@twin.org/rights-management-plugins 0.0.3-next.25 → 0.0.3-next.26

package/dist/es/policyArbiters/defaultPolicyArbiter.js

@@ -3,7 +3,7 @@
 import { ArrayHelper, Coerce, ComponentFactory, GeneralError, Guards, Is, ObjectHelper } from "@twin.org/core";
 import { JsonPathHelper } from "@twin.org/data-json-path";
 import { OdrlPolicyHelper, PolicyDecision, PolicyObligationEnforcerFactory } from "@twin.org/rights-management-models";
-import { OdrlConflictStrategyType, OdrlLogicalConstraintType, OdrlOperatorType } from "@twin.org/standards-w3c-odrl";
+import { OdrlConflictStrategyType, OdrlLogicalConstraintType, OdrlOperatorType, OdrlTypes } from "@twin.org/standards-w3c-odrl";
 /**
  * Default Policy Arbiter.
  */
@@ -13,25 +13,25 @@ export class DefaultPolicyArbiter {
      */
     static CLASS_NAME = "DefaultPolicyArbiter";
     /**
-     * Type indicating the operand type is JSONPath.
+     * Default maximum inheritance depth.
      * @internal
      */
-    static _JSON_PATH_TYPE = "jsonpath";
+    static _DEFAULT_MAX_INHERITANCE_DEPTH = 10;
     /**
-     * Prefix indicating the operand encodes a JSONPath.
+     * TWIN prefix operations.
      * @internal
      */
-    static _JSON_PATH_OPERAND_PREFIX = `twin:${DefaultPolicyArbiter._JSON_PATH_TYPE}`;
+    static _TWIN_PREFIX_OPERATIONS = "twin:";
     /**
-     * Prefix indicating the permission target references an item in the information map.
+     * TWIN prefix JSONPath.
      * @internal
      */
-    static _INFORMATION_TARGET_PREFIX = "twin:information:";
+    static _TWIN_PREFIX_JSONPATH = "jsonpath";
     /**
-     * Default maximum inheritance depth.
+     * TWIN prefix information.
      * @internal
      */
-    static _DEFAULT_MAX_INHERITANCE_DEPTH = 10;
+    static _TWIN_PREFIX_INFORMATION = "information";
     /**
      * The logging component.
      * @internal
@@ -75,6 +75,14 @@ export class DefaultPolicyArbiter {
      */
     async decide(agreement, information, data, action) {
         Guards.object(DefaultPolicyArbiter.CLASS_NAME, "agreement", agreement);
+        // ODRL policy profiles extend the vocabulary with additional semantics (e.g. custom
+        // operators, left operands). Without profile-aware evaluation logic the arbiter
+        // cannot guarantee correctness, so any policy that declares a profile is rejected.
+        if (Is.notEmpty(agreement.profile)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "policyProfileNotSupported", {
+                policyId: OdrlPolicyHelper.getUid(agreement) ?? ""
+            });
+        }
         await this._logging.log({
             level: "info",
             source: DefaultPolicyArbiter.CLASS_NAME,
@@ -86,74 +94,251 @@ export class DefaultPolicyArbiter {
         });
         // Resolve and merge inherited policies.
         const mergedPolicy = await this.mergeInheritedPolicies(agreement);
+        const expandedPolicy = this.expandCompactPolicyRules(mergedPolicy);
+        const dataSources = {
+            [`${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}`]: data,
+            [`${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_INFORMATION}`]: information
+        };
         // Extract agreement parties once for use in rule evaluation
         const agreementAssigner = OdrlPolicyHelper.getPartyIds(agreement.assigner);
         const agreementAssignee = OdrlPolicyHelper.getPartyIds(agreement.assignee);
-        // ODRL-style rule evaluation:
-        // - Permission rules authorize if ANY applicable permission matches (OR across permissions).
-        // - Default to denied when there are no permissions (closed-world for access control).
-        // - Conflict strategy controls how applicable permissions/prohibitions are resolved.
-        const permissions = ArrayHelper.fromObjectOrArray(mergedPolicy.permission ?? []);
-        let permissionApplies = false;
-        if (permissions.length > 0) {
-            for (const permission of permissions) {
-                if (await this.evaluatePermission(agreementAssigner, agreementAssignee, mergedPolicy, permission, information, data, action)) {
-                    permissionApplies = true;
-                    break;
+        const obligationsFulfilled = await this.evaluatePolicyObligations(agreementAssigner, agreementAssignee, expandedPolicy, dataSources);
+        // ODRL-style rule evaluation grouped by decision target:
+        // - Permission rules authorize if ANY applicable permission on the same target matches.
+        // - Default to denied when no permission applies on a target (closed-world for access control).
+        // - Conflict strategy controls how applicable permissions/prohibitions are resolved per target.
+        const targetStates = Object.create(null);
+        const permissions = ArrayHelper.fromObjectOrArray(expandedPolicy.permission ?? []);
+        for (const permission of permissions) {
+            const decisionTargets = this.resolveRuleDecisionTargets(permission, dataSources);
+            for (const decisionTarget of decisionTargets) {
+                const state = this.getOrCreateTargetState(targetStates, decisionTarget.target);
+                if (await this.evaluatePermission(agreementAssigner, agreementAssignee, expandedPolicy, permission, decisionTarget.refinements, dataSources, action, decisionTarget.target)) {
+                    state.permissionApplies = true;
                 }
             }
         }
-        const prohibitions = ArrayHelper.fromObjectOrArray(mergedPolicy.prohibition ?? []);
-        let prohibitionApplies = false;
+        const prohibitions = ArrayHelper.fromObjectOrArray(expandedPolicy.prohibition ?? []);
         for (const prohibition of prohibitions) {
-            if (this.evaluateProhibition(agreementAssigner, agreementAssignee, prohibition, data, action)) {
-                prohibitionApplies = true;
-                break;
+            const decisionTargets = this.resolveRuleDecisionTargets(prohibition, dataSources);
+            for (const decisionTarget of decisionTargets) {
+                if (await this.evaluateProhibition(expandedPolicy, agreementAssigner, agreementAssignee, prohibition, decisionTarget.refinements, dataSources, action, decisionTarget.target)) {
+                    const state = this.getOrCreateTargetState(targetStates, decisionTarget.target);
+                    state.prohibitionApplies = true;
+                }
             }
         }
-        const conflictStrategy = mergedPolicy.conflict ?? OdrlConflictStrategyType.Invalid;
-        let decision;
-        if (permissionApplies && prohibitionApplies) {
-            switch (conflictStrategy) {
-                case OdrlConflictStrategyType.Perm:
-                    decision = PolicyDecision.Granted;
-                    break;
-                case OdrlConflictStrategyType.Prohibit:
-                case OdrlConflictStrategyType.Invalid:
-                default:
-                    decision = PolicyDecision.Denied;
-                    break;
+        const conflictStrategy = expandedPolicy.conflict ?? OdrlConflictStrategyType.Invalid;
+        if (Object.keys(targetStates).length === 0) {
+            // Closed-world fallback when the policy has no rules at all.
