Policy Guide

Policy Guide

As a policy expert, you define the rules that govern data access and computation at each domain. Policies ensure that sensitive data is handled according to organizational requirements, regulations, and agreements between parties.

What You’ll Learn

1. Setup — Install policy development and management tools
2. Writing Policies — Author eFLINT policies for your domain

How Policies Work in Brane

Each worker node runs a policy checker service (brane-chk) that evaluates every incoming task against the domain’s active policies. If a task violates any rule, it is rejected before execution.

Policies are written in eFLINT (Executable Formal Language for the Interpretation of Normative Theories), a formal language designed for expressing institutional rules and regulations.

Policy Flow

1. A workflow reaches a step that needs to run on your domain
2. The central node sends the task to your worker
3. brane-chk evaluates the task against your active policies
4. If allowed, the task runs; if denied, the workflow receives an error

What Policies Can Control

• Which functions may execute on your node
• Which datasets can be accessed and by whom
• Whether data can be transferred to other domains
• What types of operations are permitted (read, compute, export)

Policy Independence

Each domain manages its own policies independently. This means:

• Hospital A can have different rules than Hospital B
• Policy changes at one domain don’t affect others
• There is no central authority that can override local policies

This matches real-world governance: each organization maintains control over its own data and compliance requirements.

Management Tools

You can manage policies using either:

• Policy Reasoner GUI — A visual interface (recommended for most users)
• branectl — Command-line interface (for scripted or automated management)

Both tools communicate with the brane-chk service to push, pull, and activate policies.