Disentangling Deontic Positions and Abilities: a Modal Analysis

Abstract

Computational systems are traditionally approached from control-oriented perspectives; however, as soon as we move from centralized to decentralized computational infrastructures, direct control needs to be replaced by distributed coordination mechanisms that are on par with institutional constructs observable in human societies (contracts, agreements, enforcement mechanisms, etc.). This paper presents a formalization of Hohfeld's framework building upon a logic whose language includes primitive operators of ability and parametric deontic operators. The proposal is meant to highlight the fundamental interaction between deontic and potestative concepts and contains proofs of soundness and completeness with respect to a class of relational models.

Keywords

• Institutional Powers • Ability • Modal Logic • Normative
• Positions • Hohfeldian Relations

-

In access control models, \privileges" of users result to be both permissions (for the user to perform the action, and the system can not sustain any claim against it) and powers (as the user creates a duty on the system to perform the action by requesting it). However, merging permission with power, despite being common in control-oriented approaches, is not always a sound choice. For example, data access to distinct public data-sources might be unconditionally enabled, but processing of the aggregated data might still result in illicit outcomes (e.g. producing discriminatory decisions). More generally, as soon as we move from centralized to decentralized systems (e.g. data-sharing infrastructures, distributed machine learning, smart contracts on distributed ledgers, digital market-places), direct control needs more and more to be replaced by distributed coordination mechanisms that are on par with institutional constructs observable in human societies (contracts, agreements, regulations, and related enforcement mechanisms). This requirement emerges because any decision-making of autonomous components/agents requires relatively reliable expectations of the behaviour of the *Copyright '2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). other components/agents, as well as of the measures holding to maintain these expectations, e.g. penalties in case of violations. Making these expectations clear can be seen as the main function of normative artefacts. Strengthening them, of the associated mechanisms of enforcement.

This paper aims to present a logical framework attempting to reduce the gaps amongst existing approaches to normative speci cations, on the basis of the higher-granularity given by Hohfeld's framework of normative relationships [ 8 ], further investigated in the last decades by several contributions in the analytical and theory of law tradition [ 10, 11, 7, 15, 14, 12 ].

A few contemporary e orts are focusing on the operationalization of Hohfeld's framework in practical settings [ 17, 2 ], but so far only few attempts have been concerned with the underlying formal properties in a systematic way. This work is analytical in nature but starts from a pragmatic view: actions will be given rst-class citizenship, and deontic notions (obligations, permission, or prohibition) will be reinterpreted in terms of the actions they enable. Our contribution consists in showing how a language of multimodal logic including labels for action-types, objects and object-con gurations|but involving no form of quanti cation|is adequate to de ne several concepts at the basis of the Hohfeld's framework (such as change, ability, disability, duty and power). On the one hand, the proposed language is more expressive than standard languages of propositional modal logic used for similar purposes (e.g., those in Brown's approaches to represent ability [ 3, 4 ] or those in the STIT-framework [ 9 ], discussed in section 2.3), since it allows one to analyse the internal structure of propositions. On the other hand, logical systems built over it, such as the calculus in this article, can be axiomatized by focusing on a restricted set of primitive modalities, since more ne-grained notions can be treated via purely syntactic de nitions. Furthermore, such a language will be proved to make room for a formal rendering of coordination mechanisms, starting shading light on the relationships between deontic and potestative notions.

The paper proceeds a follows. Section 2 presents the background underlying and motivating the proposal. Section 3 presents the formal notation, and discusses several examples of syntactic de nitions, together with their application in the analysis of some types of normative scenarios (sale contracts, data protection, delegation). It also illustrates a procedure to transform object-con gurations into propositions and addresses the issue of coordination mechanisms. Section 4 provides proofs of soundness and completeness for an example of axiomatic calculus over our language. A note on further developments ends the paper. 2 2.1