+            return [{ decision: PolicyDecision.Denied, target: "$" }];
+        }
+        const decisions = [];
+        for (const [target, state] of Object.entries(targetStates)) {
+            let decision;
+            if (state.permissionApplies && state.prohibitionApplies) {
+                switch (conflictStrategy) {
+                    case OdrlConflictStrategyType.Perm:
+                        decision = PolicyDecision.Granted;
+                        break;
+                    case OdrlConflictStrategyType.Prohibit:
+                    case OdrlConflictStrategyType.Invalid:
+                    default:
+                        decision = PolicyDecision.Denied;
+                        break;
+                }
+            }
+            else {
+                decision = state.permissionApplies ? PolicyDecision.Granted : PolicyDecision.Denied;
             }
+            if (!obligationsFulfilled) {
+                decision = PolicyDecision.Denied;
+            }
+            decisions.push({
+                decision,
+                target
+            });
         }
-        else {
-            decision = permissionApplies ? PolicyDecision.Granted : PolicyDecision.Denied;
+        return decisions;
+    }
+    /**
+     * Expand compact/compound policy rule forms into atomic rules.
+     * ODRL 2.7 allows compact forms where rule properties can be arrays.
+     * Evaluation in this arbiter is performed on expanded atomic rules.
+     * @param policy The policy to expand.
+     * @returns A policy with expanded rule arrays.
+     * @internal
+     */
+    expandCompactPolicyRules(policy) {
+        const expandedPermissions = this.expandRules(ArrayHelper.fromObjectOrArray(policy.permission ?? []));
+        const expandedProhibitions = this.expandRules(ArrayHelper.fromObjectOrArray(policy.prohibition ?? []));
+        const expandedObligations = this.expandRules(ArrayHelper.fromObjectOrArray(policy.obligation ?? []));
+        return {
+            ...policy,
+            permission: expandedPermissions.length > 0 ? expandedPermissions : undefined,
+            prohibition: expandedProhibitions.length > 0 ? expandedProhibitions : undefined,
+            obligation: expandedObligations.length > 0 ? expandedObligations : undefined
+        };
+    }
+    /**
+     * Expand a rule list into atomic rules.
+     * @param rules The rules to expand.
+     * @returns Expanded atomic rules.
+     * @internal
+     */
+    expandRules(rules) {
+        const expanded = [];
+        for (const rule of rules) {
+            expanded.push(...this.expandRule(rule));
+        }
+        return expanded;
+    }
+    /**
+     * Expand a single compact/compound rule into atomic rules.
+     * @param rule The rule to expand.
+     * @returns Expanded atomic rules.
+     * @internal
+     */
+    expandRule(rule) {
+        const targets = this.normalizeRuleField(rule.target);
+        const actions = this.normalizeRuleField(rule.action);
+        const assigners = this.normalizeRuleField(rule.assigner);
+        const assignees = this.normalizeRuleField(rule.assignee);
+        const expanded = [];
+        for (const target of targets) {
+            for (const action of actions) {
+                for (const assigner of assigners) {
+                    for (const assignee of assignees) {
+                        const atomicRule = { ...rule };
+                        atomicRule.target = target;
+                        atomicRule.action = action;
+                        atomicRule.assigner = assigner;
+                        atomicRule.assignee = assignee;
+                        expanded.push(atomicRule);
+                    }
+                }
+            }
+        }
+        return expanded;
+    }
+    /**
+     * Normalize a potentially compact rule field into an array for expansion.
+     * @param value The field value.
+     * @returns Normalized values (or a single undefined when not provided).
+     * @internal
+     */
+    normalizeRuleField(value) {
+        if (Is.undefined(value)) {
+            return [undefined];
+        }
+        const values = ArrayHelper.fromObjectOrArray(value);
+        return values.length > 0 ? values : [undefined];
+    }
+    /**
+     * Get an existing target state or create an initial state if it doesn't exist.
+     * @param targetStates The dictionary of target states.
+     * @param target The target key.
+     * @returns The target state.
+     * @internal
+     */
+    getOrCreateTargetState(targetStates, target) {
+        let state = targetStates[target];
+        if (Is.undefined(state)) {
+            state = {
+                permissionApplies: false,
+                prohibitionApplies: false
+            };
+            targetStates[target] = state;
         }
-        return [{ target: "$", decision }];
+        return state;
     }
     /**
      * Evaluate whether a prohibition applies.
+     * @param policy The policy containing the prohibition.
      * @param agreementAssigner The assigner ID from the agreement.
      * @param agreementAssignee The assignee ID from the agreement.
      * @param prohibition The prohibition to evaluate.
-     * @param data The request data/context.
+     * @param targetRefinements Additional constraints from target refinement.
+     * @param dataSources The operand lookup sources.
      * @param action Optional action to check against the prohibition's applicable actions.
      * @returns True if the prohibition applies.
      * @internal
      */
-    evaluateProhibition(agreementAssigner, agreementAssignee, prohibition, data, action) {
-        if (!this.isRuleApplicableToParties(prohibition, agreementAssigner, agreementAssignee)) {
+    async evaluateProhibition(policy, agreementAssigner, agreementAssignee, prohibition, targetRefinements, dataSources, action, decisionTarget) {
+        if (!this.isRuleApplicableToParties(prohibition, agreementAssigner, agreementAssignee, dataSources)) {
             return false;
         }
         // Check if the prohibition's action(s) match the requested action
-        if (!this.isActionApplicable(prohibition.action, action)) {
+        if (!this.isActionApplicable(prohibition.action, action, dataSources)) {
             return false;
         }
         // ODRL semantics: a rule without constraints is unconditional.
-        const constraints = ArrayHelper.fromObjectOrArray(prohibition.constraint ?? []);
-        if (constraints.length === 0) {
+        const constraints = [
+            ...ArrayHelper.fromObjectOrArray(prohibition.constraint ?? []),
+            ...targetRefinements
+        ];
+        if (constraints.length > 0 &&
+            !constraints.every(c => this.evaluateConstraint(c, dataSources))) {
+            return false;
+        }
+        const prohibitionTargetLookup = this.tryResolveTargetDataSource(this.buildRuleDataContextTargetId(this.getRuleDataContextTargetId(prohibition.target), decisionTarget), dataSources, true);
+        const ruleDataContext = prohibitionTargetLookup.value;
+        const remedies = ArrayHelper.fromObjectOrArray(prohibition.remedy ?? []);
+        if (remedies.length === 0) {
+            return true;
+        }
+        for (const remedy of remedies) {
+            if (!(await this.enforceDuty(policy, remedy, dataSources, ruleDataContext))) {
+                return true;
+            }
+        }
+        // Remedies satisfied: prohibition is treated as no longer infringed.
