Phase 1 of the WIA-ACS standard establishes standardized data formats for all entities in an access control system. By defining common schemas for users, credentials, permissions, access rules, and audit events, this phase enables data exchange, reporting, and migration between systems—even without full API integration. This chapter details the data models, schemas, and validation rules that form the foundation of WIA-ACS interoperability.
WIA-ACS defines several core entities that represent the fundamental concepts of access control:
Entity Relationship Diagram:
┌──────────┐ ┌──────────────┐ ┌──────────┐
│ User │────────┤ Credential │─────────│ Device │
└────┬─────┘ └──────────────┘ └──────────┘
│ │
│ has │ uses
│ │
┌────▼─────┐ ┌──────▼───────┐
│ Role │ │ Access Rule │
└────┬─────┘ └──────┬───────┘
│ │
│ grants │ applies to
│ │
┌────▼─────────────────────▼────┐
│ Permission │
└───────────────┬───────────────┘
│
│ recorded in
│
┌───────▼────────┐
│ Audit Event │
└────────────────┘
The User entity represents an individual person who may be granted access to resources. WIA-ACS user schema balances completeness with privacy, collecting only necessary information.
{
"$schema": "https://wia-acs.org/schemas/v1/user.json",
"user_id": "usr-20251226-abc123",
"external_id": "employee-12345",
"status": "active",
"identity": {
"given_name": "John",
"family_name": "Doe",
"middle_name": "Michael",
"preferred_name": "Johnny",
"email": "john.doe@example.com",
"email_verified": true,
"phone": "+1-555-0123",
"phone_verified": true
},
"employment": {
"employee_id": "E-12345",
"department": "Engineering",
"title": "Senior Software Engineer",
"manager_id": "usr-20241201-xyz789",
"start_date": "2020-01-15",
"end_date": null,
"employment_type": "full_time"
},
"roles": [
"role-employee",
"role-engineering",
"role-building-access"
],
"attributes": {
"clearance_level": 3,
"location": "headquarters",
"floor": "5",
"cost_center": "ENG-001"
},
"metadata": {
"created_at": "2020-01-15T09:00:00Z",
"updated_at": "2025-12-26T14:30:00Z",
"created_by": "sys-hr-integration",
"updated_by": "usr-admin-001"
}
}
| Field | Required | Format | Purpose |
|---|---|---|---|
| user_id | Yes | String (UUID) | Unique identifier across all WIA-ACS systems |
| external_id | No | String | ID in source system (HR, LDAP, etc.) |
| status | Yes | Enum | active, suspended, terminated |
| identity.* | Partial | Various | Minimum: given_name, family_name, email |
| roles | Yes | Array | At least one role required for access |
| attributes | No | Object | Custom attributes for ABAC policies |
Credentials are the physical or digital tokens that prove a user's identity. WIA-ACS supports multiple credential types with a unified schema:
{
"$schema": "https://wia-acs.org/schemas/v1/credential.json",
"credential_id": "cred-20251226-xyz789",
"user_id": "usr-20251226-abc123",
"credential_type": "smart_card",
"status": "active",
"issued_at": "2025-12-26T10:00:00Z",
"expires_at": "2026-12-26T10:00:00Z",
"activates_at": "2025-12-26T10:00:00Z",
"issuer": "WIA-ACS-Core-v1.0",
"encoding": {
"format": "piv",
"facility_code": 123,
"card_number": 45678,
"chip_uid": "04:3F:2A:B5:C8:19:80",
"certificate_dn": "CN=John Doe,OU=Engineering,O=Example Corp,C=US"
},
"factors": [
{
"factor_type": "something_you_have",
"method": "smart_card",
"strength": "high"
},
{
"factor_type": "something_you_know",
"method": "pin",
"strength": "medium",
"pin_hash": "bcrypt:$2b$12$..."
}
],
"access_profiles": [
"profile-building-entry",
"profile-office-floor-5",
"profile-parking-garage"
],
"restrictions": {
"time_zones": [
{
"days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
"start_time": "06:00",
"end_time": "22:00",
"timezone": "America/New_York"
}
],
"locations": ["headquarters", "branch-office-nyc"],
"ip_ranges": ["10.0.0.0/8", "192.168.1.0/24"]
},
"metadata": {
"created_at": "2025-12-26T10:00:00Z",
"updated_at": "2025-12-26T10:00:00Z",
"created_by": "usr-admin-001",
"revocation_reason": null,
"replacement_of": null
}
}
| Type | Technology | Typical Use | Security Level |
|---|---|---|---|
| magnetic_stripe | Magnetic stripe card | Legacy systems | Low |
| proximity | 125 kHz RFID | Basic physical access | Low |
| smart_card | 13.56 MHz contactless, PIV/CAC | Government, high-security | High |
| mobile | Bluetooth LE, NFC | Smartphone-based access | Medium-High |
| biometric | Fingerprint, facial, iris | High-security areas | High |
| pin_code | Numeric or alphanumeric PIN | Secondary factor | Low-Medium |
| otp | Time-based one-time password | Multi-factor authentication | High |
WIA-ACS supports both RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control) through flexible permission modeling.
