Operational locality in global theories

Within a global physical theory, a notion of locality allows us to find and justify information-processing primitives, like non-signalling between distant agents. Here, we propose exploring the opposite direction: to take agents as the basic building blocks through which we test a physical theory, and recover operational notions of locality from signalling conditions. First, we introduce an operational model for the effective state spaces of individual agents, as well as the range of their actions. We then formulate natural secrecy conditions between agents and identify the aspects of locality relevant for signalling. We discuss the possibility of taking commutation of transformations as a primitive of physical theories, as well as applications to quantum theory and generalized probability frameworks. This ‘it from bit’ approach establishes an operational connection between local actions and local observations, and gives a global interpretation to concepts like discarding a subsystem or composing local functions. This article is part of a discussion meeting issue ‘Foundations of quantum mechanics and their impact on contemporary society’.

LdR, 0000-0002-2445-2701 Within a global physical theory, a notion of locality allows us to find and justify information-processing primitives, like non-signalling between distant agents. Here, we propose exploring the opposite direction: to take agents as the basic building blocks through which we test a physical theory, and recover operational notions of locality from signalling conditions. First, we introduce an operational model for the effective state spaces of individual agents, as well as the range of their actions. We then formulate natural secrecy conditions between agents and identify the aspects of locality relevant for signalling. We discuss the possibility of taking commutation of transformations as a primitive of physical theories, as well as applications to quantum theory and generalized probability frameworks. This 'it from bit' approach establishes an operational connection between local actions and local observations, and gives a global interpretation to concepts like discarding a subsystem or composing local functions.
This article is part of a discussion meeting issue 'Foundations of quantum mechanics and their impact on contemporary society'.

Introduction
In modelling local agents acting within a global theory, the intuitive assumption is that both their actions and their knowledge are restricted to a bounded region. The canonical example is a scientist who has full control of her laboratory and can perform local tomography. In reality though, the breadth of knowledge and the range of action of agents may be decoupled. For example, prisoners can acquire global knowledge by reading the news, but their actions are limited to small subsystems.  Reverse direction: starting from the notion of agents that may or may not be able to communicate and minimal assumptions on the nature and range of signalling, it may be possible to deduce both the space-time structure of the theory and the position of agents in it, to a good approximation. We can take inspiration from a simple example in the field of localization in wireless sensor networks (for a review, see, for example, [4]). Forest fire prevention mechanisms can be implemented by dropping a large number of smoke-detecting sensors from a plane over the forest. The sensors (our agents) are equipped with short-range communication systems, and land at random positions. One then collects the data of which sensors can signal to each other. From the signalling graph, it is possible to reconstruct the relative positions of the sensors on the ground to high accuracy-that way, when the smoke alarm goes off in a sensor, the fire-response team can quickly locate it. (Online version in colour.) Conversely, someone locked in a control room may only have local knowledge of the shapes of different buttons, but pressing one may have global consequences. The observation that the knowledge and action do not always go hand in hand implies that in order to model agents we have to specify both ( §2). This naturally leads us to search for minimal operational constraints needed to ensure that agents are truly local.
Here, we motivate a notion of secrecy between agents, which captures whether actions performed by an agent (like writing a message, choosing a bit or preparing a quantum state) can be perceived by another ( §3); traditional notions of non-signalling correspond to an extended secrecy between space-like separated regions ( §5). This work brings together and clarifies concepts of locality used in quantum theory, generalized probabilistic theories and field theories. It highlights that the state space and transformations of a theory are but a subjective choice of representation of the underlying physical theory from a viewpoint that is convenient to a given agent, as argued by Spekkens [1]. Here, we tentatively suggest commutation of transformations as a primitive of physical theories. In particular, we show how to derive local agents (and effective descriptions of local subsystems) from commutation relations on global transformations ( §4). This work draws from our 'resource theories of knowledge' [2], and has natural applications in multi-player settings, such as cryptographic scenarios, games or resource theories. There is yet a more exciting possible application: to recover the space-time structure of a physical theory from the primitive notion of test agents, in the spirit of Hardy's operational general relativity [3] and of the task of localization in wireless sensor networks [4]. The idea is to send out agents (or probes) to unknown positions, see if they can communicate with each other, and use the signalling graph to define distances between agents, reconstruct their relative positions and infer properties of spacetime ( figure 1). For this, we must first find appropriate, theory-independent notions of agents and signalling.