+        return false;
+    }
+    /**
+     * Evaluate all policy-level obligations.
+     * @param agreementAssigner The assigner ID from the agreement.
+     * @param agreementAssignee The assignee ID from the agreement.
+     * @param policy The policy containing obligations.
+     * @param dataSources The operand lookup sources.
+     * @returns True if all applicable obligations are fulfilled.
+     * @internal
+     */
+    async evaluatePolicyObligations(agreementAssigner, agreementAssignee, policy, dataSources) {
+        const obligations = ArrayHelper.fromObjectOrArray(policy.obligation ?? []);
+        for (const obligation of obligations) {
+            if (!(await this.evaluateObligation(agreementAssigner, agreementAssignee, policy, obligation, dataSources))) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Evaluate whether a policy-level obligation is fulfilled.
+     * @param agreementAssigner The assigner ID from the agreement.
+     * @param agreementAssignee The assignee ID from the agreement.
+     * @param policy The policy containing the obligation.
+     * @param obligation The obligation to evaluate.
+     * @param dataSources The operand lookup sources.
+     * @returns True if the obligation is not applicable or is fulfilled.
+     * @internal
+     */
+    async evaluateObligation(agreementAssigner, agreementAssignee, policy, obligation, dataSources) {
+        if (!this.isRuleApplicableToParties(obligation, agreementAssigner, agreementAssignee, dataSources)) {
             return true;
         }
-        return constraints.every(c => this.evaluateConstraint(c, data));
+        const { refinements } = this.resolveRuleTarget(obligation, dataSources);
+        const obligationTargetLookup = this.tryResolveTargetDataSource(this.getTargetId(obligation.target), dataSources, true);
+        const ruleDataContext = obligationTargetLookup.value;
+        const constraints = [
+            ...ArrayHelper.fromObjectOrArray(obligation.constraint ?? []),
+            ...refinements
+        ];
+        if (constraints.length > 0 &&
+            !constraints.every(c => this.evaluateConstraint(c, dataSources))) {
+            return true;
+        }
+        return this.enforceDuty(policy, obligation, dataSources, ruleDataContext);
     }
     /**
      * Merge inherited policies into the current policy.
@@ -171,9 +356,9 @@ export class DefaultPolicyArbiter {
             conflictStrategies.add(policy.conflict);
         }
         // Start with copies of the current policy's rules
-        const mergedPermissions = ArrayHelper.fromObjectOrArray(policy.permission ?? []).map(permission => this.applyPolicyPartiesToRule(policy, permission));
-        const mergedProhibitions = ArrayHelper.fromObjectOrArray(policy.prohibition ?? []).map(prohibition => this.applyPolicyPartiesToRule(policy, prohibition));
-        const mergedObligations = ArrayHelper.fromObjectOrArray(policy.obligation ?? []).map(obligation => this.applyPolicyPartiesToRule(policy, obligation));
+        const mergedPermissions = ArrayHelper.fromObjectOrArray(policy.permission ?? []).map(permission => this.applyPolicyDefaultsToRule(policy, permission));
+        const mergedProhibitions = ArrayHelper.fromObjectOrArray(policy.prohibition ?? []).map(prohibition => this.applyPolicyDefaultsToRule(policy, prohibition));
+        const mergedObligations = ArrayHelper.fromObjectOrArray(policy.obligation ?? []).map(obligation => this.applyPolicyDefaultsToRule(policy, obligation));
         // Merge rules from each inherited policy
         for (const inheritedPolicy of inheritedPolicies) {
             if (Is.stringValue(inheritedPolicy.conflict)) {
@@ -181,15 +366,15 @@ export class DefaultPolicyArbiter {
             }
             const inheritedPermissions = ArrayHelper.fromObjectOrArray(inheritedPolicy.permission ?? []);
             if (inheritedPermissions.length > 0) {
-                mergedPermissions.push(...inheritedPermissions.map(permission => this.applyPolicyPartiesToRule(inheritedPolicy, permission)));
+                mergedPermissions.push(...inheritedPermissions.map(permission => this.applyPolicyDefaultsToRule(inheritedPolicy, permission)));
             }
             const inheritedProhibitions = ArrayHelper.fromObjectOrArray(inheritedPolicy.prohibition ?? []);
             if (inheritedProhibitions.length > 0) {
-                mergedProhibitions.push(...inheritedProhibitions.map(prohibition => this.applyPolicyPartiesToRule(inheritedPolicy, prohibition)));
+                mergedProhibitions.push(...inheritedProhibitions.map(prohibition => this.applyPolicyDefaultsToRule(inheritedPolicy, prohibition)));
             }
             const inheritedObligations = ArrayHelper.fromObjectOrArray(inheritedPolicy.obligation ?? []);
             if (inheritedObligations.length > 0) {
-                mergedObligations.push(...inheritedObligations.map(obligation => this.applyPolicyPartiesToRule(inheritedPolicy, obligation)));
+                mergedObligations.push(...inheritedObligations.map(obligation => this.applyPolicyDefaultsToRule(inheritedPolicy, obligation)));
             }
         }
         let mergedConflict;
@@ -211,11 +396,9 @@ export class DefaultPolicyArbiter {
     /**
      * Resolve inherited policies by their UIDs from the Policy Administration Point.
      * Policies can inherit from other policies via the inheritFrom property.
-     * Detects circular inheritance and throws an exception if detected.
      * @param policy The policy that may have inheritFrom references.
      * @param visitedPolicyIds Array of policy UIDs already visited in this inheritance chain.
      * @returns Array of inherited policies fetched from the PAP.
-     * @throws GeneralError if a parent policy cannot be found or if circular inheritance is detected.
      * @internal
      */
     async resolveInheritedPolicies(policy, visitedPolicyIds, currentDepth) {
@@ -258,15 +441,17 @@ export class DefaultPolicyArbiter {
         return inheritedPolicies;
     }
     /**
-     * Apply policy-level assigner/assignee values to rules that don't override them.
+     * Apply policy-level default values (assigner, assignee, target, action) to rules that don't override them.
      * @param policy The policy providing defaults.
      * @param rule The rule to apply defaults to.
-     * @returns The rule with policy-level assigner/assignee applied.
+     * @returns The rule with policy-level defaults applied.