Conceptual framework

Types of normative speci cations

Three macro-families of normative speci cations can be identi ed in computational settings: (i) access and usage control models, specifying that actions of an agent on certain resources are either permitted or prohibited, under certain conditions; a typical example for this family is access rules for webservers (Fig. 1); (ii) deontic logic(s), de ning which actions or more often which situations are under obligation, permission or prohibition depending on certain conditions; the relationships between these three concepts can be illustrated on the square of opposition (Fig. 2); (iii) logics inspired by Hohfeld's framework, according to which normative concepts are seen as relationships holding between two parties, and are primarily about actions; the deontic positions of duty and liberty on one party correlate respectively with claim and no-claim of another party; the potestative positions of power and disability of one party correlate respectively with liability and immunity of the other party; the relationships between these concepts are traditionally illustrated on two squares (Fig. 3), named obligative (or rst-order) and potestative (or second-order) square.

Some major distinction can be highlighted: access-control models neglect positive obligations (e.g. about actions that need to be performed by the user), which are instead covered by languages coming from the deontic logic tradition; Hohfeld's framework is the only one making explicit the presence of another party besides the norm addressee, and introducing the category of power, meant to capture the (potential) dynamics of normative relationships as driven by parties. The mainstream tradition within deontic logic, which draws inspiration from general modal logic, is the only approach focusing primarily on situations [ 1 ]. 2.2

Actions and situations

Normative directives aiming to regulate behaviour are generally expressed in terms of (wrong/correct) actions (or courses of actions, i.e. behaviours), or in terms of (wrong/correct) situations. Situations are more easily expressed in propositional terms, and this explains why historically deontic logic moved from actions to situations (see, e.g., [ 1 ]). Yet, these are two sides of a coin. On the one hand, agents are deemed to be primarily evaluated for the conduct they engage with. Norms are meant to give indications about the speci c actions that agents may, may not, or have to perform. On the other hand, law's aim is not to regulate intent, but actual outcome. An enforcer agent is primarily concerned about situations, because even actions can be seen in terms of occurred performances. These internal and external perspectives, i.e. of the subjects acting, and of the subjects observing consequences of actions (or their absence), are clearly interrelated, but carry speci c, plausibly distinct representational requirements.

Mapping these concepts to computational actors can be particularly illustrative for our purposes. Performances of actions correspond in this context to function executions, while their consequences are values in certain registers or other memory components. Action-types and the matter specifying situations can here be labeled respectively with function names and register/variable names. The Order Deny , Allow Deny from all

Allow from example . org Fig. 1: Example of access-control rules, from an Apache web-server con guration contrary

F O e t i s o p p o

No-Claim correlative correlative 4

Privilege

Disability

Immunity correlative

ongoing or occurred performance of an action (execution of a function) can be easily rei ed by means of dedicated boolean variables. However, the most intuitive way e.g. to constrain a program at runtime not to invoke a certain function is to make use of some speci c data-structure that explicitly identi es allowed and/or not allowed functions. In the context of operationalization of norms, because there will be eventually a (computational) agent deciding how to behave, actions gain a primary role, as well as the related concept of ability. The concept of ability has been long investigated in formal logic. In [ 3 ] Brown introduces an intensional operator for ability which takes formulas expressing propositions as arguments and inherits some features of the well-known operator for possibility, being associated with one of the meanings of the modal verb `can' in English. This operator, here denoted by A, is a non-normal one, since it is not closed under the following schema, where A x; means that agent x is able to bring about the proposition expressed by : A x; 1 A x; 1 A x; . An alternative approach is presented by Brown in [ 4 ], where he de nes ability in terms of a a bimodal language with two normal operators u and , where u represents historical necessity and encodes the notion of `bringing about'. If we take  to be the dual of u and make explicit reference to an agent in formulas within the scope of , then we can say that in this approach x has the ability to produce the proposition expressed by i there is a possible course of events in which x brings about , that is: A x; def  x; .

Another popular analysis of the notion of ability in modal terms is o ered within the framework of STIT logic (see, e.g., [ 9 ]), where ability is usually dened via a combination of the deliberative STIT operator (here represented as x dstit , and meaning \agent x deliberately brings about") and historical possibility, as follows: A x; def  x dstit .