Modelling agents
We start with a top-down approach, where we first describe a global theory (as seen by a global agent), and then model restricted agents acting within that theory.

(a) Global theory
From the point of view of a given global agent, a global theory may be represented via a state space Ω and a set of transformations T that are available to the agent [5][6][7][8]. We can think of the state space as the 'language' chosen by this global observer to describe nature. For example, Ω could be the set of coordinates and momenta of all celestial bodies; in quantum theory, it could be the set of valid density matrices over a global Hilbert space. It need not be a static picture: in astronomy, an alternative state space Ω could be the set of possible trajectories of celestial bodies, and in quantum theory it could include all global Hamiltonians that determine the free evolution of density matrices. Three observations are pertinent at this point: firstly, Ω is not the ultimate description of reality, just a convenient representation from the point of view of a global agent; secondly, different pictures, like Ω and Ω , may be related and mapped to one another [1,2]; and thirdly, Ω need not have any special structure a priori besides being a set-indeed, the approach laid out here will allow us to find an operational subsystem structure in the set of states.
The transformations in T represent all actions that the theory allows the global agent to implement. We can think of them as the ways in which the agent may test a theory, by applying actions that change state parameters. For example, an explicit theory of a quantum universe may allow only for unitary operations, while a more generous theory could equip the agent with implicit large ancillas, and allow her to implement general quantum channels, state preparations and even tomography. Again the two views can be related: the latter is an effective theory derived from the unitary quantum theory, by internalizing part of the global space as belonging to the agent and her instruments, and not to the object of study (the rest of the universe) [2]. In the context of field theories, this is discussed as emerging agency [3]. In a superdeterministic theory, there is only one possible course of evolution for the universe, and T consists only of functions that apply it (for example, T ∼ = {e −iHt } t where the global agent is given some choice of time). Formally, T is a monoid of functions f : Ω → Ω: it contains the identity transformation and is closed under concatenation (an associative binary operation), such that performing two actions subsequently, f • g, is still an allowed operation. We discuss the monoidal assumption and possible relaxations in §5.

(b) Local agents
Local agents are characterized by limited knowledge: their inability to distinguish global states that appear identical in their eyes. We can formalize this by building equivalence classes of states that are indistinguishable from the perspective of an agent. For example, in quantum theory, we could have an agent Bob who only has access to a Hilbert space H B ; two global states are indistinguishable (or equivalent) from Bob's perspective if they have the same marginal in H B . This defines an equivalence relation σ ∼ B ρ : TrBσ = TrBρ, where TrB denotes a partial trace over all systems except B. The corresponding equivalence classes are Taking the quotient over, this equivalence relation gives us a new space state Ω/∼ B , which is in one-to-one correspondence with the set of all reduced density matrices in H B . This is Bob's effective state space, sufficient to encode all the information that he can observe about any global state (figure 2). In this case, the map from the global to the local spaces (the canonical map) is given by the partial trace More generally, we can always build the effective state space of an agent in this way, even if we do not know anything about the structure of the global space (for instance whether it can be split into a convenient tensor form H A ⊗ H B ). The construction of an agent's effective state space Ω B := Ω/∼ B is in the spirit of the Leibniz principle of identity of indiscernibles [9]. Yet, this operational procedure emphasizes that both discernibility and identity are subjective concepts (figure 2). Limitations on Bob's perspective may have nothing to do with spatial locality. Bob might only have access to crude measurement instruments unable to distinguish microscopic details of states, or he may not be able to distinguish a global phase or gauge [3]. In generalized probability frameworks, Bob's perspective can correspond to a grouping of individual global outcomes into events (appendix E). In algebraic quantum field theory, these equivalence classes could emerge from algebras of local observables (e.g. [10] for a review). The other ingredient needed to define an agent, as we saw in the Introduction, is a description of the actions available to him. As his actions may have a global impact, a minimal approach is to take them to be a submonoid T B ⊆ T of the globally allowed transformations. We discuss relaxations of this definition in §5. Generalizations of this approach can be found in [2]. There, we also study explicit ways to move between global and local views (technically, related by Galois insertions), effective theories and other properties of local agents.
Having defined the effective state space of a restricted agent, we can also see how such an agent perceives the outcome of her local actions. Namely, the effect of an action f B ∈ T B applied to a global state ρ is seen by agent B as [f B (ρ)] B . This has been explored in more detail in [2], and is not used in this work. In short, such an agent could then define a local theory of accessible states and actions, (Ω B ,T B ), where the transformationsT B act on the reduced state space Ω B as We can always further coarse-grain the effective state space of a given agent B in order to obtain a more restricted agent C. For example, in renormalization group flow, lowering the cut-off corresponds to coarse-graining over more and more observables [11,12]. The following proposition formalizes this idea [2,prop. III.5]. All proofs can be found in appendix A. (i) C has more restricted knowledge than B, that is,

