A Logical Framework for Individual Permissions on Public Announcements

We propose a formalization of the concept of ‘having the permission to say something to somebody’. For it, we introduce a notion of private announcement and define a permission operator with agency. We prove that this can be seen as a generalisation of the notion of permitted public announcement Balbiani and Seban (2011). We also add a notion of obligation with a new intuition. We illustrate the logic with an example of communication in the french medical system. We axiomatize the logic and give some of its properties. Introduction A medical laboratory (L) gets the results of the blood analysis of a patient called Michel (M). This confirms that Michel does not have AIDS (A). But of course, the results could have been different. To prevent that patients commit suicide when they learn that they are ill, French laboratories are not allowed to inform a patient directly of the results of a blood analysis (by email, by post, or whatever inconvenient form of impersonal or unprofessional communication). They have to inform a doctor (D), who will receive the patient in his office, and then inform the patient. This protocol has to be followed when the patient has AIDS , but also when he does not have AIDS, otherwise having an appointment with the doctor could already be interpreted as confirmation of the disease, and we still get the terrible situation of lonely people in distress, that are a suicide risk. Our aim is to be able to formalize this kind of situation in which agents can communicate with each other, and where there are restrictions, that can be deontic, moral or hierarchical, ∗Universidad de Sevilla, Spain. †IRIT, Université de Toulouse, France. 4 H. van Ditmarsch & P. Seban The logic of public announcements (PAL) proposed by Plaza in Plaza (1989) is an extension of epistemic logic. It permits to express how agents update their knowledge after public announcements of true propositions. We can write in this language 〈ψ〉φ which means that after the truthful public announcement of ψ, φ is true. This logic has been largely studied and extended van Ditmarsch et al. (2007). One of these extensions (Baltag and Moss (2004)) allows us to consider other kind of informative events than public announcements, as private ones (announcement that give information to a subgroup of the entire group of agents, with partial information given publicly). To formalize the concept of ‘having the permission to say something to somebody’ we extend a variant of Plaza’s public announcement logic, which we could call ‘private announcement logic’, with a modal operator Pi for permission, where P G i φ expresses that agent i is allowed to sayφ to the agents of the group G. This can be seen as an adaption of the dynamic logic of permission proposed by van der Meyden in van der Meyden (1996), and later elaborated by Pucella and Weissman (2004). In van der Meyden’s work, ^(α, φ) means “there is a way to execute α which is permitted and after which φ is true”. We treat the particular case where actions are truthful announcements. Thus, for α in van der Meyden’s ^(α, φ) we take an announcementψ! such that^(ψ!, φ) now means “it is permitted to announceψ, after whichφ is true”. This suggests an equivalence with PAG i ψ∧ 〈ψ!〉φ, but our operator behaves slightly differently, because we assume that if you have the permission to say something, you also have the permission to say something weaker, i.e. a something that gives less information. We also introduce an obligation operator Oi ψ, meaning that the agent is obliged to say ψ to the group G. Our work relates to the extension of public announcement logic with protocols by van Benthem et al. (2009). In their approach, one cannot just announce anything that is true, but one can only announce a true formula that is part of the protocol, i.e., that is the first formula in a sequence of formulas (standing for a sequence of successive announcements) that is a member of a set of such sequences called the protocol. In other words, one can only announce permitted formulas. We don’t have this limitation in our framework: as in their one, we consider only truthful announcement, but we can distinguish an announcement that cannot be done (because its content is false) from an announcement that is feasible but forbidden. The permissions we model here are permissions for individual agents Individual Permissions on Public Announcements 5 modelled in a multi-agent system. For example, if we have three agents a, b, c, we want to formalize that a has permission to say p to b, but not to c. We chose to model permission for agents using the standard method that agents only announce what they know: so, saying p, agent a says Kap. This leaves open what c learns from this interaction, and we could imagine many possibilities Baltag et al. (1998). The solution we chose is similar to the semi-public announcements where agents not involved in the communicative interaction at least are aware of the topic of conversation and of the agents involved in it: if a actually announces p to b, c considers it possible that a announces Kap to b, or that he announces ¬Kap to the same b. These notions are presented in details in Section 1.2. We also model such permissions and obligations of individual agents towards other agents in the system, or to groups of other agents. 1 Logic of permitted and obligatory private announcements 1.1 Starting from public announcements The work that we present here is based on a previous work Balbiani and Seban (2011), where we considered exclusively public announcements. Let us present it briefly. The logic POPAL of permitted and obligatory public announcement was an extension of public announcement logic, with two new binary operators P and O. More precisely, the language Lpopal over a countable set of agents AG and a countable set of propositions Θ is defined inductively as follow: phi ::= ⊥|p|¬φ|ψ ∨ φ|Kiφ|[ψ]φ|P(ψ,φ)|O(ψ,φ) where i ∈ AG and p ∈ Θ. We interpret these new operators as “after the (public) announcement of ψ, it is permitted (resp. obligatory) to announce χ”. We add the usual boolean abbreviations (in particular > := ¬⊥) and the following ones: K̂iφ := ¬Ki¬φ, 〈ψ〉φ := ¬[ψ]¬φ. The models of this logic (permission Kripke models) are tuples of the form M = (S,R,V,P) where (S,R,V) is a classical Kripke model and P is a subset of T = {(s,S′,S′′) ∈ S × 2S × 2S | s ∈ S′′ ⊆ S′}. The semantics of knowledge and announcement are the classical ones Plaza (1989), the new operators having the following semantics: M, s |= P(ψ, χ) iff for some (s, [[ψ]]M,S′′) ∈ P, S′′ ⊆ [[〈ψ〉χ]]M M, s |= O(ψ, χ) iff for all (s, [[ψ]]M,S′′) ∈ P, S′′ ⊆ [[〈ψ〉χ]]M. 6 H. van Ditmarsch & P. Seban For all formula χ ∈ Lpopal, we note Pχ := P(>, χ) and Oχ := O(>, χ). The following proposition allows us to consider the simpler equivalent language restricted to these ‘unary’ operators (for which we explain the intuition): Proposition 1.1. The language Lpopal is expressively equivalent to the language with unary operators Pφ and Oφ. Proof. Clearly, Lpopal is at least as expressive as this language. To prove the equivalence, it is sufficient to prove that for all ψ,φ ∈ Lpopal, |= P(ψ,φ) ↔ 〈ψ〉Pφ and |= O(ψ,φ) ↔ 〈ψ〉Oφ. We know already that |= [ψ]P(>, φ) ↔ P(ψ,φ) and |= [ψ]O(>, φ) ↔ O(ψ,φ) (see Balbiani and Seban (2011) for details). It remains to prove that |= P(ψ,φ) → ψ (and analogously for O). But by definition of T, if (s, [[ψ]]M,S′′) ∈ P then s ∈ [[ψ]]M, then we have the wanted result.