By contrast, in our formal framework the notion of ability will be treated as a more complex relation involving an agent, an action and a con guration of object(s). The primary motivation for this approach comes from computational environments, considering \actions" (that is, primitive operators, labeled procedural blocs) as rst-class citizen. Further inspiration comes from the psychological concept of a ordance, rstly introduced by [ 6 ], whose basic outline (see e.g. [ 5 ]) can be logically captured as A ords- environment; organism , where is the behaviour of the organism which is a orded by the environment. A representational account of a ordances has been discussed from a roboticist perspective in [ 13 ], with|neglecting indexing optimizations|the data model e ect ; agent ; entity ; behavior , meaning that the agent can perform a certain behaviour on a certain object to obtain a certain e ect. On similar lines, [ 19 ] suggests that considering actions as events driven by agents, ability can be seen as a more re ned form of the initiates predicate used in event calculus [ 16 ], and thus as a rei cation of agent-driven causal mechanisms. 2.4

Temporal aspects

Our treatment of ability and deontic positions will rely on the assumption that the portion of the world in which agents operate is a system evolving in a nondeterministic way over time. Non-deterministic systems can be modeled via relational structures consisting of a set of nodes denoted by w; w¬; etc., and ordered as a tree by a precedence relation. The tree can be imagined as being left-to-right oriented: it is linear towards the past (left) and possibly branching towards the future (right). The truth of a proposition will be evaluated at a node of a structure, hereafter called the evaluation node. Nodes that are vertically aligned to the evaluation node are simultaneous alternatives of it; nodes that lie immediately on the right of the evaluation node are successive alternatives of it. In our formal language we will use an intensional operator { to quantify over the set of successive alternatives of the evaluation node, as well as an intensional operator u to quantify over the set of simultaneous alternatives of the evaluation node. For our purposes we do not need the expressive power of operators like `until' (U) that are commonly employed in temporal logics of computation (e.g., CTL˜). 3 3.1

Formal framework

A minimal language for directed and located change

In the present section we introduce the symbolic language that will be used for the formal rendering of our theoretical analysis of ability and deontic positions. We start with a minimal language denoted by L and able to express factual information about a non-deterministic world.

De nition 1 (Vocabulary of L) The language L includes: { a set OBJ of labels for objects, entities that may su er change, denoted by x, y, z, etc. and including a special element, the `whole' (i.e., the whole system analysed), denoted by ˜; { a set AGE of labels for agents, entities that may produce change; we assume all agents being part of the whole, and therefore being objects: AGE N OBJ; { a set CONF of labels for con gurations denoted by S1, S2, S3, etc. (each con guration being a possibly partial description of an object at an instant); { a set ACT of labels for action-types, denoted by a1, a2, a3, etc.; { the modal operators u (\at all alternative simultaneous nodes") and { (\at all alternative successor nodes") { the binary predicates is and performs; { the boolean connectives and .

De nition 2 (Well-formed formulas in L) The set of well-formed formulas over L, denoted by WFF, is described by the grammar below, where x " AGE, z " OBJ, S " CONF, and " ACT OBJn, for some n " N: performs x; ¶ is z; S ¶ ¶ ¶ u ¶ { We say that is a (label for a) re ned action-type; it highlights the objects which are involved in its instantiation (e.g., the objects `taxes' and `bank transfer' in the notion of `paying taxes with a bank transfer'). A formula of the form u means that is the case in every simultaneous alternative of the evaluation node (e.g., in the current node Anna is not paying taxes, but we can imagine an alternative arrangement at this time in which Anna pays taxes). A formula of the form { means that is the case in every successive alternative of the evaluation node. A formula of the form performs x; means that x performs a re ned action of type . A formula of the form is x; S means that x is in the con guration S.

