Towards a Theory of Accountability and Audit

Enforcement of authorization policies is traditionally via controls that are imposed before shared resources are accessed. Recently, there has been great interest in the exploration of accountability mechanisms that rely on after-the-fact verification. Currently, accountability lacks the formal foundations that are available for access-control. This paper makes two contributions to the theory of accountability and audit: 1. We describe an operational model of accountability based systems. 2. We describe analyses to support the design of accountability systems and validation of auditors for finitary accountability systems. Our study provides formal foundations to explore the tradeoffs underlying the design of accountability systems, between the power of the auditor, the efficiency of the audit protocol, the requirements placed on the agents and the communication infrastructure of the system.