Secrecy between agents (a) Secrecy
Having defined agents, we may study conditions for secrecy and non-signalling between them. Consider a set-up of two agents Alice and Bob, represented by A = (∼ A , T A ) and B = (∼ B , T B ). Imagine that Alice wants to keep her actions (like writing a message or preparing a state) secret from Bob. This is achieved if Bob cannot tell whether she applied them, even after post-processing. 1

Definition 3.1 (Secrecy).
We say that an agent A has access to secret operations If all actions in T A are secret towards B and those in T B are secret towards A, we say that the two agents are mutually secret.
We may ask if this definition is robust enough, that is, whether further pre-or post-processing by Alice and Bob could destroy the secrecy of a choice of action g A ∈ T S A . The next proposition shows that no matter how many 'secret' transformations in T S A Alice implements, or how Bob acts in between to try and recover information, he will not detect any of the effects of Alice's actions. In addition, it is easy to see that pre-processing with a global function (such as distributing entanglement between the two parties) cannot lift secrecy, as definition 3.1 requires it to hold for all initial states.

Proposition 3.2 (Robustness of secrecy). If A has secret operations T S
A with respect to B (according to definition 3.1), then pre-and post-processing cannot lift the secrecy, that is,

(b) Extended secrecy
We may also ask whether Alice's actions stay secret to Bob in the presence of an additional global transformation f ∈ T . Transformations, such as a subsystem swap or a communication channel, may break secrecy; others, like the use of a Popescu-Rohrlich box, do not. 2 For this situation, we define an extended notion of secrecy in the spirit of definition 3.1, which reduces to definition 3.1 in the case f = id. Here, Bob may try to post-process information before and after the global transformation.

Definition 3.3 (Extended secrecy). Let
A be an agent with access to secret operations towards an agent B, We say that the agents are mutually secret in the presence of f if all actions in T A are secret towards B in the presence of f and vice versa.
We can now show that, analogously to proposition A.2, further pre-and post-processing by Alice and Bob cannot lift the secrecy.

Proposition 3.4 (Robustness of extended secrecy). If an agent A only uses secret operations g A ∈ T S
A with respect to agent B in the presence of f ∈ T , then further pre-and post-processing cannot lift the secrecy, that is, and global operations g ∈ T and N ∈ N.
In particular, for the case in which Bob only implements post-processing at the very end, proposition 3.4 implies that T S A forms a monoid.

Corollary 3.5 (Secret monoid). The set T S A of secret operations in the presence of a global function f ∈ T forms a monoid, i.e. id ∈ T S
A and Naturally, if we further restrict the actions and knowledge of one of the agents (as in proposition 2.2), secrecy is maintained.

