Problem

FWSS current authorization mechanic (will refer to it as Legacy Auth throughout the doc) are limited to:

Direct Signature by the payer
Session-key Registry (SKR) scoped by payer + operation

These two options are quite limited and do not represent robust ACL mechanics for a number of reasons:

Legacy Auth granularity is user-level. There is no native way of controlling authorization on the dataset level
Current SKR logic give delegated keys unbounded access to all user datasets
A delegation MUST be an on-chain transaction, imposing gas on unused delegation and a min 60s to be picked up by SPs on the write path
an SKR is a user-proxy, it acts on behalf of the user. It’s not suitable primitive for cross-user sharing, low-trust sharing i.e agents, apps.
Authorization flow expects secp256k1 keys e2e, meaning p256r1/passkeys cannot natively be attested against.

For all the reasons above, FWSS needed a path to implement programmable ACL to enable upstream platform builders to build meaningfully robust data platforms on top of PDP.

Motivation

Refound is building a Platform-as-a-service that offer users and app builders a versioned filesystem-like E2EE data infrastructure for their applications. This require the following at the storage layer:

Instant Delegation A delegated key usable immediately, with no SKR transaction (no ~60s wait) and no per-key on-chain registration. Allowing agents/3rd party apps/other users fine-grained access to particular pieces within a dataset
Path/Refs on the Dataset level: A dataset is formatted to look like a versioned filesystem, this means embedding paths as part of the pieces metadata and imposing ACLs recursively within these paths including permission to advance the canonical HEAD of a file in the virtual filesystem
P256-WebAuthn support: browser-native signing schemes that FWSS should not hard-code.
Ephemeral off-chain cross-user sharing UCANs: Owner signed capability UCANs carrying specific scope, expiry and revocation rights.

Some of these requirements are tightly coupled to Refound product and it’s believed that this is not going to be a unique problem to Refound. An modular programmable authorizer interface seemed to be the best next step that unlocks above requirements while enabling the FWSS team to build their robust ACL system to be the default and phase-out SKR seemlessly.