusivity despite positive single-branch evidence—carries practical weight for dataspace implementers, as does the guarantee that alignment never fabricates conflicts. The framework's scope remains constraint-level, and extending it to rule activation and broader operand coverage are the principal questions the work leaves open.