      * @internal
      */
-    applyPolicyPartiesToRule(policy, rule) {
+    applyPolicyDefaultsToRule(policy, rule) {
         const assigner = Is.empty(rule.assigner) ? policy.assigner : rule.assigner;
         const assignee = Is.empty(rule.assignee) ? policy.assignee : rule.assignee;
+        const target = Is.empty(rule.target) ? policy.target : rule.target;
+        const action = Is.empty(rule.action) ? policy.action : rule.action;
         const assignerIds = OdrlPolicyHelper.getPartyIds(assigner);
         const ruleAssignerIds = OdrlPolicyHelper.getPartyIds(rule.assigner);
         const assigneeIds = OdrlPolicyHelper.getPartyIds(assignee);
@@ -289,13 +474,17 @@ export class DefaultPolicyArbiter {
                 assigneeIds.length === ruleAssigneeIds.length &&
                     assigneeIds.every(id => ruleAssigneeIds.includes(id));
         }
-        if (assignerEqual && assigneeEqual) {
+        const targetEqual = target === rule.target;
+        const actionEqual = action === rule.action;
+        if (assignerEqual && assigneeEqual && targetEqual && actionEqual) {
             return rule;
         }
         return {
             ...rule,
             assigner,
-            assignee
+            assignee,
+            target,
+            action
         };
     }
     /**
@@ -306,17 +495,74 @@ export class DefaultPolicyArbiter {
      * @returns True if the rule is applicable to the agreement parties.
      * @internal
      */
-    isRuleApplicableToParties(rule, agreementAssigner, agreementAssignee) {
-        const ruleAssigners = OdrlPolicyHelper.getPartyIds(rule.assigner);
-        const ruleAssignees = OdrlPolicyHelper.getPartyIds(rule.assignee);
-        if (!this.isPartyApplicable(ruleAssigners, agreementAssigner)) {
+    isRuleApplicableToParties(rule, agreementAssigner, agreementAssignee, dataSources) {
+        const assignerContext = this.resolveRulePartyContext(rule.assigner);
+        const assigneeContext = this.resolveRulePartyContext(rule.assignee);
+        if (!this.isPartyApplicable(assignerContext.partyIds, agreementAssigner)) {
+            return false;
+        }
+        if (assignerContext.refinements.length > 0 &&
+            !assignerContext.refinements.every(c => this.evaluateConstraint(c, dataSources))) {
+            return false;
+        }
+        if (!this.isPartyApplicable(assigneeContext.partyIds, agreementAssignee)) {
             return false;
         }
-        if (!this.isPartyApplicable(ruleAssignees, agreementAssignee)) {
+        if (assigneeContext.refinements.length > 0 &&
+            !assigneeContext.refinements.every(c => this.evaluateConstraint(c, dataSources))) {
             return false;
         }
         return true;
     }
+    /**
+     * Resolve rule party identifiers and refinements.
+     * PartyCollection source values are currently not supported for party matching.
+     * @param party The rule party value.
+     * @returns Resolved party identifiers and refinement constraints.
+     * @throws GeneralError if PartyCollection source has a value.
+     * @internal
+     */
+    resolveRulePartyContext(party) {
+        const partyIds = [];
+        const refinements = [];
+        const parties = ArrayHelper.fromObjectOrArray(party ?? []);
+        for (const partyEntry of parties) {
+            if (Is.stringValue(partyEntry)) {
+                partyIds.push(partyEntry);
+            }
+            else if (Is.object(partyEntry)) {
+                // Guard against unsupported ODRL party properties
+                if (Is.notEmpty(partyEntry.assignerOf)) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "partyAssignerOfNotSupported");
+                }
+                if (Is.notEmpty(partyEntry.assigneeOf)) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "partyAssigneeOfNotSupported");
+                }
+                if (Is.notEmpty(partyEntry.partOf)) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "partyPartOfNotSupported");
+                }
+                if (OdrlPolicyHelper.getType(partyEntry) === OdrlTypes.PartyCollection) {
+                    const partyCollectionEntry = partyEntry;
+                    if (Is.stringValue(partyCollectionEntry.source)) {
+                        throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "partyCollectionSourceNotSupported", {
+                            source: partyCollectionEntry.source ?? ""
+                        });
+                    }
+                    refinements.push(...ArrayHelper.fromObjectOrArray(partyCollectionEntry.refinement ?? []));
+                }
+                else {
+                    const partyId = OdrlPolicyHelper.getUid(partyEntry);
+                    if (Is.stringValue(partyId)) {
+                        partyIds.push(partyId);
+                    }
+                }
+            }
+        }
+        return {
+            partyIds,
+            refinements
+        };
+    }
     /**
      * Determine whether a rule party constraint applies to the agreement parties.
      * Rule party is treated as a constraint: if specified, it must match at least one agreement party.
@@ -343,6 +589,7 @@ export class DefaultPolicyArbiter {
     }
     /**
      * Determine whether a rule's action(s) match the requested action.
+     * Supports exact match, includedIn hierarchy, and implies relationships.
      * If no action is specified in the rule, it applies to all actions (action-agnostic).
      * If an action is specified in the rule and a specific action is requested, they must match.
      * If an action is specified in the rule but no specific action is requested, the rule applies (general evaluation).
@@ -351,7 +598,7 @@ export class DefaultPolicyArbiter {
      * @returns True if the rule's action(s) apply.
      * @internal
      */
-    isActionApplicable(ruleActions, requestedAction) {
+    isActionApplicable(ruleActions, requestedAction, dataSources) {
         // If the rule has no action specified, it applies to all actions
         if (Is.empty(ruleActions)) {
             return true;
@@ -361,72 +608,124 @@ export class DefaultPolicyArbiter {
         if (Is.empty(requestedAction)) {
             return true;
         }
-        // Both rule actions and requested action are specified - check for match
+        const requestedActionId = Is.string(requestedAction)
+            ? requestedAction
+            : OdrlPolicyHelper.getUid(requestedAction);
+        if (!Is.stringValue(requestedActionId)) {
+            return false;
+        }
         const ruleActionArray = ArrayHelper.fromObjectOrArray(ruleActions) ?? [];
-        // Check if the requested action matches any of the rule's actions
         for (const ruleAction of ruleActionArray) {
-            const ruleActionId = Is.string(ruleAction) ? ruleAction : OdrlPolicyHelper.getUid(ruleAction);
-            const requestedActionId = Is.string(requestedAction)
-                ? requestedAction
-                : OdrlPolicyHelper.getUid(requestedAction);
-            if (Is.stringValue(ruleActionId) && Is.stringValue(requestedActionId)) {
-                if (ruleActionId === requestedActionId) {
-                    return true;
-                }
+            if (this.ruleActionCoversRequested(ruleAction, requestedActionId, dataSources)) {
+                return true;
             }
         }
         return false;
     }
+    /**
+     * Determine whether a single rule action covers a requested action.
+     * Covers exact match plus ODRL action hierarchy semantics.
+     * - includedIn: the rule action is a sub-action of a broader parent.
+     *   A rule naming the narrower action also covers requests for the parent.
+     *   E.g. rule action "print" with includedIn "reproduce" covers a request for "reproduce".
+     * - implies: the rule action entails another action.
+     *   A rule granting action X also covers action Y when X implies Y.
+     *   E.g. rule action "distribute" implying "reproduce" covers a request for "reproduce".
