DelSoN: Bridging the Gap Between Social Trust and Technical Access Control

TL;DR

Social networking has evolved from personal sharing to professional business management, yet our security models haven't kept up. DelSoN (Delegation for Social Networks) is a groundbreaking model that allows users to delegate specific tasks—like replying to messages or posting updates—to others without surrendering their passwords or full administrative control. It uses a socio-technical approach to ensure that "digital proxies" remain accountable while owners retain ultimate authority.

Problem & Motivation: The "Admin" Trap

In the physical world, we delegate authority constantly (e.g., a CEO delegating to a secretary). In the digital world, specifically on social networks, we are often stuck in an "all or nothing" paradox. If a company wants an expert to manage their Facebook page, they often have to make them an "Admin," providing far more power than necessary.

The authors identify that current models fail because:

• Traditional RBAC (Role-Based Access Control) is too rigid; it doesn't account for the personal ownership inherent in social profiles.
• Trust-based models act more like recommendation systems rather than strict security protocols.
• Insecure workarounds, like password sharing, remain the status quo for small businesses.

Methodology: The Socio-Technical Blueprint

The brilliance of DelSoN lies in its Reduction Tree approach. The authors didn't just build a technical tool; they analyzed social psychology to determine how delegation should work based on thousands of years of human cooperation.

The Seven Pillars of Digital Delegation

The paper defines a specific "path" through the design space for social networks:

1. Authority: Only the Owner can delegate.
2. Autonomy: The delegatee has Complete Autonomy to act within their scope.
3. Cardinality: Supports Multiple delegatees for scalability.
4. Totality: Primarily Partial; delegating only specific subsets of rights.
5. Consent: Requires Joint Consent from both the owner and the proxy.
6. Depth: Allows No Pass or Single Pass to prevent the "dilution of accountability."
7. Visibility: Differentiates between Public, Private, and Protected actions.

Figure 1: The Systematic Reduction Approach to Delegation Semantics.

Ensuring "Rights Consistency"

Delegating a right can create messy conflicts. What if a user is already blocked from a certain folder but is then delegated rights to see it? DelSoN uses logical algorithms to detect:

• Strict Conflicts: Preventing "Yes" and "No" rights from overlapping.
• Redundancy: Cleaning up unnecessary permissions to keep the system fast.
• Role Hierarchies: Ensuring that high-level roles correctly inherit (or don't inherit) delegated tasks.

Implementation: Real-World Testing on Facebook

The authors didn't just stay in the realm of theory. They implemented DelSoN using Facebook APIs, demonstrating a "Delegate" button that pops up directly on posts. This allows a stakeholder to select a specific friend and assign them a "Responsibility" (a tie between a right and an object) with a fixed duration (Time-based revocation).

Figure 2: Real-world UI for delegating rights via Facebook API.

Experiments & Results: Human Acceptance

Technical security is useless if humans find it cumbersome. The authors conducted User Acceptance Testing (UAT) with graduate students and conference organizers.

Key Findings:

• Ownership & Control: Users felt a high sense of authority over their data (Mean: 5.93/7.0).
• Motivation: Delegatees (proxies) felt more motivated and affiliated with the team when they were given clear, delegated responsibilities rather than shared account access.
• Auditing: The use of "tokens" linked to every action allowed delegators to trace errors easily, significantly increasing trust.

Table 1: DelSoN vs. 27 other models. Notice that DelSoN is the only one checking all boxes for Ownership, Accountability, and Intransitivity.

Critical Insight & Conclusion

The core takeaway from this paper is that delegation is not just a technical feature; it is a social contract. By formalizing concepts like "Joint Consent" and "Intransitivity," the authors have provided a roadmap for future social platforms to become professionalized.

Limitations: While the model is robust, it primarily focuses on user-to-user delegation. In the coming years, we will need to see how these models adapt to User-to-AI delegation, where autonomous agents manage our social presence.

Future Outlook: DelSoN sets the stage for a "Delegated Web" where we can participate in communities through trusted proxies, maintaining our privacy while scaling our digital influence.