Basic formulas in L are formulas of type performs x; and of type is x; S . A basic formula in L describes an atomic proposition. The boolean connectives for conjunction, disjunction and material equivalence, as well as dual modal operators of possibility ( and ‰), can be de ned in the usual way. 3.2

Relevant de nitions

Con gurations and propositions In L we can de ne predicates that are in a one-one correspondence with con gurations. For instance, suppose that the whole system is in the con guration raining. Then, we can de ne a 0-ary predicate (i.e., atomic proposition) raining as follows: raining

def is ˜; raining Vice versa, we can associate con gurations of the whole system with the propositional formulas describing them. More formally, for any " WFF which is not in the form is ˜; : : : we can extend the set CONF with a symbol S , denoting the arrangement that holds when is the case:

is to avoid recursive nesting, e.g. raining, is ˜; raining , is ˜; Sraining , is ˜; Sis ˜;raining , etc.

Change and continuity A binary predicate becomes, meant to capture a change of con guration concerning an object, can be de ned as follows: We can also de ne the dual concept of absence of change, or continuity: becomes y; S

def is y; S 0 { is y; S keeps y; S

def is y; S 0 { is y; S Ability Extending the approach proposed in [ 19 ], a general schema to represent the ability of an agent x to produce a con guration S via a re ned action of type is as follows: From this, one can infer that if an agent x has the ability to produce a con guration S by performing a re ned action of type , then x can cause S to become a new con guration of the whole (whereas without performance this needs not be the case). In other words, our de nition of ability entails that becomes ˜; S is true consecutively at all nodes in which x performs an action of type and S is not already holding.

Disability and Inhibition A concept dual to ability is disability. One way to de ne it would be by applying negation on ability. In this way, we get disability of obtaining an e ect with respect to a particular type of re ned action: performs x; 1 {is ˜; S 1  performs x; The negation implies either that the agent cannot perform the re ned action , or the outcome will be in any case present, or that the connection between performance and outcome does not necessarily works, i.e. that there is some lack of controllability, because there is some consecutive node for which the change does not occur. Strengthening this characteristic, i.e. making in sort that for all consecutive nodes the change will not occur in presence of performance, allows us to de ne the ability of inhibiting a world con guration, or negative ability : has neg ability x; ; S Because negative ability is still a form of controllability (although in negative sense), a full disability can to be de ned as lack of ability and of negated ability: has disability x; ; S def Disability, positive and negative abilities can be used to introduce further notions as enabling and disabling actions, interference, etc., see e.g. [ 19 ]. We can extend the minimal language L in a modular way. In this article we focus on an extension LN including normative concepts: for any x; y " AGE, we take an operator xOy. In the de nition below, we rely on the notion of subformula of a formula , which is understood in the usual way.

De nition 3 (Well-formed formulas in LN ) We denote by WFFN the set of formulas which can be obtained from any " WFF by pre xing a nite (possibly empty) sequence of operators of kind xOy to any of its subformulas.

A formula of the form xOy means that is obligatory for x with respect to y (directed obligation, see e.g. [ 7 ]). We use the standard de nition of prohibition (F ) and permission (P ): xFy def xOy , and xPy def xOy . Hohfeld's framework of concepts The normative relationships identi ed by Hohfeld [ 8 ] consists of two groups of concepts, illustrated on the obligative and potestative squares (Fig. 3). Several axiomatizations have been proposed along the years [ 10, 11, 7, 15, 12 ], in the great majority relying on some framework for agency logic with no explicit reference to action-types; however, a systematic joint treatment of deontic and potestative concepts has not been yet developed. Our proposal is distinct as it considers \action" to be a primitive object of analysis. Using the proposed notation, we can set the following de nitions. For the obligative square: { duty: xDTy def xOyperforms x; { claim-right: yCRx def xDTy { privilege (liberty): xP Ry def xPyperforms x; { no-claim: yN Cx def xP Ry For the potestative square: { power: xP OWy { liability: yLBLx { disability: xDISy { immunity: yIM Mx ; ; def has disability x; ; SyOx

def xDISy ;