+     * @param ruleAction The action specified in the rule.
+     * @param requestedActionId The requested action identifier.
+     * @returns True if the rule action covers the requested action.
+     * @internal
+     */
+    ruleActionCoversRequested(ruleAction, requestedActionId, dataSources) {
+        // Extract the rule action ID — support both @id and rdf:value forms
+        let ruleActionId;
+        if (Is.string(ruleAction)) {
+            ruleActionId = ruleAction;
+        }
+        else if (Is.object(ruleAction)) {
+            ruleActionId = ruleAction["rdf:value"]?.["@id"] ?? OdrlPolicyHelper.getUid(ruleAction);
+        }
+        // Determine whether this rule action covers the requested action via any semantic path.
+        let covers = false;
+        if (Is.stringValue(ruleActionId) && ruleActionId === requestedActionId) {
+            // Exact match
+            covers = true;
+        }
+        else if (Is.object(ruleAction)) {
+            // includedIn: rule action A includedIn B means A is a sub-type of B.
+            // A rule that names the narrower action A with includedIn B also covers requests for B.
+            if (Is.stringValue(ruleAction.includedIn) && ruleAction.includedIn === requestedActionId) {
+                covers = true;
+            }
+            // implies: rule action A implies B means exercising A also entails B.
+            // A rule granting A therefore also grants each implied action.
+            if (!covers && (ruleAction.implies ?? []).includes(requestedActionId)) {
+                covers = true;
+            }
+        }
+        if (!covers) {
+            return false;
+        }
+        // If the action specifies refinements, all must be satisfied for the action to apply.
+        // Refinements constrain the manner in which the action is exercised (e.g. print count <= 5).
+        if (Is.object(ruleAction) && Is.notEmpty(ruleAction.refinement)) {
+            const refinements = ArrayHelper.fromObjectOrArray(ruleAction.refinement ?? []);
+            return refinements.every((refinement) => this.evaluateConstraint(refinement, dataSources));
+        }
+        return true;
+    }
     /**
      * Apply a permission and create decisions based on that information.
      * @param agreementAssigner The assigner ID from the agreement.
      * @param agreementAssignee The assignee ID from the agreement.
      * @param policy The policy containing the permission.
      * @param permission The permission to apply.
-     * @param information Additional facts provided by the PIP.
-     * @param data The request data/context.
+     * @param targetRefinements Additional constraints from target refinement.
+     * @param dataSources The operand lookup sources.
      * @returns True if the permission applies.
      * @internal
      */
-    async evaluatePermission(agreementAssigner, agreementAssignee, policy, permission, information, data, action) {
-        if (!this.isRuleApplicableToParties(permission, agreementAssigner, agreementAssignee)) {
+    async evaluatePermission(agreementAssigner, agreementAssignee, policy, permission, targetRefinements, dataSources, action, decisionTarget) {
+        if (!this.isRuleApplicableToParties(permission, agreementAssigner, agreementAssignee, dataSources)) {
             return false;
         }
         // Check if the permission's action(s) match the requested action
-        if (!this.isActionApplicable(permission.action, action)) {
+        if (!this.isActionApplicable(permission.action, action, dataSources)) {
             return false;
         }
         // ODRL semantics: a Permission without constraints is unconditional.
-        const constraints = ArrayHelper.fromObjectOrArray(permission.constraint ?? []);
+        const constraints = [
+            ...ArrayHelper.fromObjectOrArray(permission.constraint ?? []),
+            ...targetRefinements
+        ];
+        const permissionTargetLookup = this.tryResolveTargetDataSource(this.buildRuleDataContextTargetId(this.getRuleDataContextTargetId(permission.target), decisionTarget), dataSources, true);
+        const ruleDataContext = permissionTargetLookup.value;
         if (constraints.length === 0) {
-            return this.enforcePermissionDuties(policy, permission, information, data);
+            return this.enforcePermissionDuties(policy, permission, dataSources, ruleDataContext);
         }
-        // Resolve the data context for evaluating this permission.
-        // If the target starts with twin:information:<key>, the key references an entry in the information map.
-        const ruleDataContext = this.resolveRuleDataContext(permission, information, data);
         // All constraints must be satisfied for the permission to apply.
-        const constraintsSatisfied = constraints.every(c => this.evaluateConstraint(c, ruleDataContext));
+        const constraintsSatisfied = constraints.every(c => this.evaluateConstraint(c, dataSources));
         if (!constraintsSatisfied) {
             return false;
         }
-        return this.enforcePermissionDuties(policy, permission, information, ruleDataContext);
+        return this.enforcePermissionDuties(policy, permission, dataSources, ruleDataContext);
     }
     /**
      * Enforce duties attached to a permission.
      * @param policy The policy being evaluated.
      * @param permission The permission being evaluated.
-     * @param information Additional facts provided by the PIP.
-     * @param data The request data/context.
+     * @param dataSources The operand lookup sources.
+     * @param ruleDataContext The target-scoped data context passed to enforcers.
      * @returns True if all duties are enforced or none are present.
      * @internal
      */
-    async enforcePermissionDuties(policy, permission, information, data) {
+    async enforcePermissionDuties(policy, permission, dataSources, ruleDataContext) {
         const duties = ArrayHelper.fromObjectOrArray(permission.duty ?? []);
         if (duties.length === 0) {
             return true;
         }
         for (const duty of duties) {
-            const enforced = await this.enforceDuty(policy, duty, information, data);
+            const enforced = await this.enforceDuty(policy, duty, dataSources, ruleDataContext);
             if (!enforced) {
                 return false;
             }
@@ -437,46 +736,87 @@ export class DefaultPolicyArbiter {
      * Enforce a single duty using registered obligation enforcers.
      * @param policy The policy being evaluated.
      * @param duty The duty to enforce.
-     * @param information Additional facts provided by the PIP.
-     * @param data The request data/context.
+     * @param dataSources The operand lookup sources.
+     * @param ruleDataContext The target-scoped data context passed to enforcers.
      * @returns True if any enforcer succeeds.
      * @internal
      */
-    async enforceDuty(policy, duty, information, data) {
+    async enforceDuty(policy, duty, dataSources, ruleDataContext) {
         const enforcerNames = PolicyObligationEnforcerFactory.names();
+        const information = dataSources[`${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_INFORMATION}`];
         if (enforcerNames.length === 0) {
             throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "noObligationEnforcersRegistered");
         }
         for (const enforcerName of enforcerNames) {
             const enforcer = PolicyObligationEnforcerFactory.get(enforcerName);
-            if (await enforcer.enforce(policy, duty, information, data)) {
+            if (await enforcer.enforce(policy, duty, information, ruleDataContext)) {
                 return true;
             }
         }
-        return false;
+        const consequences = ArrayHelper.fromObjectOrArray(duty.consequence ?? []);
+        if (consequences.length === 0) {
+            return false;
+        }
+        for (const consequence of consequences) {
+            if (!(await this.enforceDuty(policy, consequence, dataSources, ruleDataContext))) {
+                return false;
+            }
+        }
+        return true;
     }
     /**
-     * Resolve the data context used when evaluating a permission's constraints.