{
"$schema": "https://wia-acs.org/schemas/v1/role.json",
"role_id": "role-engineering",
"name": "Engineering Department",
"description": "Access rights for engineering team members",
"role_type": "department",
"parent_roles": ["role-employee"],
"permissions": [
{
"resource_type": "door",
"resource_id": "door-engineering-lab",
"actions": ["entry", "exit"],
"conditions": {
"time_range": "business_hours",
"requires_escort": false
}
},
{
"resource_type": "system",
"resource_id": "sys-dev-servers",
"actions": ["read", "write"],
"conditions": {
"mfa_required": true,
"ip_restriction": "internal_network"
}
}
],
"metadata": {
"created_at": "2020-01-01T00:00:00Z",
"updated_at": "2025-12-26T14:30:00Z",
"managed_by": "usr-admin-001"
}
}
{
"$schema": "https://wia-acs.org/schemas/v1/permission.json",
"permission_id": "perm-server-room-access",
"name": "Server Room Access Policy",
"effect": "allow",
"principals": {
"user_attributes": {
"department": ["IT", "Security"],
"clearance_level": {"gte": 4}
},
"role_attributes": {
"role_type": ["technical", "security"]
}
},
"resources": {
"resource_type": "door",
"resource_attributes": {
"location": "headquarters",
"security_zone": "high"
},
"resource_ids": ["door-server-room-a", "door-server-room-b"]
},
"actions": ["entry", "exit"],
"conditions": {
"time": {
"business_hours": true,
"emergency_override": "security_officer_approval"
},
"context": {
"mfa_verified_within_minutes": 15,
"location_proximity_meters": 100,
"device_compliance_verified": true
}
},
"priority": 100,
"enabled": true,
"metadata": {
"created_at": "2025-01-01T00:00:00Z",
"updated_at": "2025-12-26T14:30:00Z",
"owner": "usr-security-manager-001"
}
}
Access rules define when and how credentials grant access to specific resources:
{
"$schema": "https://wia-acs.org/schemas/v1/access-rule.json",
"rule_id": "rule-main-entrance",
"name": "Main Building Entrance Access",
"resource_type": "door",
"resource_id": "door-main-lobby",
"allowed_credentials": {
"credential_types": ["smart_card", "mobile", "biometric"],
"minimum_factors": 1,
"credential_status": ["active"]
},
"allowed_roles": ["role-employee", "role-contractor", "role-visitor"],
"schedules": [
{
"schedule_id": "sched-business-hours",
"name": "Business Hours",
"enabled": true,
"periods": [
{
"days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
"start_time": "06:00",
"end_time": "22:00"
},
{
"days": ["saturday"],
"start_time": "08:00",
"end_time": "18:00"
}
],
"holidays": {
"calendar": "US_Federal",
"behavior": "deny_access"
}
}
],
"antipassback": {
"enabled": true,
"mode": "soft",
"timeout_minutes": 2
},
"occupancy_limits": {
"max_occupancy": 500,
"behavior_when_full": "deny_entry"
},
"audit": {
"log_level": "detailed",
"alert_on": ["forced_entry", "repeated_denials", "disabled_credential_attempt"]
},
"metadata": {
"created_at": "2020-01-01T00:00:00Z",
"updated_at": "2025-12-26T14:30:00Z",
"managed_by": "usr-security-ops-001"
}
}
Comprehensive, tamper-proof audit logging is critical for security and compliance. WIA-ACS defines a standard event schema with cryptographic integrity:
{
"$schema": "https://wia-acs.org/schemas/v1/audit-event.json",
"event_id": "evt-20251226-143217-abc123",
"event_type": "access_granted",
"category": "authentication",
"severity": "info",
"timestamp": "2025-12-26T14:32:17.234Z",
"actor": {
"user_id": "usr-20251226-abc123",
"user_name": "John Doe",
"credential_id": "cred-20251226-xyz789",
"credential_type": "smart_card",
"ip_address": "192.168.1.45",
"device_id": "reader-main-lobby-001",
"session_id": "sess-20251226-143000-xyz"
},
"target": {
"resource_type": "door",
"resource_id": "door-main-lobby",
"resource_name": "Main Lobby Entrance",
"location": "Building A - Floor 1"
},
"action": "entry_granted",
"result": "success",
"decision": {
"decision_engine": "wia-acs-authz-v1.0",
"decision_time_ms": 87,
"matched_rules": ["rule-main-entrance"],
"applied_roles": ["role-employee", "role-building-access"],
"evaluation_method": "rbac"
},
"context": {
"mfa_verified": true,
"mfa_method": "pin",
