Delegated Operation: Software for the Body with More Than One Owner

1.Introduction

The scene repeats in millions of households every week. An adult child opens a video call with a parent. The parent shares their screen. For the next forty minutes, the child operates the parent's bank portal through the parent's mouse — reading a statement aloud, walking them through a transfer form, catching the confirmation screen before a timeout — while the parent watches their own finances happen to them. Nothing about this arrangement appears in any system's design document. The bank's authentication, its device fingerprinting, its fraud models, its "unusual login" detection: all of them assume the person at the session is the account's person, and all of them are, in this scene, wrong. Multiply the scene by every phone plan that has to be managed for a parent in another city, every pharmacy refill that fails while someone is hospitalized, every insurance portal whose password lives in a notepad, every smart thermostat in an empty house that a child tries to keep from freezing pipes. The United States counts 53 million unpaid family caregivers (AARP/National Alliance for Caregiving, 2020); the census of software being operated by someone other than its user has never been taken, because no architecture has ever made the distinction countable.

Software's identity layer was built for a world that never existed. The single-principal assumption — one account, one human, always present, always able — was a reasonable simplification for the systems that inherited it (timesharing, then databases, then the web), and it became load-bearing everywhere: authentication proves that the principal is present, authorization assumes the principal is the actor, audit logs the actor as the principal, and every abuse team's playbook treats "someone else is using the account" as the attack rather than as, several million times per day, the point.

The thesis in one sentence: proxy operation is a mainstream, permanent, growing mode of software use with no first-class protocol — and the protocol is fully specifiable today by composing capabilities that enterprise, identity, and assistive software each already possess.

The paper's structure follows the program's method: Section 2 states the assumption precisely and traces it to its architectural roots. Section 3 verifies the gap against the existing landscape, sink by sink. Section 4 explains the gap's survival. Section 5 specifies the protocol. Sections 6–9 evaluate, bound, and confront.

2.The single-principal assumption, stated and traced

The assumption is a compound of four sub-assumptions, each false in caregiving and proxy arrangements, and each independently load-bearing in current architecture:

1. Identity = actor. The authenticated principal is the person performing actions. False whenever an operator acts for a primary. Enterprise software dissolved this assumption decades ago (RBAC, service accounts, delegated admin); consumer software never did, because consumer identity products were built on the "one human, one credential" simplification that made onboarding cheap.
2. Presence = capability. The principal can see, read, remember, and transact. False across the entire gradient the assumption ignores: low vision, tremor, memory decline, language barriers, situational incapacity (driving, hospitalized, detained), cognitive load. Accessibility engineering patches the interaction layer (screen readers, switch access) for sensory and motor variance but not the authority layer for attention and cognition variance.
3. Consent = continuous. Authorization decisions are made by a present, oriented principal. Real consent in proxy arrangements is granted in advance, in weaker moments, for futures that arrive differently — the parent authorizes the child "to handle the phone thing" at 3 p.m. in the kitchen, and the child encounters an authentication wall at 11 p.m. in another city. Software has no memory of the kitchen conversation; the notepad password is its folk replacement.
4. Account = person = life. Death, transition of care, institutional moves, custody changes, power-of-attorney activation — the transitions of principalhood — are modeled as account closure at best. The continuity family of this program (P-008 device succession, P-010 maintainer succession, P-011 behavioral succession) established the pattern: systems without a succession state machine default to their worst available behavior at every transition. Principalhood is the last unsuccessioned transition.

The four sub-assumptions are why every workaround in §1 exists: if the architecture cannot express "another person, acting for this person, within bounds, with the person watching," then the users build it anyway, out of passwords and screen-shares, and the security organization files the arrangement under account-takeover fraud.

3.The landscape: every component exists, no consumer composition

Email delegation. The oldest and cleanest proof the concept ships when a vendor wills it: major consumer webmail has allowed delegated access — another account reading and answering mail on the primary's behalf, with the primary able to grant and revoke — for two decades. It is precisely the operator pattern, and its isolation is diagnostic: it never spread to the rest of the vendor's own products, let alone the industry, because it was a feature, not a protocol.

