Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems

Abstract: High-risk automated systems distribute control across services, credentials, protected components, and lifecycle mechanisms. Labels such as authorized, approved, privileged, or protected therefore do not answer a basic causal question: which actors can actually make a consequential action occur? This paper provides an action-relative method for deriving which trust-domain coalitions are sufficient to cause protected execution, defined as the occurrence of a designated protected state transition. The framework models components, powers, resources, boundaries, and alternative realization structures; includes update, recovery, override, disablement, and alternative invocation; and separates causal control over execution from control over the authoritative account of an operation. It derives inclusion-minimal sufficient coalitions and tests whether claimed execution boundaries remain independent of designated upstream domains. Cross-domain analytical cases illustrate the method. In a split-control, release-intended, open-state, source-bounded Havenlon protocol model, the ordinary witness requires five trust domains, while certificate replacement yields a three-domain inclusion-minimal known requirement set among source-enumerated protocol witnesses; the Linux domain remains insufficient for the complete transition. Deployed global non-bypassability and boundary-bound veto coverage remain unresolved. The framework is a conceptual and analytical tool. It does not certify implementations, establish deployment security, guarantee complete discovery of hidden powers, or define evidence-verification semantics.

• The paper introduces an authority-decomposition framework to identify actors capable of causing consequential state transitions in high-risk automated systems, integrating trusted domains and system configurations for credible evidence presentation.
• Realization witnesses, coalitions, and decomposition diagnostics are theoretically dissected, revealing that collapsing same-domain contributions undermines traditional heuristics and that representations of 'global no-bypass' conditions contain nuanced requirements.
• Through case studies and protocol analyses, distinct high-risk systems are modeled, highlighting the framework's practical applicability and revealing insights that bypass and disablement are distinct metrics and antiveto conditions involve more than complementary routes.

Motivation and problem statement

High-risk automated systems distribute control across policy engines, delegated credentials, protected hardware, lifecycle mechanisms, and evidence subsystems. Labels such as authorized, approved, privileged, or protected do not answer a causal question: which actors can actually cause a consequential state transition? This paper develops an authority-decomposition framework that answers this question action-relatively. Its central object is protected execution: the occurrence of a designated protected state transition $\tau_a$ for a concrete protected-action instance $a$, under a fixed system configuration $M$, threat model $\Theta$, and environmental assumptions $\Gamma$. The paper explicitly does not claim new access control mechanisms, cryptographic primitives, graph formalisms, or certification schemes; its contribution is the integrated derivation pipeline connecting established mechanisms to trust-domain coalitions.

The core predicate is execution authority:

$$\mathsf{EA}_{M,\Theta,\Gamma}(X,a) \iff \exists w\;(\text{FeasibleWitness}(w,a)\ \land\ \operatorname{Req}(w)\subseteq X),$$

i.e., coalition $X$ can cause $\tau_a$ without an indispensable decision from outside $X$. Inclusion-minimal sufficient coalitions $\mathcal{M}_{EA}$ are extracted by projecting support-selected witnesses onto controlling trust domains and removing nonminimal sets. Three sanity results (domain-collapse invariance, monotonicity, minimal-coalition extraction) are stated as methodological propositions, not claimed as isolated mathematical novelty.

Conceptual positioning

The framework is deliberately integrative. Authorization and access control supply typed decisions; reference-monitor theory informs traversal claims; usage-control motivates composing lifecycle reconfiguration with later realization; attack-tree, hypergraph, and fault models supply AND/OR/threshold structure; provenance and attestation supply evidence-control facts. The residual compositional question—after ordinary workflow powers and admitted lifecycle powers are composed, which coalitions suffice for the transition—is what none of these local outputs settles alone. Notably, the paper treats bypass as derived rather than primitive: there is no CAN_BYPASS relation; bypass exists only when admitted powers support a realized witness avoiding a claimed-final boundary $a$0.

Taxonomy of authority

Nine authority types are distinguished: proposal, authorization, approval, command, policy decision, policy update, veto, execution, and evidence. The taxonomy classifies powers, not actors, and is descriptive rather than normative—a legitimate service and an attacker on the same command path may both hold command authority under $a$1. Two separations carry most analytical weight. First, veto is path-relative: refusing one mediated route establishes nothing about maintenance routes, compromised boundaries, or alternative executors; global prevention requires non-vacuous witness coverage plus independence conditions. Second, evidence authority is epistemic: it governs production, attestation, preservation, suppression, and official designation of accounts, contributing causally only when such designation feeds a later protected transition.