These de nitions follow assumptions implicit in Hohfeld's presentation, namely that duty is a directed obligation about a performance of the duty-holder and that, following the legal tradition, institutional power is primarily about creating duties. We also followed the approach suggested in [ 18 ] to consider the privilege position as corresponding to liberty, and disability as a conjunction of lack of ability and lack of negative ability, so as to recover the original symmetry between the two squares that is lost in the other formalizations.3 Extending Hohfeld's framework Hohfeld's assumptions might be however relaxed for a general application of the notation. First, one could specify a duty independently of the person performing that action; for instance, parents have the duty that their kids go to school. Second, duties might be about con gurations, e.g. landowners have to maintain their land in an adequate state to prevent propagation of re. For these reasons, for the concepts of the obligative square, we propose to replace the performance of by x with any formula from L: { duty: xDTy

def xOy For the potestative square, Hohfeld's power is about creating duties, but one could extend the term to cover the abilities of releasing from a duty, and in principle, also the abilities of creating or destroying powers. Such an approach would allow us to identify the whole structure that determines the dynamics of a normative system, not only its super cial layer. We have then: { power: xP OW ; ¬

def has ability x; ; S ¬ where ¬ is a formula de nitionally equivalent to one in the form yDTx or yP Rx , or in the form xP OW ; ¬ or xDIS ; ¬ . Accepting conjunctions of those terms implies that several parties might be associated to duty-holder positions. Note that the party/parties in the correlative position of power positions can be omitted as those are determined by the inner formulas. 3.4

Examples of application

Sale contract Using Hohfeld's primitive concepts (here in the extended form), the execution of a sale would be characterized in terms of mutual duties and claims holding between a buyer x and a seller y: xDTy performs x; pay

0 yDTx performs y; deliver 3 This choice supports the introduction of additional positions otherwise neglected: protection, correlative to a negative duty (prohibition), and negative power, correlative to negative liability, illustrated on the Hohfeldian prisms [ 18 ]. The formation of such a contract, in the bilateral case, consists of o er and acceptance steps, associated to two forms of power. The overall normative pattern can be modeled as: yP OW o er ; xP OW accept ; xDTy performs x; pay Data protection Following data protection regulations (e.g. GDPR), legal processing of personal data requires consent from data subjects. Usually this mechanism is seen as a conditional duty (simplifying, if data belongs to y, x must collect consent from y). However, this is an arguable choice; this duty can be literally violated (e.g. because y may not provide consent) without any legal consequence. The normative relevant positions are that processing is in general prohibited, unless there is consent. This means that a data controller has the power to release the prohibition existing by default, by collecting consent: xDTy performs x; process

0 xP OW collect consent ; xP Ry performs x; process Delegation Power rei es a causal mechanism that modi es normative relationships holding between parties. The rei cation enables to treat this mechanism as an object, i.e. to create or destroy it at need. This is not possible if the representation is limited on conditional statements modeling the content of power. We consider an example. As an institutional pattern, delegation holds in cases in which x is granted a power associated to some re ned action , but is also granted to grant this power to someone else, (possibly) losing the original power: xP OW ;

0 xP OW delegate; yP OW ; 0 xDIS ; 3.5

Coordination mechanisms

Deontic notions can be seen as setting up speci c social coordination mechanisms. Three activities might be generally associated to any norm regulating behaviour: performance concerns the abilities of the duty-holder x, monitoring concerns the abilities of duty-claimant y (whose role, from a coordination perspective, is to signal whether expectations are met), enforcement typically concerns a judiciary system j to which y refers to protect its rights (see e.g. [ 12 ]). We will present here an elaboration on a simpli ed form of the signaling aspect, leaving the rest to future study.