Parental controls. Family-link products implement the inverse of caregiving — a guardian operating with authority over rather than on behalf of a dependent — and in doing so built real protocol pieces: consent choreography between devices, approval workflows for actions (purchase approval, app approval), screen-time governance, and location sharing. The direction of authority is wrong for eldercare (the dependent is the primary here, not the child), the privacy model is wrong (surveillance-grade visibility is acceptable for a nine-year-old and an assault on a seventy-nine-year-old's dignity), but the machinery — request/approve pairs, per-category grants, expiry — is directly reusable.

Password-manager vault sharing. The pragmatic stopgap of the last five years: families move credentials into shared vaults, which at least centralizes the notepad. The vault inherits single-principal semantics wholesale — the operator is indistinguishable from the primary, sessions are the primary's sessions, no act-level audit exists, and the grant is the credential itself, the coarsest possible capability bundle. That families adopted this instrument at scale is the demand signal: users built the schema the industry wouldn't.

Financial services. The sector with the strongest legal instruments and the weakest software: powers of attorney are accepted through paper, branch visits, and dedicated teams; a handful of banks offer view-only third-party access; UK banks run third-party mandates under banking-industry guidance. Elder financial abuse — estimated by AARP at roughly $28 billion annually in the United States — is the sector's own argument for act-level delegation with audit trails, and the sector's answer is a PDF form.

Healthcare. HIPAA defines personal representatives with formal rights to a patient's information, and patient portals largely ignore the operational problem: caregivers share portal credentials in violation of terms, or print screens. The clinical alarm-fatigue and care-team literature (P-014's territory) is separate; here the relevant prior art is the rule (45 CFR §164.502(g)) without the runtime.

Enterprise identity. RBAC, delegated administration, just-in-time access, break-glass with audit — the complete pattern library, priced for organizations and never ported to households. OAuth and its successors solved application delegation (an app acting for a user via scopes) and explicitly not human delegation (a person acting for a person on a first-party surface); the vocabulary ("delegated authorization") has caused a decade of category confusion in exactly this paper's territory.

Academic HCI. A real literature on proxy use, caregiver infrastructure, and "proxies in personal health records" documents the workarounds, the privacy negotiations, and the burden distribution — demand-side evidence from the field, with no architectural answer, because the field measures rather than specifies.

Screen sharing. The dominant instrument's honest description: it is the absence of delegation, executed as a body-transfer — the operator borrows the primary's eyes, hands, and authentication at 15 frames per second. It works, which is the problem: any protocol must beat it on convenience while destroying its security posture.

VERDICT: STRONG. Component maturity across six adjacent worlds, zero consumer-grade composition, a demographic driver operating in one direction for thirty years, and a status quo (credential sharing) that is maximally favorable to attackers. No incumbent is in the gap; several are one architectural decision away from entering it, which is the standard gap shape this program's papers exist to specify before someone specifies it badly.

4.Why the gap survived

The identity layer is upstream of everyone's roadmap. Authentication-as-a-service commodified the single-principal model; changing it means touching every session, every audit log, every fraud model — the least tractable refactor in consumer software. Delegation is an identity-model feature pretending to be a product feature, and identity-model features ship only when platforms decide they are load-bearing.

Security orthodoxy classified the use case as the threat. "Someone else is in the account" is account-takeover, the canonical attack; abuse teams were trained on it for twenty years. The possibility that the someone else is the system's legitimate second principal was a policy exception with no data model, so it became a human exception — the support agent who quietly helps grandma's caregiver and asks no questions. Exceptions do not become protocols by accretion.

Monetization runs per-seat. Two principals operating one account doubles support surface for one subscription. The ToS clauses against credential sharing (selectively enforced — the streaming password crackdowns of 2023 demonstrated the enforcement machinery exists and is aimed at licensing, not security) exist to protect the per-seat model, and delegating operation without delegating ownership is precisely the distinction that model cannot price.

Compliance fear is a legitimate-looking shield. KYC, fraud liability, HIPAA — every regulated surface treats the principal's own body as the trust anchor, and the industry concluded that the only safe answer is to refuse proxies. The regulatory texts are more permissive than the products (personal representatives, powers of attorney, third-party mandates all exist in law), but compliance teams price the operational risk of building it wrong into infinity and decline.

