Endpoint to see with whom a resource has already been shared

When we give others the right to share a resource (through delegation), it's very annoying if they can't know with whom the resource has already been shared. They may want to select all their contacts, thinking none of them can see the resource... while in reality all their contacts can already see the resource. The AA will mostly likely ignore these Delegated Data Grants, but it's still a very bad user experience.

So it would be very useful if there could be some endpoint that shares the authorizations that have already been granted. And maybe the resource owner could give it only to people who received the right to share (delegation).

In WAC, there has been a proposal to create a ControlRead ACL mode: the right to see the permissions, but not to change them. We would be something similar for SAI grants.

This cannot be something specific to the Authorization Agent (that would be implementation-specific) because, if Bob receive the right to share a resource from Alice, it is Alice's AuthorizationAgent that can tell to Bob with whom this resource has already been shared. So the endpoint needs to be published somewhere.

In ActivityPods, we currently use an ActivityStreams collection, linked from every shared resources, that simply list the WebID of users. This collection is private by default, but users who receive the right to share a resource also get the right to read that collection. It works, but we would prefer to have something that better integrate into SAI.

Start by reviewing the SAI grant model and the linked WAC ControlRead proposal to clarify what permission visibility should expose. Compare this with the ActivityStreams collection approach described for ActivityPods, then define where the endpoint belongs and which delegated users may read it. Done means an agreed specification for the endpoint, access rules, and returned authorizations.