GIF AMA
GA4GH Implementation Forum: Ask Me Anything

30 October 2025

Featured standard

Meeting Overview

Attendees: Mallory Freeberg, Tom Conner, Jessica Seegobin, Kaitlyn Brethour, Jaime Delgado, Gregory Rushton (Broad), Angela Page, Ara Abbott, Arwa Farrukh, Carla, Deborah Sebatta, Dylan Spalding, Jaclyn Estrin, Jason, Jinny Park , Jonathan Tedds (ELIXIR Hub), Kevin, Martin, Michael Baumann, Pavel Nikonorov, Rachel, Reggan  Thomas, Ruth, Sasha Sigel, Silvia Llorente, Stephen, Venkat Malladi, Karen Cranston, Wendi Bacon, Wafaa Rashed

Recording

Passcode: ?WQfs0k?

Slides 

Info

• Data Security Work Stream page
• Passports v1.2 Github
• AAI OIDC Profile

• FAQ
• Changes between 1.0 and 1.2
• GitHub
• AAI Repository

Questions and Answers

Note: This is a community-driven resource, and your contributions help make it better! If you spot a mistake, see an opportunity to add a resource, or have more details to share, please jump in and make changes. We welcome and encourage your input!

Meeting Summary

Intro

Tom Conner gave an update on Pasports, noting it’s a token based on JWT which relies on OIC authentication. He outlined the five types of Visas, which conveys the information about the researcher, including permissions and affiliations. The AAI spec from DSWS provides a protocol for using OIDC to pass tokens around to obtain data access. Tom demonstrated the governance model involving a Data Access Committee with the need to submit a Data Access Request (DAR) for gaining access, and the presentation of metadata and any data use constraints that come from the policy setup. He also pointed to links with the specs and FAQ online. Tom also outlined some of the ongoing work on Verifiable credentials as a trust model for putting Visas into wallets, and the need for better computable and standardized policy governance through Data Passports.

Question and Answer:

❓Question (Mallory Freeberg): It sounds like Passport is in the gathering requirements phase. How can people get involved with the next development phase?

👉Tom Conner: There’s going to be more discussion at the subsequent Nov 3 DSWS meetings, in addition to the DURI and Data Passports meetings. (More details can be found here)

👉Jessica Seegobin: If you need help with the calendar invites or would like to be included in the mailing lists, please feel free to reach out.

👉Jessica Seegobin (chat): To join the DSWS, DURI and Data Passports mailing lists, please contact Jessica Seegobin (jessica.seegobin@ga4gh.org)

❓Question (Mallory Freeberg): Is the idea that you want people to engage in this phase that didn’t before, or  hadn't implemented the passports for one reason or another?

👉Tom Conner: Conversations around trust are happening in other places outside of DSWS, such as federated AI/ML, Beacon security. Cloud is also looking at how to address authentication and authorization, and dealing with large tokens.

_________________

❓Question (Michael Baumann (chat)): What is the current status of Passport adoption/use globally at this point? I know the US National Institutes of Health is in the process of rolling these out in production in the NIH Research Auth Service (RAS).What about the rest of the world? Europe? Africa? Asia? How global is Passports in their adoption and use?

👉Mallory Freeberg: most of my engagement has been at the European level. Most groups in Europe  would involve Genomics England, UK Biobank, HDR UK, and may probably work off of systems developed previously.

👋Sasha Siegel:  Genomics England is providing support for people to use Passports. ELIXIR is the largest user of Passports and development. The current largest usage of Passports is in Europe.

👋Angela Page:  eLwazi is using Passports in Africa, and Tommo in Japan. Also Tohoku Medical Megabank.

👋Dylan Spalding:  Life science RI supports Pass ports and Visas.

💡Michael Baumann: Hoping to represent Data Passports can represent the policies we see globally, and ensure we get these global groups’ input for use cases in order to support the automated policy processing to provide reliable mechanical access to the data.

💡Deborah Ekusai Sebatta: The Passports standard is not used in Uganda, but it is needed. Spreading the word about these products, ensuring inclusivity and that the products are tailored to the needs of these regions.

❓Question (Mallory Freeberg): What are ways for Deborah and colleagues to get that input or find the documentation they need to think about whether implementing Passports works for their systems?

👉Tom Conner: Joining the DSWS meetings and reaching out to experts on this call who have begun to work with Passports are good things to do, along with reviewing links from the Plenary discussions.

💡Sasha Siegel: We also have lots of videos on Passports/Visas on Youtube that have a lot of detail.

💡Karen Cranston (chat):  Those videos sounds great! Should be linked here? https://www.ga4gh.org/product/aai/ 

👉Michael Baumann (chat): @Deborah E. Sebatta, thank you for representing the Ugandan/African perspective and status. My early understanding is that Africa has some important additional policy considerations/requirements that will be important to incorporate as this work moves forward.

______________

❓Question (Angela Page): Is there any effort in the Passports community to document these implementations?

💡Angela Page: It might take time to get a robust platform up and running, but starting with a list would be helpful. Steps are being taken to properly record implementations in the implementation registry.

