The problem
Classical decentralised control fixes, for each event, the supervisors entitled to veto it. In delegated or revocable architectures that right changes with the system’s hidden history, and a local supervisor may be unable to see whether it holds it. As the paper puts it, one supervisor may know an event must be disabled but not that it is authorised to veto, while another knows its authority but not the decision, and neither can act.
An unauthorised veto is not harmless even when it is ignored. It is an invalid command that can break an audit or interface contract, and it may be stale, replayed or misrouted.
What the paper does
Authority is modelled as what each supervisor is permitted to issue at each point: admitting an event is always allowed, vetoing it only for an issuer that is currently active. A control policy is “legitimate” if every command it issues where it matters is one its issuer was entitled to issue. The key notion is the “aligned witness”: a single supervisor that knows, across everything it cannot tell apart, both that a continuation is forbidden and that its veto is allowed.
What it shows
Exact control is achievable precisely when the specification is controllable and “legitimately co-observable”, and the paper constructs the policies that achieve it. A minimal example, with two supervisors and three decision points, shows that a decision held by one supervisor and an authority held by another do not combine.
When the specification cannot be met, the paper computes the largest behaviour that can be, extending a classical construction so that it never relies on an unauthorised veto. Because authority changes out of sight, every hidden schedule behind one observable history must be kept or removed together. Deciding the condition is PSPACE-complete in general; synthesis is polynomial in the size of the explicit model for each fixed bound on how many states a supervisor’s estimate can span. In a family of cyclic examples the classical method keeps a branch only by depending on unauthorised vetoes, which the new one correctly removes. A validator agreed with the algorithm on 20,000 randomly generated cases, which the paper is careful to say does not prove the theorem.
What it does not claim
The scope is stated: behaviour closed under prefixes, at least one active issuer at all times, faithful delivery of commands, authority updated from outside the system, and finite observers for synthesis. Synthesising the delegation itself, communication between supervisors, faults and malicious supervisors are all left out, and the cyclic example is a structural illustration, not a claim about scale.
Where it sits
The companion to the branch-set paper: that one fixes the interface, this one lets the effective interface change with hidden history. Both are written with agent permissions and capability-checked command architectures in view.