The constituency is invisible in the data. Caregivers do not appear in analytics as a segment; they appear as session anomalies to be suppressed. The demand is real, physical, and universal in the life course — and it is invisible to every dashboard, which is why no product roadmap ever says the word caregiver.

5.The protocol

5.1 Principals and operators

The identity model gains one type: the operator — a full principal with their own authentication, devices, and reputation, linked to a primary through a grant rather than a credential. Operators are not sub-accounts (they exist independently, may operate several primaries — the sandwich generation runs two at once — and may be operated for by others later: the protocol is composable). The grant is the unit of trust, and everything downstream scopes to it.

5.2 Capability bundles: the act

The grant enumerates acts — named, permission-sized operations in the product's own vocabulary (view balance; read statements; schedule payment ≤ X; refill prescription; respond to sender L; adjust thermostat). The act's granularity is the design decision that carries everything: coarser than acts, the operator is the primary (the password-sharing failure); finer, and the protocol collapses into unusable micro-permissions (the mobile-permission-dialog failure). Acts are product-defined but protocol-typed: each carries a class (read / write / spend / communicate / irrevocable), a bound (amount, recipient class, rate), and a disclosure surface (what the act reveals to the operator — the privacy dial, since "view balance" and "view balance with full transaction history" are different dignities).

5.3 The autonomy ladder

Grants sit on a five-rung ladder, and the protocol's core interaction is movement between rungs — the graduation ceremony:

1. Observe. The operator sees a projected view (status, alerts, upcoming deadlines) and nothing else. Rung for beginnings, and for principals who want help staying oriented rather than help acting.
2. Advise. The operator composes suggested actions; the primary approves each on their own device. Rung for cognitive-load relief while authority stays put.
3. Co-act. Joint control: acts execute only with both parties' assent (two-device confirmation), timing negotiated either way. Rung for shared finances, early cognitive decline with preserved capacity.
4. Act. The operator executes grants within bounds; the primary can audit at will. Rung for standard long-distance caregiving.
5. Break-glass. Explicit, bounded, alarming: the operator exceeds bounds under an emergency declaration; acts execute, every stakeholder is notified, retroactive review is mandatory. Rung for hospitalizations and crises.

The ladder's rungs are one-directional by default with ceremonies in both directions: escalation requires the primary's consent whenever capacity exists, and de-escalation requires no one's — the dignity-preserving asymmetry that parental-control software gets backwards for eldercare.

5.4 Grant semantics

Every grant carries: scope (the act list), bounds (per-act ceilings and rates), term (time-boxed, renewable by the primary's device; indefinite terms require periodic re-consent — consent that is never re-asked is consent that has quietly become surveillance), purpose (a stated reason, visible in audit, required for spending and communication classes), and device binding (the operator's devices, enrolled explicitly, so a stolen password grants nothing — the security property credential sharing cannot have).

5.5 Audit, drift, and the operator-as-threat model

Every act emits an immutable event in an audit log the primary controls — readable, exportable, shareable with family or an attorney, and structured for the estate (the succession semantics of §5.6). The audit stream feeds drift detection: the operator's session is the system's new crown-jewel surface, so anomaly models — the same machinery banks already run against account takeover — run against the operator, watching for pattern changes that suggest the operator is compromised, coerced, or drifting toward the financial abuse the eldercare literature documents at terrible scale. Detection triggers protective downgrades and alerts to the primary's emergency contacts: the protocol assumes the threat may arrive holding a legitimate grant, which is the assumption no current architecture makes and the abuse statistics require.

5.6 Succession and the ends of grants

Grants end in four ways, each a first-class transition: revocation (one gesture, effective everywhere, with a grace audit the primary can read), expiry (quiet, with renewal prompts), transfer (handover ceremonies between operators — the sibling taking over — with capability review, the P-010 succession pattern at household scale), and death of the primary (the grant lapses into an estate mode: the audit log and projected state survive for the executor under the P-002 entitlement machinery; operation ceases with dignity rather than with a suspension email). The protocol's last act is the one current systems perform worst.