💡Tom Conner: On the roadmap, there are a couple of projects to enhance the service registry, to make sure it can accommodate the roles of the Passport ecosystem, like a Passport broker, for example, and to add conformance testing so that we can be properly listed in the implementations with registry. This is a piece that we will try to follow in the footsteps of DRS getting DRS servers listed.

👉Michael Baumann: +1 to getting onto the service registry, given momentum in Cloud WS. Once you have services in the registry, you can have contact information to get reviews of use cases as they are developing, and it’s an enabler to get the community populated with the right people

💡Sasha Siegel (chat): We can easily use the outreach form and code that Brian O’Conner has to update service registry (GA4GH’s implementation) for Passports.

________________

❓Question (Sasha Siegel (chat)): Are there plans to expand the researcher information portion of the spec?

👉Tom Conner: Yes, this will be driven by implementers and the analysis of Data Passports. Slide 17 illustrates the Researcher visa types capturing the affiliations, permissions and linked identities of a researcher, along with the new data Visa types which have been identified in a white paper from Jonathan Lawson and Tom Conner which shows that the data is tagged with these different policy elements. We;re going to be looking at other use cases and scenarios.

💡Wendi Bacon: They used to have a list at HDR UK where they’ve done engagement with data custodians  and published guidance on what criteria should be looked at, which has been stabled. This video shows a walkthrough of the researcher profile; the Guidance doc explaining it:  Having the information included in this video going into Passports would help implementation in the UK Exploring what criteria would go into the person’s Passport about that researcher would make it instantaneous for people to have all of the information needed to determine whether it’s safe across a gamut of data custodians.

👉Mallory Freeberg: Wendi or someone from HDR UK should be part of this new group moving forward with the new version.

💡Sasha Siegel (chat): I think inviting Wendi to come give a quick talk at the next Passports session would be great, and other potential users to do a show and tell

💡Venkat Malladi: Having Driver Projects present what they are trying to solve would be helpful to identify the needs in order to develop the right solutions. Here’s a link to GA4GH in the real world  implementation.

👉Mallory Freeberg: Having presentations like this would be helpful to have during Connect.  

______________________

❓Question (Mallory Freeberg): How many people on the call are  thinking about implementing Passports, but maybe don't know enough or think it doesn't meet your needs?

👉Wendi Bacon: A big win would be populating data from initial log in portals. The technical implementation team would have additional questions.

👋Gregory Rushton: At the Broad, there are two needs for Passports, involving querying for a user’s Passports. When a user signs in, it would be helpful to know more about the user. When a user submits a data access request, it would be good to become a provider.

💡Karen Cranston: From the Pan-Canadian Genome Library perspective, OIDC is working well, but Passports/AAI is on the horizon when the roadmap comes to a point when they want to connect to other resources. Essentially, there is no use case right now. A lot of driver projects are likely in this same state - where they are aware of these standards, but the current methods they are using work well enough for now. May want to reach out 1:1 to the driver projects to ask what is holding them back. May want to create documentation that addresses when you need Passports and Visas.

💡Tom Conner: We  intend to have reference implementations. In some cases, we have heard that although there is a starter kit, there’s some code that can be copied but it’s not easy to figure out how to implement. More work needs to be done to make the on ramp easier.

👉Karen (chat): I am happy to help with that documentation @Thomas Conner (which would help me better understand when and how PCGL implements)

________________________

❓Question (Sasha Siegel (chat)): When is the next version of passports expected to be ready?

👉Tom Conner:  Ideally April, however it might take longer. Individual features may be released separately instead of bundling them all up to release all together as a large version.

💡Sasha Siegel:  We can do some minor releases to push this faster, as there won't be breaking changes. That said, a 2.0 might take some more time, meaning it could be good to use the GA4GH maturity model to push individual features out sooner.

👉Michael Baumann (chat): Using the GA4GH Maturity Model to roll out new features in draft form could be helpful.

❓Venkat Malladi: How much can we lean on the tech team to use  starter kits to release this?

👉Sasha Siegel: There may be a possibility of a quick implementation for a draft future release pathway that Wendi needs.This is a minor spec change that could be done in a couple of months. Rate limiting step is having the potential users (e.g. Wendi, others in the community) going through the data request process and identifying which specs they would want in the next version.

💡Tom Conner: We could open a PR to begin the process of talking about this.

❓Venkat Malladi: How behind is the starter kit?

💡Tom Conner: It’s fairly behind, which needs to be updated. We should also update the DRS starter kit or make a new one for the Passport broker.

👉Sasha Siegel: The  tech team is building a sandbox in AWS for starter kits to live in the cloud. GDI has a well done implementation of Passports, which could be looked at to get example code to redo a starter kit that’s on a  current spec.

💡Tom (chat): We have begun to talk about a February hackathon to make a push forward on some of these ideas.

👉Angela Page: This might also be the verified implementation conversation, which hasn't gone far along because there needs to be management to meet community expectations around openness and support. We may call them informal reference implementations, but not starter kits or verified implementations unless we’re following that stated model that’s already been put forward.