Let us denote with V and F the con gurations of the whole in which a norm having content N is deemed to be respectively violated and ful lled. Separating performance from monitoring, the creation of V or F can occur only after intervention of the duty-claimant y, so this actor needs to have the associated abilities for doing so. Yet, these abilities are not arbitrary, but conditioned by the actual state of the world, in relevance to the norm. Thus, any active prescriptive norm N as xDTy comes also with two conditional powers:

N where S is the con guration associated to , V and F are distinct signaling actions possibly performed by the duty-claimant, respectively associated to violation and ful llment. In contrast, with an active permissive norm Nperm as xP Ry , the duty-holder x gains immunity from any attempt of y to signal violation in case of performance and of non-performance (i.e. always): Note that, on a normative system level, these mechanisms need to override (to inhibit) where necessary all precedent norms. A complete treatment of this aspect is beyond the scope of this paper. 4

Logical system

In the present section we de ne an axiomatic calculus and a class of standard models for a rigorous transposition of the conceptual framework discussed in the previous part of the article; will be shown to be sound and complete with respect to its standard models. 4.1

Syntactic derivability

De nition 4 (Axiomatic basis) The calculus is fully speci ed by the following list of axioms and rules: A0 All substitution instances of tautologies of the Propositional Calculus; R0 Modus Ponens; A1-R1 S5-principles for the operator u; A2-R2 K-principles for the operator {; R3 To infer xOy xOy from , for any x; y " AGE. A3 u { { u ; A4  { á u { á; A5 xOy ‰ .

A few remarks on the basis are helpful to clarify the ideas behind: axioms A0, A1 and A2, together with rules R1 and R2, are standard principles for normal multimodal systems. Rule R3 says that operators of kind xOy are congruential: if two propositions are provably equivalent, then either each of them is obligatory or neither of them is obligatory. This is a very weak deductive principle for obligations, able to avoid many paradoxes of deontic reasoning a ecting normal modal operators (see, e.g, [ 1 ]). Axioms A3 and A4 capture the relation between simultaneous alternatives and successive alternatives of the evaluation node. Axiom A5 conveys a simple form of the Ought-imples-Can thesis: if something is obligatory, then it holds in some successive alternative of some simultaneous alternative of the evaluation node. De nition 5 (Derivation) A derivation in is a nite sequence of formulas 1; :::; n s.t., for 1 & i & n, i i s¬ either an axiom of or is obtained from some formulas in the sub-sequence 1; :::; i 1 via the application of a rule among R0, R1, R2 and R3.

De nition 6 (Derivable formula) A formula " W F F N is derivable in (in symbols, à ) i there is a derivation 1; :::; n where n .

De nition 8 (Truth-conditions) Formulas of LN are evaluated at a node w of a model M, according to the truth-conditions provided below: { M; w è performs x; i I x ; I ; w " I performs ; { M; w è is x; S i I x ; I S ; w " I is ; { M; w è u i for all v " Ru w , we have M; v è ; { M; w è { i for all v " R{ w , we have M; v è ; { M; w è xOy i " fxOy w .

De nition 9 (Standard models) A standard model satis es the properties: PA Ru is an equivalence relation; PB if is derivable in , then for all w " W , " fxOy w i PC R{ ` Ru N Ru ` R{ PD either (i) for all u " Ru w , R{ u o

or (ii) for no u " Ru w , R{ u o; PE if " fxOy w , then there is u " Ru w and v " R{ u s.t. M; v è . " fxOy w . Property PA is a quite natural choice to characterize simultaneous alternatives (since simultaneity is on its own an equivalence relation). Properties PB and PE have been already discussed with reference to the corresponding axioms/rules (R3 and A5). Property PC indicates that if we move one step forward in time and look for simultaneous states, we nd a subset of the states that are reachable by rst looking at simultaneous states and then |for each of these| moving one step forward. Property PD indicates that the end of time is a global phenomenon: it either a ects all branches of a model or none. However, this has to be distinguished from the end of change (i.e., the fact that formulas keep having the same truth-value after some point), which may a ect a proper subset of all the branches.

De nition 10 (Valid formula) A formula " WFFN is valid in a model M i M; w è for all w " W ; is valid in a class of models Cm i it is valid in all models of the class. If is valid in every standard model, we write è .

