WAC/ACL

Web Access Control (WAC) is a small, RDF-based vocabulary for saying who is allowed to read, write, append to, or control a given resource, the access-control layer for Linked Data. Instead of a centralized permissions database, a WAC rule is itself a small piece of Linked Data sitting next to (or referencing) the resource it protects, naming which WebIDs (see: WebID) or groups get which modes of access. Solid adopted WAC as its default authorization model, a newer, more expressive alternative called Access Control Policies (ACP) exists alongside it.

WAC grew out of W3C Semantic Web community work on access-control vocabularies and was carried forward by the Solid project as the standard way a Pod enforces permissions.

Where Solidus stands

Solidus's Pod product uses WAC-style access control today, alongside its JWT+Postgres storage layer. Under the current architecture, that enforcement runs inside the Community Solid Server component, real Solid software, not code Solidus wrote, rather than as a from-scratch Solidus implementation. We have not independently run our stack against the full WAC conformance suite, so we describe this as "WAC-style," not "WAC-conformant."

Proof

The vocabulary itself is documented at github.com/solid/web-access-control-spec. A generic, stranger-checkable test: request a WAC-protected resource on any Solid pod without credentials and confirm you get a 401 or 403 back, then request it again with the right credentials and confirm access. We don't have a Solidus-specific conformance report to point to.