Ownership structure within a data pod

An owner may wish to hold all their data in a single data pod for simplicity, but might want to be able to add other owners who can control parts of the data.

This is a possible scenario with individuals, but is more likely with a "social entity" which would have different roles that require difference access and control to subsets of the data in the data pod.

The specification should be extended to include support for a standardised identity access management capability, in which owners can be assigned to groups, groups can be included in other groups. The groups are assigned to roles, with access and control of the data then mapped to a role.

On data pod construction, two roles and one group are created. The creating owner is assigned to the group, and the group is assigned to the two roles.

The first role provides access to data,which ensures the owner has full control of all data as before.

The second role provides access to perform role, group and owner management. This allows the creating user to construct roles, groups and add more owners to establish a segregation of duties with data partitioning within the data pod.

Essentially this is analogous to cloud IAM capabilities but applied to a data pod.

No file or test is named. Start by reviewing the specification's current ownership and data-pod access model, then define how owners, nested groups, roles, and data permissions should interact. Done means the specification contains an agreed standardized IAM capability covering initial roles and group creation, delegation, and partitioned access.