Theorem 1 (Soundness) For every

" WFFN , if à , then è .

Proof. A standard induction on the length of derivations: every axiom of the system is valid in all standard models and all rules of the system preserve validity in standard models. For the sake of example, we show the validity of two axioms, A4 and A5. In the case of A4, assume that there is a node w in a standard model M s.t. M; w è  { á and M; w è u { á. This means that there is a node v " Ru w s.t. M; v è {á and that it is not the case that for all u " Ru w , we have M; u è {á. Therefore, there is v¬ " Ru w s.t. M; v¬ è {á. From this one can infer R{ v o and R{ v¬ j o, which contradicts PD.

In the case of A5, assume that there is a node w in a standard model M s.t. M; w è xOy but M; w è  ‰ . Then for all u " Ru w we have M; u è { and this means that for no such u there is a v " R{ u s.t. M; v è , which contradicts PE.

Theorem 2 (Completeness) For every

" WFFN , if è , then à .

Proof. For the completeness proof we rely on the canonical model for , using the language LN as its own interpretation. We will adopt the following abbreviations: u w r u " wx and { w r { " wx. The canonical model for is built in the following way:

Relying on a straightforward adaptation of the truth-lemma for propositional multimodal logic, we have that for every formula " WFFN and every maximal -consistent set (hereafter, m.c.s.) w, the following holds: M; w è i " w. We need to show that the canonical model is a standard one, namely, that is satis es properties PA-PE. The case of PA follows from well-known results on the completeness of system S5 and the de nition of standard models.

In the case of PB, assume that is derivable in . Then, we can infer that belongs to every m.c.s., whence that (due to R3) xOy xOy belongs to every m.c.s. as well. By the truth-lemma, we can conclude that for every m.c.s. w we have M; w è xOy xOy , whence, by the truth-conditions, that " fxOy w i " fxOy w .

In the case of PC, assume that R{ w ` Ru w N© Ru w ` R{ w for some m.c.s. w. Then, there is a m.c.s. v s.t. v " R{ w `Ru w and v Š Ru w `R{ w . Let be a formula which distinguishes v from any other m.c.s. (that is, for every u " W , we have " u i v u; there is always such a formula due to the de nition of a canonical model). By construction, ‰ " w. Now, A3 is provably equivalent with ‰  ‰ , whence, given that all instances of A3 are included in w, we have  ‰ " w. But then there is z " Ru w ` R{ w s.t. " z. Yet, since distinguishes v from any other m.c.s, we must have z v.

In the case of PD, assume that there is some m.c.s. w s.t., for some u " Ru w , we have R{ u o. From this we can infer that {á " u and  { á " w. Since w contains all instances of A4, then u { á " w and, for any z " Ru w , we get that {á " z, whence R{ z o.

In the case of PE, assume that " fxOy w for some m.c.s. w. Then, xOy " w and, since w contains all instances of A5,  ‰ " w, which entails that there is u " Ru w and v " Ru u s.t. " v; by the truth-lemma, we get M; v è . 5

Conclusion and Future Developments

The paper reports on a research e ort unifying insights from modal logic and normative systems, having in mind applications on complex cyber infrastructures. The key contribution of the paper is to make explicit the deep entrenchment between deontic and potestative categories, and how the second ones are required to model complex coordination structures (e.g. delegation). Future developments will concern the completion of the analytical e ort, focusing on the mechanisms of enforcement, investigating the relations of powers with conditional obligations, and extending those results introducing roles for objects and agents and more complex forms of re ned actions. Additionally, we started working on computational implementations of the proposed axiomatization (e.g. in logic programming, proceeding similarly to [ 19 ]).

