Semantic Privacy Monitoring and
Auditability for Decentralized Data

Uha Isnaini1,3 Kabul Kurniawan2,3,* Ahmad Cahyono Adi2 Muhammad Hanif1 Andreas Ekelhart4,5
1Dept. of Mathematics, UGM, Indonesia 2Dept. of Computer Sciences and Electronics, UGM, Indonesia 3Center for Cryptography and Cybersecurity Research, UGM 4SBA Research, Vienna, Austria 5University of Vienna, Austria
Read Paper (PDF) Source Code Zenodo Dataset

Abstract

Decentralized personal data platforms such as Solid give users greater control over where their data is stored and which applications may access it. However, they provide limited support for monitoring how data is used after access has been granted.

This paper presents O-Prime, an ODRL-based privacy monitoring framework that extends Solid with a runtime gateway for policy-based monitoring and semantic audit logging. The gateway intercepts application requests, evaluates usage policies, classifies accessed data with the Data Privacy Vocabulary (DPV), and records access events as PROV-O-based audit logs. Unlike policy evaluators that only compute access decisions, O-Prime turns monitored requests into linked semantic evidence, supporting seven policy dimensions and a three-tier trust model.

System Architecture & Core Features

O-Prime seamlessly integrates into the Solid ecosystem without modifying the underlying server, adding a powerful layer of accountability.

Semantic Policy Evaluation

Combines ODRL for policy representation and DPV for privacy-aware data classification, enabling fine-grained, context-aware evaluation.

PROV-O Audit Logging

Transforms access events into machine-readable, SPARQL-queryable RDF provenance graphs stored directly in the user's Solid Pod.

Three-Tier Trust Model

Distinguishes technically enforceable constraints (e.g., count, time) from accountability-oriented evidence (e.g., purpose, legal basis).

O-Prime Monitoring Gateway Architecture

Figure 1: O-Prime monitoring gateway architecture integrating ACL services, policy evaluation, and semantic logging across multiple Solid Pods.

Technologies & Standards

O-Prime is built on established Semantic Web standards and W3C recommendations, ensuring interoperability, machine-readability, and long-term sustainability.

PROV-O

W3C Provenance Ontology for representing audit trails and data access history as machine-readable RDF graphs.

W3C Recommendation

ODRL

Open Digital Rights Language for expressing permissions, prohibitions, duties, and constraints on data usage.

W3C Standard

DPV

Data Privacy Vocabulary for classifying personal data categories, purposes, legal bases, and processing operations.

W3C Spec

SHACL

Shapes Constraint Language for validating the structure and semantics of generated RDF artifacts.

W3C Recommendation

SPARQL

RDF query language for querying audit logs and answering compliance competency questions.

W3C Standard

RDF

Resource Description Framework as the foundational data model for all semantic artifacts.

W3C Standard

Solid

Decentralized data platform providing user-controlled Pods for personal data storage.

Platform

Schema.org

Vocabulary for structured data markup, used for modeling personal identity and health records.

Vocabulary

Implementation Stack

Node.js Solid-OIDC Community Solid Server Next.js Tailwind CSS

Live Demo & Resources

Explore the O-Prime prototype, browse the source code, or download the reproducible evaluation dataset.

Live Dashboard

Interactive privacy monitoring dashboard to configure policies and view semantic audit logs.

Source Code

Full implementation of the O-Prime monitoring gateway, dashboard, and evaluation package.

Zenodo Dataset

Reproducible evaluation package including SHACL shapes, SPARQL queries, and sample logs.

Read Paper

Full preprint manuscript detailing the architecture, trust model, and comprehensive evaluation.

Comprehensive Evaluation

O-Prime was rigorously evaluated across two distinct domains (Health Records and Student/Academic Records), covering 34 representative scenarios to validate policy coverage, semantic conformance, queryability, runtime overhead, and user experience.

EQ1

Policy Coverage

Validated across 34 scenarios in 2 domains, covering all 7 supported policy dimensions:

  • Tier 1 (Enforceable): Count, Temporal
  • Tier 2 (Accountable): Purpose, Legal Basis, Recipient, Duty, Prohibition
EQ2

Semantic Conformance

100% SHACL validation pass rate across all generated RDF artifacts:

ODRL Policies PROV-O Logs DPV Mapping SoTW State

Total: 942 combined triples with 0 violations.

EQ3

Audit Queryability

Successfully answered 15 SPARQL competency questions over the PROV-O audit logs, including:

  • Agents accessing special-category data
  • Policy & purpose violations
  • Duty obligation fulfillment status
  • Count limit exceedances per application
EQ4

Runtime Overhead

Ultra-low latency introduced by the monitoring gateway (500 sequential GET requests):

~1.1ms
Mean Overhead
<0.1ms
In-Memory Eval

Rule evaluation scales linearly (p99 < 0.1ms even with 100 active policies).

EQ5

Pilot User Evaluation

Conducted with 10 academic participants to assess usability, acceptance, and understanding of the monitoring workflow (authentication, policy configuration, and audit interpretation).

4.29/5
Functional Usability Mean
6.04/7
UX Evaluation Mean

Key Takeaway:

"Participants positively validated the monitoring concept, while highlighting the need for enhanced visualization and summarization of semantic audit logs for non-technical users."

Citation

@article{isnaini2026oprime,
  title={Semantic Privacy Monitoring and Auditability for Decentralized Data Environments},
  author={Isnaini, Uha and Kurniawan, Kabul and Adi, Ahmad Cahyono and Hanif, Muhammad and Ekelhart, Andreas},
  journal={Preprint submitted to Elsevier},
  year={2026},
  note={O-Prime: An ODRL-based privacy monitoring framework for Solid}
}

Funded by the Indonesian Endowment Fund for Education (LPDP) and supported by SBA Research (COMET Centre, Austria).

© 2026 O-Prime Research Team. Department of Computer Sciences and Electronics, Universitas Gadjah Mada.