Dynamic delegation in outsourced ICA processes

Get the paper Cite

We consider the problem of enforcing corporate governance control relying on cloud-based services. Extending previous work, we focus, in particular, on the support for delegation of director privileges, enabling their dynamic and temporary assignment to a vice-director. Like previous work, our control relies on encrypted tags, which are extended to address the challenges introduced by dynamic delegation which operates on a time dimension orthogonal to the corporate governance control process. Our solution enables delegation while ensuring a vice-director to enjoy the director privileges only when delegation is active, or on operations for which the vice-director has already started the director phase, and not to operate as director for operations the vice-director has processed as employee (separation of duties). Our tag construction ensures integrity of the dynamic delegation control and protection against tag tampering. Our implementation of the proposed framework, which relies on FoundationDB for persistent encrypted workflow state and OpenBao for key management, demonstrates its viability and integration with current technological solutions. The high throughput obtained in our experimental evaluation confirms the applicability of the approach and the limited impact of delegation.

@article{ica,
	author = {Sabrina De Capitani di Vimercati and Sara Foresti and Stefano Paraboschi and Matthew Rossi and Pierangela Samarati},
	journal = {Computers & Security},
	title = {Dynamic delegation in outsourced ICA processes},
	day = {20},
	month = {August},
	year = {2026},
	volume = {171},
	pages = {105099},
	issn = {0167-4048},
	doi = {https://doi.org/10.1016/j.cose.2026.105099},
	url = {https://www.sciencedirect.com/science/article/pii/S0167404826002750},
	keywords = {Cloud-based services, Outsourcing, Internal controls and audit process, Delegation, Separation of duties},
	abstract = {We consider the problem of enforcing corporate governance control relying on cloud-based services. Extending previous work, we focus, in particular, on the support for delegation of director privileges, enabling their dynamic and temporary assignment to a vice-director. Like previous work, our control relies on encrypted tags, which are extended to address the challenges introduced by dynamic delegation which operates on a time dimension orthogonal to the corporate governance control process. Our solution enables delegation while ensuring a vice-director to enjoy the director privileges only when delegation is active, or on operations for which the vice-director has already started the director phase, and not to operate as director for operations the vice-director has processed as employee (separation of duties). Our tag construction ensures integrity of the dynamic delegation control and protection against tag tampering. Our implementation of the proposed framework, which relies on FoundationDB for persistent encrypted workflow state and OpenBao for key management, demonstrates its viability and integration with current technological solutions. The high throughput obtained in our experimental evaluation confirms the applicability of the approach and the limited impact of delegation.}
}