[cap-talk] Authority is always potential

[Jed Donnelley]

On 9/19/2007 6:36 PM, Mark Miller wrote:
> First, I must admit I've only been skimming this thread, so my
> apologies if my remarks are redundant, irrelevant, or already refuted.
> But from the skimming I've done, it seems to me we keep dancing around
> a distinction that, IIUC, Fred got right in his thesis.
> 
> Authority is about causality. Causality is about counter-factuals,
> i.e., reasoning over sets of possible worlds consistent with one's
> partial knowledge. If you have full knowledge of an actual system,
> including the actual behavior of all the objects in the system under
> all conditions, then causality and authority are meaningless in
> attempting to describe this system.

I haven't yet read most of Fred's thesis, so apologies for any
demonstrated ignorance there.

Still, to me there is still meaning in the authority
concept even if one assumes full knowledge of an actual
system, including the actual behavior of all the objects
in the system under all conditions.

Take a simple example:

Imagine a program executing in an environment where it
has two possible inputs (permissions):

Input:  On/off state of the red switch
        On/off state of the blue switch

and two potential outputs (permissions):

Output: On/off state of the red light
        On/off state of the blue light

If the program is something like:

while true do {
  if (red switch on) then turn on red light
  else turn off red light

  if (blue switch on) then turn on blue light
  else turn off blue light
}

then I could imagine this program executing
with or without authority to turn on or off the
red and blue lights (or the authority to sense
the state of the red or blue switches).

If, for example, in a given execution
environment the program has the authority to
control the red light but not the blue one,
then, depending on its input, it may or may
not be able to exercise its intent when the
blue switch is turned on or off.

One could similarly understand the consequences for
the results of its behavior with or without
permission to sense the red or blue switches.

To me these permissions constitute the authority
granted to the program by its execution environment,
even if I have full knowledge of the system,
including the actual behavior of all the objects in
the system under all conditions.

Still, I follow and agree with:

On 9/19/2007 9:16 PM, Mark Miller wrote:
> On 9/19/07, Mark Miller <erights at gmail.com> wrote:
>> For a given system and a given stakeholder, that stakeholder
>> will rely upon some objects to constrain the behavior of other objects
>> they don't rely upon.
>
> My message was way too abstract/obtuse. Let's return to our canonical example:
>
> Once Alice sends the revoke() message, Alice relies on the Caretaker
> to deny Bob the authority to invoke Carol.
...

So perhaps I'm inappropriately taking issue with an
unintended (intended?) minutia from your abstraction MarkM?

I think of the authority that a program runs with as
part of the external environment that it may run in
at any time.  If one were to take the president of the
United States and put that person in a different
environment (away from the trappings of presidential
authority) then the consequences of their actions would
be very different - even if one understood exactly how
they would act under any set of conditions.

--Jed  http://www.webstart.com/jed/