"door_unlock_duration_ms": 5000,
"occupancy_before": 247,
"occupancy_after": 248,
"weather_condition": "normal",
"business_hours": true
},
"integrity": {
"previous_event_hash": "sha256:abcdef1234567890...",
"this_event_hash": "sha256:1234567890abcdef...",
"signature": "rsa-sha256:BASE64_SIGNATURE",
"chain_sequence": 1234567
},
"metadata": {
"correlation_id": "corr-20251226-143000-xyz",
"retention_days": 2555,
"classification": "internal",
"tags": ["physical_access", "headquarters"]
}
}
| Category | Event Types | Severity Levels |
|---|---|---|
| Authentication | access_granted, access_denied, mfa_success, mfa_failure | info, warning, error |
| Credential Lifecycle | credential_issued, credential_revoked, credential_expired | info, warning |
| User Management | user_created, user_modified, user_deleted, role_assigned | info |
| Security Events | forced_entry, tailgate_detected, repeated_failures | warning, critical |
| System Events | device_online, device_offline, firmware_updated | info, warning |
All WIA-ACS schemas include JSON Schema validation rules to ensure data integrity:
Example Validation Rules:
user_id:
- Pattern: ^usr-[0-9]{8}-[a-z0-9]{6}$
- Uniqueness: Global unique constraint
- Immutable: Cannot be changed after creation
email:
- Format: Valid RFC 5322 email address
- Maximum length: 255 characters
- Must be verified before use in authentication
status:
- Enum: ["active", "suspended", "terminated"]
- Transition rules:
active → suspended (reversible)
active → terminated (irreversible)
suspended → active (with approval)
roles:
- Type: Array of role IDs
- Minimum items: 1 (at least one role required)
- Each role must exist in role database
- Circular dependencies detected and prevented
timestamp fields:
- Format: ISO 8601 with timezone (RFC 3339)
- Validation: Future timestamps rejected for created_at
- Precision: Milliseconds
expires_at:
- Must be after issued_at
- Maximum validity: Configurable (default 2 years)
- Warning period: 30 days before expiration
WIA-ACS provides standardized formats for data migration from legacy systems:
user_id,external_id,status,given_name,family_name,email,department,roles
usr-001,E-12345,active,John,Doe,john.doe@example.com,Engineering,"role-employee,role-engineering"
usr-002,E-12346,active,Jane,Smith,jane.smith@example.com,Security,"role-employee,role-security"
Validation:
- Header row required
- UTF-8 encoding
- Quote strings containing commas
- Array fields pipe-delimited alternative: "role-employee|role-engineering"
Newline-Delimited JSON for efficient streaming:
{"user_id":"usr-001","status":"active","identity":{"given_name":"John"...}}
{"user_id":"usr-002","status":"active","identity":{"given_name":"Jane"...}}
{"user_id":"usr-003","status":"terminated","identity":{"given_name":"Bob"...}}
Benefits:
- Stream processing of large datasets
- Fault tolerance (corrupted line doesn't break entire file)
- Easy to parallelize processing
- Compatible with tools like jq, BigQuery, Athena
WIA-ACS supports global deployments with built-in i18n:
| Field | Localization Support | Example |
|---|---|---|
| Names | UTF-8, multiple scripts | given_name: "田中", family_name: "太郎" |
| Addresses | Country-specific formats | postal_code: "123-4567" (Japan) |
| Phone Numbers | E.164 international format | phone: "+81-90-1234-5678" |
| Timestamps | ISO 8601 with timezone | "2025-12-26T23:32:17+09:00" |
| Display Names | Localized translations | name_i18n: {"en": "Server Room", "ko": "서버실"} |
This chapter detailed Phase 1 of WIA-ACS: standardized data formats. We explored schemas for users, credentials, roles, permissions, access rules, and audit events. These JSON-based schemas enable data exchange between systems, support both RBAC and ABAC models, include comprehensive validation rules, and provide migration tools for legacy systems.
With standardized data formats established, Chapter 5 explores Phase 2: API Interfaces. We'll examine the RESTful and gRPC APIs that enable programmatic access to authentication, authorization, credential management, and audit services.