government · United Kingdom (national programme)
Federated Data Sharing — Data Architecture for the Policy Layer
Data architecture for the policy layer of a UK central government department's federated data-sharing infrastructure: what decides who may discover, and who may access, which data product.
The Challenge
The Problem We Were Asked to Solve
Two organisations want to share data. Both are willing and the legal basis exists — but neither can prove to the other, at machine speed, that the request is legitimate and that the recipient will handle the data properly. The exchange falls back to email and legal review, and takes months.
The department is building a federated data-sharing infrastructure to solve this: organisation-owned nodes advertising data products to one another, with no central authority holding the data. It works only if every node evaluates policy against the same vocabulary — and access control shaped around clearance and nationality cannot express why data is wanted, or from what environment.
Project Details
- Client
- UK central government department
- Year
- 2026
- Location
- United Kingdom (national programme)
- Sector
- government
Tags
Our Approach
What We Built
Attribute Model
Designed an organisational attribute model and versioned attribute dictionary, extending the programme's existing attribute-based access control rather than replacing it. Attributes cover the data, the requester, the requesting environment and the stated purpose, each traced to a named data-sharing risk.
Policy as Code
Produced a policy template expressed as code — fail-closed, tested, with a plain-language mirror so reviewers who do not read code can verify what a policy does — over a versioned policy store with a governed release path. Made the federation's management component policy-aware, delivered implementation-ready, with the control plane kept separate from the data plane.
The Results
What Changed
What Changed
The architecture expresses conditions the previous access control could not: purpose of use, environment assurance and requester competence. Discovery and access became two distinct policy decisions, enforced separately and replayable afterwards — the precondition for compliance evidence.
This is a research and development programme, running on synthetic data by design. It is not a production deployment.
Work Examples
Risk traceability — every attribute starts from a named data-sharing risk and ends as a condition a machine can test at the moment of decision.
Two decisions, not one — what an organisation may see exists is a separate question from what it may retrieve.
Control plane and data plane — the decision is taken centrally to the federation; the data itself moves directly between the two organisations.
Explore More