6.Evaluation design

1. Convenience delta against screen-sharing. Timed, task-matched comparison of representative caregiving tasks (refill, statement reconciliation, transfer, insurance form) via the protocol versus the video-call folk method. The protocol must win on time and error rate or lose honestly — convenience is the folk method's only virtue and the incumbent's real moat.
2. Dignity and privacy audit. Structured evaluation of disclosure surfaces per rung: what the operator sees beyond task necessity, measured against the minimal-necessary standard, with primary-side comprehension testing (can the primary state what their caregiver can see? — a question no current architecture even allows them to answer correctly).
3. Adversarial drills. Operator-account takeover, coerced break-glass, gradual-boundary-creep abuse (the hard one: the drift detector's specificity against slow, legitimate adaptation), and collusion-free escalation failures. Deliverable: detection latency and false-alarm rate per attack class.
4. Failure-mode mapping of the status quo. The counterfactual baseline: instrument the existing workarounds' risks (shared-credential session anomalies, stale vault grants, screen-share exposure) to price the incumbent fairly rather than strawmanning it.
5. Longitudinal field pilot. One platform, one cohort of caregiver dyads, six months: rung-mobility rates, audit-log reading behavior, revocation frequency, and — the protocol's ultimate metric — the rate at which shared passwords die in the pilot population.

7.What this is not

This is not parental-control software pointed at old people — the authority direction, privacy defaults, and dignity model are inverted, and the difference is the paper. This is not enterprise RBAC for households — the protocol's primitives are consumer-legible (acts in product vocabulary, not role hierarchies) because the operator is a frightened adult child at 11 p.m., not an IAM administrator. This is not a surveillance product — the primary's audit control and the disclosure dial exist precisely to prevent the protocol from becoming the wiretap the abuse literature would otherwise predict; rung 1 is not a tracking mode. This is not a legal-tech proposal — powers of attorney, personal representatives, and mandates are the legal layer the protocol operationalizes, not replaces; and this is not an OAuth extension — it is the human-delegation layer OAuth's vocabulary has masqueraded as for a decade.

8.Objections, confronted

"The operator's device is now the crown jewels." Yes — and this is an upgrade over the status quo, where the crown jewels are a notepad password that grants everything with zero audit. Device binding, act bounds, drift detection, and break-glass alarms reduce a total-compromise surface to a bounded, monitored, revocable one. The objection prices the protocol against a nonexistent perfectly-safe alternative; the real incumbent is credential sharing, and the comparison is not close.

"Operators ARE the abusers in much elder financial harm." True, and the protocol is the instrument that addresses it: act bounds cap the blast radius, audit logs create the evidentiary record that today's notepad-based abuse lacks entirely, and drift detection is aimed at exactly the gradual-boundary-creep pattern the victimization literature describes. The status quo handles operator abuse by discovering it after the estate is empty; the protocol handles it by making the abuse visible while it is happening. No architecture eliminates predation; this one prices it, bounds it, and records it.

"Monetization: two principals, one seat." The pricing is a product decision the protocol deliberately does not fix; the honest note is that the per-seat objection was also raised against family plans, shared subscriptions, and delegation in enterprise — all of which eventually priced the second principal rather than criminalizing it. Caregiver features are retention features for the primary's household; the seat-expansion question is smaller than the churn question it replaces.

"ToS enforcement says credential sharing is solved by crack-downs." The streaming crackdowns enforced licensing boundaries with session hygiene (device counts, household verification) — and conspicuously did not build delegation, because the music was never about who operates, only about who consumes. The caregiving case has no licensing question at all; it has an operation question, and crackdowns on it produce 84-year-olds locked out of their own accounts with their children on a plane.

"Compliance (KYC/HIPAA) makes this radioactive." The regulatory layer already recognizes the principal relationships — personal representatives under HIPAA, powers of attorney in banking, third-party mandates in UK finance; what regulation does not have is a compliant runtime. The audit log is the compliance artifact the regulators keep asking for in prose. This objection, examined, is actually a distribution channel.

"The primary can't consent meaningfully in dementia's later stages." The ladder is the answer's structure: grants made earlier persist with periodic re-consent while capacity exists; capacity's absence moves the protocol into its estate/succession modes with multi-party checks (the emergency-contact lattice of §5.5) rather than silent operator absolutism. The hard boundary cases — contested capacity, family conflict — are legal processes the protocol can serve with evidence but cannot adjudicate, and the paper says so rather than pretending a state machine dissolves family court.

