Digital Product Passport Access Rights by Role

A passport has to satisfy audiences whose needs directly conflict. A consumer wants to know how to wash a jacket. A recycler wants to know whether its coating contains PFAS. A regulator wants the evidence behind every claim. The brand wants none of its supplier pricing visible to any of them.

Building five separate systems is the obvious answer and the wrong one — the data diverges immediately and nobody can tell which copy is authoritative. The workable answer is one record with five projections over it.

What does each role actually need?

Start from the job each audience is doing, not from the data you happen to hold. The boundaries follow from the jobs.

Note what the first row implies. Consumer access has to work with no account, no app and no prior relationship, from a phone camera, years after purchase, possibly for a second-hand owner who has never heard of your brand. That constraint drives more architecture than any other.

Which fields sit behind which boundary?

The useful way to model this is to make fields public by default and require an explicit decision to restrict one. That way adding a field is safe, and restricting it is a choice someone has to make and justify in review.

Why refuse rather than trim?

When an unauthorised caller requests a restricted view, there are two possible responses: return the record with restricted fields removed, or refuse the request outright. The second is correct, and the reasoning is worth spelling out because the first looks friendlier.

If you silently trim, a caller cannot distinguish "this product has no hazardous substances" from "you are not allowed to know whether it does". A recycler acting on the first interpretation when the second is true makes a materially unsafe decision. The ambiguity is the danger, not the withholding.

• Refuse with 403 and name the role required, so the caller knows what credential to obtain.
• Report what was withheld in metadata — a count of restricted fields tells an authorised-but-limited caller that more exists without revealing what.
• Never vary the response shape by permission in a way that leaks. If a field is absent for everyone below regulator, its absence carries no information.
• Log denied requests. Repeated attempts against a role boundary are a signal worth seeing.

How is a role actually verified?

Consumer access needs no verification, which leaves four roles that do. The mechanism that scales is a credential the caller presents, issued by someone whose authority to issue it can itself be checked.

This is what W3C Verifiable Credentials are for. A national waste authority issues a credential asserting that an operator is a licensed recycler; the operator presents it; your resolver checks the signature and the issuer, and grants the recycler view. You never need a business relationship with that operator, and they never need an account with you.

The alternative — every brand maintaining its own list of approved recyclers — does not scale to a continent of waste operators and thousands of manufacturers, and it fails precisely at end-of-life when the brand may no longer exist.

The supplier boundary is the hard one

Suppliers are the only role that both reads and writes, and the only one whose access must be scoped to a portion of the record rather than a layer of it.

A tier-2 component maker contributing composition data should be able to see and correct their own contribution, and should not be able to see what a competing supplier contributed to the same product. Getting this wrong in either direction is costly: too open and you leak commercial relationships between competitors; too closed and suppliers cannot verify or correct their own data, which quickly ends their cooperation.

Designing the boundaries for your own product

Two questions settle most cases. First: if this field were on the public internet tomorrow, what specifically would go wrong? If the answer is vague discomfort rather than a concrete harm, it probably belongs in the public layer.

Second: who needs this to do their job safely? Hazardous substance data feels sensitive and is genuinely dangerous to withhold — a recycler who does not know what is in a cell can be injured by it. Sensitivity and restriction are not the same axis.

The residual category — unit cost, supplier identity, internal codes — is small, and keeping it small is what makes the passport valuable rather than defensive. A record that withholds most of itself is not a passport; it is a marketing page with extra steps.