-     * If the permission target is `twin:information:<key>`, the key references an entry in the information map.
-     * @param rule The permission being evaluated.
-     * @param information Additional facts provided by the PIP.
-     * @param data The request data/context.
-     * @returns The data context to use for JSONPath resolution.
-     * @throws GeneralError When the information target key is missing.
+     * Resolve a target string to a matching datasource prefix and remaining target value.
+     * @param targetId The target identifier to resolve.
+     * @param dataSources The available lookup sources.
+     * @param resolveValue True to resolve an item from the target path/key.
+     * @returns The matching prefix, source, remaining target and optional resolved value.
      * @internal
      */
-    resolveRuleDataContext(rule, information, data) {
-        const targetId = this.getTargetId(rule.target);
-        if (targetId?.startsWith(DefaultPolicyArbiter._INFORMATION_TARGET_PREFIX)) {
-            const key = targetId.slice(DefaultPolicyArbiter._INFORMATION_TARGET_PREFIX.length);
-            if (Is.empty(key) || Is.empty(information?.[key])) {
-                throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "informationTargetMissing", {
-                    key
-                });
+    tryResolveTargetDataSource(targetId, dataSources, resolveValue = false) {
+        // If there is no target id, default to the entire "twin:jsonpath" datasource
+        if (Is.empty(targetId)) {
+            return {
+                prefix: `${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}`,
+                source: dataSources[`${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}`],
+                target: "$",
+                value: dataSources[`${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}`]
+            };
+        }
+        // Otherwise lookup the target id prefix in the datasources and return the remaining suffix as the target path/key
+        const prefixes = Object.keys(dataSources).sort((a, b) => b.length - a.length);
+        for (const prefix of prefixes) {
+            if (targetId.startsWith(`${prefix}:`)) {
+                const source = dataSources[prefix];
+                const target = targetId.slice(prefix.length + 1);
+                if (!target.startsWith("$")) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "ruleTargetNotSupported", {
+                        target: targetId
+                    });
+                }
+                if (!resolveValue) {
+                    return {
+                        prefix,
+                        source,
+                        target
+                    };
+                }
+                const matches = JsonPathHelper.query(target, source);
+                if (matches.length === 0) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "ruleTargetNotSupported", {
+                        target: targetId
+                    });
+                }
+                return {
+                    prefix,
+                    source,
+                    target,
+                    value: matches.length === 1 ? matches[0].value : matches.map(m => m.value)
+                };
             }
-            return information[key];
         }
-        return data;
+        throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "ruleTargetNotSupported", {
+            target: targetId
+        });
     }
     /**
      * Extract the target id from the permission.
@@ -497,24 +837,267 @@ export class DefaultPolicyArbiter {
         }
         return Is.string(arr[0]) ? arr[0] : OdrlPolicyHelper.getUid(arr[0]);
     }
+    /**
+     * Resolve the target identifier used for rule data context lookup.
+     * For AssetCollection targets the `source` property is used because the collection has no `uid`.
+     * Falls back to `getTargetId` for all other target forms.
+     * @param target The rule target field value.
+     * @returns The prefixed target string for data context resolution.
+     * @internal
+     */
+    getRuleDataContextTargetId(target) {
+        const arr = ArrayHelper.fromObjectOrArray(target ?? []);
+        if (arr.length === 1) {
+            const firstTarget = arr[0];
+            if (Is.object(firstTarget) &&
+                OdrlPolicyHelper.getType(firstTarget) === OdrlTypes.AssetCollection &&
+                Is.stringValue(firstTarget.source)) {
+                return firstTarget.source;
+            }
+        }
+        return this.getTargetId(target);
+    }
+    /**
+     * Build a concrete prefixed target id for rule data-context lookup.
+     * @param baseTargetId The original prefixed target id from the rule.
+     * @param decisionTarget The concrete decision JSONPath target.
+     * @returns The concrete prefixed target id.
+     * @internal
+     */
+    buildRuleDataContextTargetId(baseTargetId, decisionTarget) {
+        if (!Is.stringValue(decisionTarget) || decisionTarget === "$") {
+            return baseTargetId;
+        }
+        if (!Is.stringValue(baseTargetId)) {
+            return undefined;
+        }
+        const pathStartIndex = baseTargetId.indexOf(":$");
+        if (pathStartIndex < 0) {
+            return baseTargetId;
+        }
+        return `${baseTargetId.slice(0, pathStartIndex)}:${decisionTarget}`;
+    }
+    /**
+     * Resolve a rule target into a policy-decision JSONPath target and extracted refinements.
+     * For AssetCollection targets, `source` is treated as the decision target and `refinement`
+     * constraints are applied as additional rule constraints.
+     * @param rule The rule to resolve the target for.
+     * @returns The decision target and target refinements.
+     * @throws GeneralError if target is invalid or unsupported.
+     * @internal
+     */
+    resolveRuleTarget(rule, dataSources) {
+        const arr = ArrayHelper.fromObjectOrArray(rule.target ?? []);
+        if (arr.length === 0) {
+            return {
+                target: "$",
+                refinements: []
+            };
+        }
+        if (arr.length > 1) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "multipleTargetsNotSupported");
+        }
+        const firstTarget = arr[0];
+        if (Is.object(firstTarget)) {
+            // Guard against unsupported ODRL asset properties
+            if (Is.notEmpty(firstTarget.hasPolicy)) {
+                throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "assetHasPolicyNotSupported");
+            }
+            if (Is.notEmpty(firstTarget.partOf)) {
+                throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "assetPartOfNotSupported");
+            }
+            if (Is.object(firstTarget) &&
+                OdrlPolicyHelper.getType(firstTarget) === OdrlTypes.AssetCollection) {
+                if (!Is.stringValue(firstTarget.source)) {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "assetCollectionSourceNotSupported", {
+                        source: firstTarget.source ?? ""
+                    });
+                }
+                let sourceLookup;
+                try {
+                    sourceLookup = this.tryResolveTargetDataSource(firstTarget.source, dataSources);
+                }
+                catch {
+                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "assetCollectionSourceNotSupported", {
+                        source: firstTarget.source
+                    });
+                }
+                return {
+                    target: sourceLookup.target,
+                    refinements: ArrayHelper.fromObjectOrArray(firstTarget.refinement ?? [])
+                };
+            }
+        }
+        const targetId = Is.string(firstTarget) ? firstTarget : OdrlPolicyHelper.getUid(firstTarget);
+        if (!Is.stringValue(targetId)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "ruleTargetNotSupported", {
+                target: ""
+            });
+        }
+        const targetLookup = this.tryResolveTargetDataSource(targetId, dataSources);
+        return {
+            target: targetLookup.target,
+            refinements: []
+        };
+    }
+    /**
+     * Resolve decision targets for a rule.
