P-14

Alexandros Karargyris 1, Hasan Kassem1, Ann Novakowski2

1 MLCommons,

2 Sage Bionetworks

The Data Use Ontology (DUO) provides a community standard for expressing data use conditions on genomic and health datasets. In practice, DUO terms are applied as human-readable labels, data access committees interpret them manually, and downstream enforcement depends on platform-specific logic. No solution today supports policy portability and auditability across federated systems operating downstream from data hosting. We present a machine-readable policy library that encodes DUO terms as executable policy-as-code objects, grounded in a verifiable credential vocabulary aligned with the W3C Verifiable Credentials Data Model v2.0. Each policy card defines the constraints, evidence credentials required for evaluation, evaluation logic, and a discrete decision outcome. The library is developed collaboratively by Sage Bionetworks and MLCommons as part of a broader technical blueprint for decentralized AI governance, and is publicly available on GitHub. This work addresses a concrete interoperability gap: a researcher accessing data across platforms governed by DUO must navigate separate access workflows, even when underlying governance requirements are semantically identical. By encoding DUO as policy-as-code objects, we separate policy expression from enforcement and enable a Policy Engine to evaluate evidence against encoded policy. On approval, the Policy Engine issues a signed capability package that an Asset Guardian can verify, independent of platform, building on our work for trustworthy, decentralized AI (arXiv:2512.11878). We discuss mapping decisions required to translate DUO's human-readable semantics into deterministic machine logic, including cases that resist full automation, e.g., IRB requirements and methods research, and how these are routed to human reviewers. GA4GH Passport Visas carry structured claims about researcher identity and affiliation directly relevant as evidence inputs to DUO policy evaluation. A mapping between Visa claim types and the DUO credential vocabulary would make Passports a first-class evidence source in automated enforcement, closing the loop between GA4GH's identity infrastructure and data governance standard. How this mapping compares to emerging digital credential frameworks, including the EU Digital Identity Wallet, is an open question we bring to the community. We seek partnership with GA4GH and MLCommons to validate, extend, and pilot this library as shared community infrastructure for executable governance.