Witnesses, coalitions, and independence diagnostics

Realization witnesses are finite, grounded, well-founded support-selected certificates over a typed causal hypergraph, possibly preceded by an explicit reconfiguration prefix (firmware replacement, credential recovery, override, disablement). Coalition requirements $a$2 collapse same-domain contributions via the component-to-domain map $a$3, so three approvers in one trust domain contribute only one independent member—an observation that undermines principal- and component-count heuristics.

Independence from an upstream coalition $a$4 decomposes into four causal conditions: I1 (no unilateral alteration), I2 (no unilateral satisfaction of boundary acceptance inputs), I3 (no unilateral disablement while $a$5 remains realizable), and I4 (global no-bypass over all admitted witnesses, including reconfiguration-enabled ones), plus a separate evidentiary condition E1 (no suppression of all contrary accounts combined with exclusive official designation). The propositions in Section 7 sharpen these distinctions: $a$6 does not imply boundary independence from $a$7; global no-bypass alone implies none of I1–I3; and physical separation supplies no independence when one domain controls update roots, keys, or accepted facts.

Controlled case studies

Five cross-domain archetypes (AI-agent finance, enterprise payment release, IoT interlock control, HSM signing, CI/CD deployment) serve as controlled contrasts, each varying one authority-relevant fact while holding workflow shape constant. The recurring discriminative findings: shared credential recovery collapses a two-of-three threshold to effectively single-domain support; admitting diagnostic firmware creates an avoiding witness without disabling the interlock, while forced non-refusal defeats the veto while preserving traversal (so bypass and disablement are distinct); client-controlled acceptance makes I2 fail at an HSM without changing the minimal coalition $a$8; and reallocating preservation/suppression/designation powers flips E1 while leaving every causal witness unchanged. These are analytical demonstrations, not empirical validation, and no workload metrics were recorded.

Havenlon instantiation

The source-grounded instantiation analyzes signature production $a$9 in the Havenlon protocol model. Under the stipulated split-control, release-intended, open-state configuration, the ordinary witness requires five domains:

$M$0

and among source-enumerated protocol witnesses, certificate replacement yields the unique inclusion-minimal known requirement set $M$1. The composite still traverses the Arbiter—it is not a structural bypass but a weakening alteration of trusted-input semantics followed by a $M$2-controlled acceptance certificate—establishing I1 and I2 failures relative to $M$3 within the bounded model. Critically, the Linux domain remains insufficient for the complete signing transition, and every source-enumerated witness still requires $M$4 and $M$5. Deployed global non-bypassability ($M$6) and boundary-bound veto coverage remain unresolved; direct-bus, dormant-test, update, manufacturer, recovery, and evidence-administration conclusions stay conditional or unresolved. Self-attestation is established for designated coalitions, but E1 is unresolved because sources establish neither complete contrary-account suppression nor exclusive designation.

Two qualifications deserve emphasis. The split superscript is a stipulated analytical assignment, not a finding that the two MCU modules have independently controlled firmware, update, recovery, or debug roots. And the repository inspection is not a production-image attestation; build definitions, boot configuration, provisioned credentials, and operational administration can change the effective model.

Limitations and open questions

All results are conditional on $M$7, the trust-domain partition, and supplied witness and certificate inventories. Hidden maintenance interfaces, emergency credentials, physical access, or administrative relationships may add witnesses or collapse domain distinctions; positive coverage claims are only as strong as their inventories. Collusion and common-mode failure lie outside scope—coalition size is not a scalar safety score. Implementation correctness is unproven, and missing mediation records cannot prove bypass absent a completeness premise. The evidentiary plane defines no validity, completeness, verifier, or conformance semantics. Specific open questions left by the paper include whether deployed Havenlon satisfies global non-bypassability for $M$8, whether complete controller assignments exist for durable evidence preservation and official designation, and how completeness of witness inventories could ever be established for extensible systems—the procedure admits only bounded abstractions, depth limits, or fixed-point rules.

Conclusion

The framework converts the informal question "who can make the action happen?" into a derivable, predicate-backed analysis over trust-domain coalitions. Its main insights are that execution authority follows complete selected support rather than roles; that component, principal, and threshold counts do not establish trust-domain multiplicity; that lifecycle reconfiguration belongs inside causal analysis; that structural traversal does not entail resistance to alteration, satisfaction, or disablement; and that evidentiary independence is a separate dimension from causal independence. The Havenlon instantiation demonstrates disciplined source-bounded application, with conclusions carefully qualified as model-, threat-, and witness-relative rather than product security claims.