9.Limitations

The act vocabulary is product-specific, so the protocol is a framework whose quality varies with each implementing product's taxonomy — a standard, not an app, and standards move slowly. Drift detection inherits anomaly detection's false-positive burden; false abuse alarms at a frail household's scale are their own harm, and the calibration of rung-down recommendations versus alerts is unsolved before the field trials. The succession semantics interact with estate law that varies across jurisdictions and moves slower than software. The protocol deliberately does not solve assistant delegation (AI agents acting for principals — the P-006 family's territory) though its act/bound/audit vocabulary is designed to extend there, and that extension's threat model is harder than this paper's. And the convenience bar is empirical, not rhetorical: if the field trials show screen-sharing stays faster for the 11 p.m. use case, the protocol's correct deployment is the audit-and-bounds layer underneath the folk method, which is a smaller claim and a still-useful one.

10.Conclusion

Unix gave us one user per account because the terminal gave us one body per terminal, and software has spent fifty years inheriting an assumption its own demographic curve has quietly repealed. The bodies that operate software are, in the last third of life and in half of all families, not the bodies the software is for — and the industry's answer to this, its most permanent human reality, has been notepad passwords, video-call mouse puppetry, and a fraud model that files the arrangement under attack. This paper specified the other answer: an operator principal with their own trust, bounded acts instead of handed credentials, a graduated ladder that moves authority in the direction of dignity, an audit the primary owns, drift detection aimed at the crown-jewel the protocol itself creates, and succession semantics that end the grant like an estate rather than an incident. Every piece exists in some adjacent world. The composition — the identity model's last missing type, the household's first real protocol — is the gap. The population is aging into it at one person every few seconds. The schema is ready when the platforms are.

11.References

1. AARP / National Alliance for Caregiving (2020). Caregiving in the U.S. 2020 — 53 million unpaid family caregivers. [Survey record; high confidence.]
2. AARP (2023). The Scope of Elder Financial Exploitation: What It Costs Victims — elder financial abuse at $28.3B annually in the U.S. [Report record; verified 2026-10: AARP’s own publication; the $28.3B figure is exact. Report title corrected from an earlier draft’s citation.]
3. HIPAA Privacy Rule, 45 CFR §164.502(g) — personal representatives. [Regulatory record; high confidence.]
4. UK third-party mandates — banking industry guidance on third-party access for carers. [Industry-guidance record; PARTIAL confidence on the current scheme names; verification queued.]
5. Consumer webmail delegated access (Gmail delegation and peers) — feature-level operator access since the 2000s. [Platform record; high confidence.]
6. Google Family Link and family-sharing products — parental-control consent choreography and approval workflows. [Platform record; high confidence.]
7. Password-manager shared vaults (1Password, Bitwarden, and peers) — credential-level family sharing. [Platform record; high confidence.]
8. Streaming password-sharing enforcement wave (2023) — Netflix and peers' household-verification crackdowns. [Industry record; high confidence.]
9. OAuth 2.0 / OAuth delegation vocabulary — application-authorization framework; the "delegated authorization" naming. [Standard record; high confidence.]
10. Enterprise RBAC, delegated administration, just-in-time and break-glass access patterns. [Identity-practice record; high confidence.]
11. HCI proxy-use literature: caregiver infrastructure studies, proxy use of personal health records, domestic financial-management studies. [Research line; high confidence on the line's existence; specific paper list verification queued.]
12. Anomaly-detection / account-takeover fraud machinery in consumer finance. [Practice record; high confidence.]
13. Power of attorney and estate-law operational reality at financial institutions. [Practice/legal record; high confidence on the pattern.]
14. p-rick P-002 (entitlements as machine-readable objects, estate mode), P-008 (device succession), P-010 (succession as governed state machine), P-011 (behavioral conservation) — the program's continuity family; this paper adds principalhood succession. [Program cross-references.]
15. p-rick P-006, The Attention Scheduler — interruption economics for the primary's device; the operator's alerts and the primary's quiet hours compose across the two papers. [Program cross-reference.]

Working-paper note: references marked "verification queued" are recorded from domain knowledge at high confidence and await the program's live citation-verification pass (see agents.md); the verification ledger is maintained with the paper sources.