In a dataspace, policies define who may use which data, for what purpose, and under which obligations. Policies are part of contract offers and agreements, not optional extras. A policy agent (policy decision point) evaluates requests against rules and returns allow/deny before data leaves the provider.
Eclipse Dataspace Components use a policy engine on the control plane to attach constraints to assets and contract definitions. During negotiation, both sides must agree on compatible policies before contract finalization and data transfer. ODRL-based expressions are common for machine-readable rights: ODRL model (W3C).
For API-level runtime authorization (for example SPARQL endpoints), MAT-X can use Open Policy Agent (OPA) with Rego policies. OPA evaluates request attributes (method, path, bearer token, etc.) and keeps policy logic separate from application logic.
Further reading Open Policy Agent (Wikipedia) - policy-as-code overview EDC policy engine - connector policy evaluation ODRL Information Model (W3C) - rights and obligations vocabulary IDS RAM - data sovereignty - policy enforcement in IDS architecture Gaia-X trust framework - compliance, credentials, policy