Acknowledgments Giovanni Sileno was supported by NWO for the DL4LD project

(Data Logistics for Logistics Data ) (628.001.001). Matteo Pascucci was supported by the tefan Schwarz Fund for the project \A ne-grained analysis of Hohfeldian concepts" (2020-2022). Authors Contributions Sections 2 and 3 are mainly due to GS, Section

4 and 2.4 to MP. The authors contributed equally to 2.3 and 3.1. Disentangling Deontic Positions and Abilities: a Modal Analysis 15

References

1. Aqvist , L. : Deontic logic . In: Gabbay, D. , Guenthner , F . (eds.) Handbook of Philosophical Logic , vol. 8 , pp. 147 { 264 ( 2002 )

2. van Binsbergen, L.T. , Liu , L.C., van Doesburg , R., van Engers, T. : eFLINT: a Domain-Speci c Language for Executable Norm Speci cations . In: GPCE 2020: Proceedings of the 19th ACM SIGPLAN International Conference on Generative Programming ( 2020 )

3. Brown , M.A.: On the logic of ability . Journal of Philosophical Logic 17 ( 1 ), 1 { 26 ( 1988 )

4. Brown , M.A.: Normal bimodal logics of ability and action . Studia Logica 51 ( 3-4 ), 519 { 532 ( 1992 )

5. Chemero , A. : An Outline of a Theory of A ordances . Ecological Psychology 15 ( 2 ), 181 { 195 ( 2003 )

6. Gibson , J.: The ecological approach to visual perception . Houghton Mi in, Boston ( 1979 )

7. Herrestad , H. , Krogh , C. : Obligations directed from bearers to counterparties . Proceedings of the International Conference on Arti cial Intelligence and Law (January 1995 ), 210 { 218 ( 1995 )

8. Hohfeld , W.N. : Fundamental legal conceptions as applied in judicial reasoning . The Yale Law Journal 26 ( 8 ), 710 { 770 ( 1917 )

9. Horty , J.F. , Belnap , N. : The deliberative stit: a study of action, omission, ability, and obligation . Journal of Philosophical Logic 24 ( 6 ), 583 { 644 ( 1995 )

10. Lindahl , L. : Position and Change: A Study in Law and Logic . Synthese Library , Springer ( 1977 )

11. Makinson , D. : On the formal representation of rights relations . Journal of philosophical Logic 15 ( 1986 )

12. Markovich , R.: Understanding Hohfeld and Formalizing Legal Rights: The Hohfeldian Conceptions and Their Conditional Consequences . Studia Logica 108 ( 1 ), 129 { 158 ( 2020 )

13. Sahin , E. , Cakmak , M. , Dogar , M.R. , Ugur , E. , Ucoluk , G. : To A ord or Not to A ord: A New Formalization of A ordances Toward A ordance-Based Robot Control . Adaptive Behavior 15 ( 4 ), 447 { 472 ( 2007 )

14. Sartor , G.: Fundamental legal concepts: A formal and teleological characterisation . Arti cial Intelligence and Law 14 ( 1 ), 101 { 142 ( 2006 )

15. Sergot , M.J.: A computational theory of normative positions . ACM Transactions on Computational Logic (TOCL) 2 ( 4 ), 581 { 622 ( 2001 )

16. Shanahan , M.: The event calculus explained . Arti cial Intelligence Today pp. 409 { 430 ( 1999 )

17. Shari , S. , Parvizimosaed , A. , Amyot , D. , Logrippo , L. , Mylopoulos , J.: Symboleo: Towards a Speci cation Language for Legal Contracts . In: IEEE International Requirements Engineering Conference (RE'20), RE@Next! track ( 2020 )

18. Sileno , G. , Boer , A., van Engers, T. : On the Interactional Meaning of Fundamental Legal Concepts . In: Proceedings of the 27th International Conference on Legal Knowledge and Information Systems (JURIX 2014 ). vol. FAIA 271 , pp. 39 { 48 ( 2014 )

19. Sileno , G. , Boer , A., van Engers, T. : Towards a Computational Theory of Action, Causation and Power for Normative Reasoning . Proceedings of the 32nd International Conference on Legal Knowledge and Information Systems (JURIX 2019 ) ( 2019 )