+     * AssetCollection wildcard targets with refinements are expanded to per-item targets.
+     * @param rule The rule being evaluated.
+     * @param dataSources The operand lookup sources.
+     * @returns The decision targets and scoped refinements.
+     * @internal
+     */
+    resolveRuleDecisionTargets(rule, dataSources) {
+        const resolvedTarget = this.resolveRuleTarget(rule, dataSources);
+        if (!this.shouldExpandToPerItemTargets(rule, resolvedTarget)) {
+            return [resolvedTarget];
+        }
+        const sourceLookup = this.tryResolveTargetDataSource(this.getRuleDataContextTargetId(rule.target), dataSources);
+        const matches = JsonPathHelper.query(sourceLookup.target, sourceLookup.source);
+        if (matches.length === 0) {
+            return [resolvedTarget];
+        }
+        return matches.map(match => {
+            const itemTarget = this.normalizeDecisionTargetPath(match.path ?? resolvedTarget.target);
+            return {
+                target: itemTarget,
+                refinements: resolvedTarget.refinements.map(refinement => this.rewriteRefinementForDecisionTarget(refinement, resolvedTarget.target, itemTarget))
+            };
+        });
+    }
+    /**
+     * Determine if a rule should be expanded to per-item targets.
+     * @param rule The rule.
+     * @param resolvedTarget The resolved target details.
+     * @returns True if the rule should emit per-item decisions.
+     * @internal
+     */
+    shouldExpandToPerItemTargets(rule, resolvedTarget) {
+        if (resolvedTarget.refinements.length === 0 || !resolvedTarget.target.includes("[*]")) {
+            return false;
+        }
+        const targets = ArrayHelper.fromObjectOrArray(rule.target ?? []);
+        if (targets.length !== 1 || !Is.object(targets[0])) {
+            return false;
+        }
+        return OdrlPolicyHelper.getType(targets[0]) === OdrlTypes.AssetCollection;
+    }
+    /**
+     * Rewrite a refinement so wildcard paths are scoped to a concrete item target.
+     * @param refinement The refinement to rewrite.
+     * @param sourceTarget The wildcard source target.
+     * @param itemTarget The concrete item target.
+     * @returns The rewritten refinement.
+     * @internal
+     */
+    rewriteRefinementForDecisionTarget(refinement, sourceTarget, itemTarget) {
+        const logicalConstraint = this.getLogicalConstraintOperands(refinement);
+        if (logicalConstraint) {
+            return {
+                ...refinement,
+                [logicalConstraint.operator]: logicalConstraint.constraints.map(item => this.rewriteRefinementForDecisionTarget(item, sourceTarget, itemTarget))
+            };
+        }
+        const regularConstraint = refinement;
+        return {
+            ...regularConstraint,
+            leftOperand: this.rewriteOperandForDecisionTarget(regularConstraint.leftOperand, sourceTarget, itemTarget),
+            rightOperand: this.rewriteOperandForDecisionTarget(regularConstraint.rightOperand, sourceTarget, itemTarget)
+        };
+    }
+    /**
+     * Rewrite JSONPath-based operands from wildcard source to concrete item target.
+     * @param operand The operand to rewrite.
+     * @param sourceTarget The wildcard source target.
+     * @param itemTarget The concrete item target.
+     * @returns The rewritten operand.
+     * @internal
+     */
+    rewriteOperandForDecisionTarget(operand, sourceTarget, itemTarget) {
+        if (Is.stringValue(operand)) {
+            const prefix = `${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}:`;
+            if (operand.startsWith(prefix)) {
+                const valuePath = operand.slice(prefix.length);
+                return `${prefix}${this.rewriteWildcardPath(valuePath, sourceTarget, itemTarget)}`;
+            }
+            return operand;
+        }
+        if (Is.object(operand)) {
+            const typedOperand = { ...operand };
+            if (typedOperand["@type"] ===
+                `${DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS}${DefaultPolicyArbiter._TWIN_PREFIX_JSONPATH}` &&
+                Is.stringValue(typedOperand["@value"])) {
+                typedOperand["@value"] = this.rewriteWildcardPath(typedOperand["@value"], sourceTarget, itemTarget);
+            }
+            return typedOperand;
+        }
+        return operand;
+    }
+    /**
+     * Rewrite wildcard source JSONPath segments to a concrete item JSONPath.
+     * @param valuePath The operand path.
+     * @param sourceTarget The wildcard source path.
+     * @param itemTarget The concrete item path.
+     * @returns The rewritten path.
+     * @internal
+     */
+    rewriteWildcardPath(valuePath, sourceTarget, itemTarget) {
+        if (!sourceTarget.includes("[*]") || !valuePath.includes("[*]")) {
+            return valuePath;
+        }
+        if (valuePath.startsWith(sourceTarget)) {
+            return `${itemTarget}${valuePath.slice(sourceTarget.length)}`;
+        }
+        return valuePath;
+    }
+    /**
+     * Normalize JSONPath strings to dot notation for stable decision targets.
+     * @param path The JSONPath to normalize.
+     * @returns The normalized path.
+     * @internal
+     */
+    normalizeDecisionTargetPath(path) {
+        return path.replace(/\['([^']+)']/g, ".$1");
+    }
     /**
      * Evaluate a single ODRL constraint against the available context.
      * Supports logical constraint composition through nested refinements.
      * @param constraint The constraint to evaluate.
-     * @param ruleDataContext The request data/context.
+     * @param dataSources The operand lookup sources.
      * @returns True if the constraint is satisfied.
      * @internal
      */
-    evaluateConstraint(constraint, ruleDataContext) {
+    evaluateConstraint(constraint, dataSources) {
         const logicalConstraint = this.getLogicalConstraintOperands(constraint);
         if (logicalConstraint) {
-            return this.evaluateLogicalConstraint(logicalConstraint, ruleDataContext);
+            return this.evaluateLogicalConstraint(logicalConstraint, dataSources);
         }
         // Must be a regular constraint beyond this point
         const regularConstraint = constraint;
+        // rightOperandReference is not supported — it requires an external IRI lookup that
+        // is outside the scope of the local evaluation engine.
+        if (Is.notEmpty(regularConstraint.rightOperandReference)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "rightOperandReferenceNotSupported");
+        }
+        // dataType specifies how the rightOperand value should be coerced before comparison.
+        // Without dataType-aware coercion logic the comparison may produce incorrect results.
+        if (Is.notEmpty(regularConstraint.dataType)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "constraintDataTypeNotSupported");
+        }
+        // unit specifies the measurement unit for the right operand (e.g. currency, length).
+        // Unit-aware comparison is not implemented.
+        if (Is.notEmpty(regularConstraint.unit)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "constraintUnitNotSupported");
+        }
+        // status represents a state-based evaluation operand (e.g. odrl:policyUsage).
+        // State-based evaluation is not implemented.
+        if (Is.notEmpty(regularConstraint.status)) {
+            throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "constraintStatusNotSupported");
+        }
         // Evaluate the main constraint condition
-        const leftValue = this.calculateOperandValue(regularConstraint.leftOperand, ruleDataContext);
-        const rightValue = this.calculateOperandValue(regularConstraint.rightOperand, ruleDataContext);
+        const leftValue = this.calculateOperandValue(regularConstraint.leftOperand, dataSources);
+        const rightValue = this.calculateOperandValue(regularConstraint.rightOperand, dataSources);
         const mainSatisfied = this.evaluateOperator(regularConstraint.operator, leftValue, rightValue);
         // If main constraint is not satisfied, the overall constraint fails
         return mainSatisfied;
@@ -589,32 +1172,32 @@ export class DefaultPolicyArbiter {
     /**
      * Evaluate a logical constraint operator against its operands.
      * @param logicalConstraint The operator and operand list.
-     * @param ruleDataContext The request data/context.
+     * @param dataSources The operand lookup sources.
      * @returns True if the logical constraint is satisfied.
      * @internal
      */
-    evaluateLogicalConstraint(logicalConstraint, ruleDataContext) {
+    evaluateLogicalConstraint(logicalConstraint, dataSources) {
         const { operator, constraints } = logicalConstraint;
         if (constraints.length === 0) {
             return false;
         }
         switch (operator) {
             case OdrlLogicalConstraintType.And:
-                return constraints.every(item => this.evaluateConstraint(item, ruleDataContext));
+                return constraints.every(item => this.evaluateConstraint(item, dataSources));
             case OdrlLogicalConstraintType.AndSequence: {
                 for (const item of constraints) {
-                    if (!this.evaluateConstraint(item, ruleDataContext)) {
+                    if (!this.evaluateConstraint(item, dataSources)) {
                         return false;
                     }
                 }
                 return true;
             }
             case OdrlLogicalConstraintType.Or:
-                return constraints.some(item => this.evaluateConstraint(item, ruleDataContext));
+                return constraints.some(item => this.evaluateConstraint(item, dataSources));
             case OdrlLogicalConstraintType.Xone: {
                 let satisfied = 0;
                 for (const item of constraints) {
-                    if (this.evaluateConstraint(item, ruleDataContext)) {
+                    if (this.evaluateConstraint(item, dataSources)) {
                         satisfied += 1;
                         if (satisfied > 1) {
                             return false;
@@ -627,25 +1210,57 @@ export class DefaultPolicyArbiter {
                 return false;
         }
     }
+    /**
+     * Resolve a prefixed operand to its source object and JSONPath expression.
+     * Prefix matching is dictionary-driven so additional operand namespaces can be
+     * added in one place by extending the lookup sources map.
+     * @param operandTypeOrValue The string operand value or typed operand namespace.
+     * @param operandValue The JSONPath expression.
+     * @param dataSources The available lookup sources.
+     * @returns The resolved source and JSONPath, or undefined when not namespaced.
+     * @throws GeneralError if a twin: prefixed operand doesn't resolve to any available datasource key.
+     * @internal
+     */
+    tryResolveOperandLookup(operandTypeOrValue, operandValue, dataSources) {
+        let lookupTargetId;
+        if (dataSources[operandTypeOrValue]) {
+            if (!Is.stringValue(operandValue)) {
+                return undefined;
+            }
+            lookupTargetId = `${operandTypeOrValue}:${operandValue}`;
+        }
+        else if (operandTypeOrValue.includes(":")) {
+            lookupTargetId = operandTypeOrValue;
+        }
+        else {
+            return undefined;
+        }
+        // Delegate prefixed path matching to shared datasource resolver
+        if (operandTypeOrValue.startsWith(DefaultPolicyArbiter._TWIN_PREFIX_OPERATIONS)) {
+            const resolved = this.tryResolveTargetDataSource(lookupTargetId, dataSources);
+            return {
+                source: resolved.source,
+                jsonPath: resolved.target
+            };
+        }
+    }
     /**
      * Calculate an operand value.
      * @param operand The operand.
-     * @param ruleDataContext The request data/context.
+     * @param dataSources The available prefixed operand sources.
      * @returns The resolved operand value.
      * @internal
      */
-    calculateOperandValue(operand, ruleDataContext) {
-        // Treat JSONPath operands as selectors against the current rule data context.
-        // Will be in the format twin:jsonpath:<jsonPath>
+    calculateOperandValue(operand, dataSources) {
+        // Treat prefixed operands as selectors against a namespaced source dictionary.
+        // Examples: twin:jsonpath:$.field, twin:information:$.credentials.level
         let jsonPath;
+        let operandRoot;
         if (Is.stringValue(operand)) {
-            if (operand.startsWith(`${DefaultPolicyArbiter._JSON_PATH_OPERAND_PREFIX}:`)) {
-                jsonPath = operand.slice(DefaultPolicyArbiter._JSON_PATH_OPERAND_PREFIX.length + 1);
-                if (jsonPath.length === 0) {
-                    throw new GeneralError(DefaultPolicyArbiter.CLASS_NAME, "jsonPathOperandMissingTarget", {
-                        operand
-                    });
-                }
+            const lookup = this.tryResolveOperandLookup(operand, operand, dataSources);
+            if (lookup) {
+                jsonPath = lookup.jsonPath;
+                operandRoot = lookup.source;
             }
         }
         else if (Is.object(operand)) {
@@ -653,12 +1268,10 @@ export class DefaultPolicyArbiter {
             const value = operand["@value"];
             const type = operand["@type"];
             if (Is.stringValue(type)) {
-                // If the type is set we can try and extract the value
-                // is it twin:jsonpath ?
-                if (type === DefaultPolicyArbiter._JSON_PATH_OPERAND_PREFIX) {
-                    if (Is.stringValue(value)) {
-                        jsonPath = value;
-                    }
+                const lookup = this.tryResolveOperandLookup(type, value, dataSources);
+                if (lookup) {
+                    jsonPath = lookup.jsonPath;
+                    operandRoot = lookup.source;
                 }
                 else {
                     const xsdValue = this.coerceXsdType(value, type);
@@ -670,7 +1283,7 @@ export class DefaultPolicyArbiter {
         }
         // We have a JSON Path to resolve
         if (Is.stringValue(jsonPath)) {
-            const jsonPaths = JsonPathHelper.query(jsonPath, ruleDataContext);
+            const jsonPaths = JsonPathHelper.query(jsonPath, operandRoot);
             if (jsonPaths.length === 0) {
                 // No matches
                 return undefined;