Commuting agents
Now, we explore how secrecy is affected when the actions of two agents A and B commute. This is particularly relevant in the context of the non-signalling principle, because actions at space-like separation naturally commute. For example, in field theory commutativity holds for measurements or field interactions at space-like separation, and this is in general how causality is recovered there [13]. 3 Motivated by this, we here take the commutation of actions in space-like separated regions as a fundamental building block in deriving agents that are secret relative to each other. Note that, in particular, finding commuting sets of transformations in T is something that can be done prior to definitions of local agents; this is shown explicitly in [2]. 4 Commutation is also an operational property of the theory: for example, commutation is independent of the choice of reference frames in relativity and quantum field theory [13,14]. If two agents commute, secrecy follows from simpler conditions.

(a) Secrecy from commutation
Starting only from commutation relations on the global transformations, we can construct descriptions of local agents that have secret actions with respect to each other. More specifically, given any two commuting submonoids T A , T B ⊆ T , we can construct equivalence relations ∼ A , ∼ B so that two agents Alice (∼ A , T A ) and Bob (∼ B , T B ) have secret actions with respect to each other.
The first step is to start with transformations T A ('Alice's transformations'), and look for the most generous effective state space Ω ¡ A that is insensitive to transformations in T A . This will model the perspective of an agent, Bob, who cannot detect Alice's actions. 5

Definition 4.3 (Perspective insensitive to transformations). Let T
We take the transitive closure ∼ ¡ The above construction gives us minimal restrictions for independent agents. The following theorem is adapted from [2].

Theorem 4.4 (Deriving secret agents). Commuting submonoids T A , T B ⊆ T give rise to descriptions of mutually secret agents
. Indeed, all agents whose actions commute with T A and for whom transformations in T A are secret must be described by a coarse-graining of ∼ ¡ A ( figure 3). This and related minor results can be found in appendix D. In appendix F, we generalize theorem 4.4 to extended secrecy in the presence of global functions. There, we also extend the construction of the effective spaces of two agents to the case where the two monoids of transformations do not commute: without commutation, this construction is not as simple. Operations in T C are still secret relative to these two agents. In addition, operations on the first bit are secret towards B and vice versa. These smaller effective state spaces correspond to equivalence relations on the effective state space Ω £ C (as in the nested agents of proposition 2.2). The two-bit space Ω £ C is a common state space of A and B, including states that could be distinguished if the two agents could work together, with

) Perceived commutation from secrecy
We can now ask if the actions T A , T B ⊆ T of two mutually secret agents must always commute. The answer is no, not at a global level: unbeknown to the two agents, their actions could affect other degrees of freedom of the global theory. This can become relevant when the actions of two agents affect a common environment that is not directly accessible to them but could be recovered by a third party. For example, consider again the state space of three bits, where Alice can only see the first bit and Bob the second. Now imagine that Alice has access to all the transformations that change the first bit and, as a side effect, reset the third bit to 0, while Bob has access to all the actions that act on the second bit and, as a side effect, flip the third bit. From a global viewpoint, their actions do not commute. However, for someone who only had access to the combined knowledge of Alice and Bob (the first two bits), their actions would appear to commute. For such an agent, only local time ordering of Alice and Bob's actions matters, as the two processes f A • f B and f B • f A are indistinguishable. This is yet another example of how subsystems and local descriptions represent simplified pictures of the global theory, reducing the degrees of freedom of the theory to an operational minimum for a given agent, who in this case would not need to model global time ordering.

Applications
In the previous sections, we have shown how to derive a notion of locality within a global theory starting from a primitive notion of individual agents, and their observed secrecy and commutation relations.
The operational approach laid out here has the advantage of carrying very few assumptions about the underlying physical theory. For example, it goes to a higher level of abstraction than generalized probability theories by not taking for granted that all agents express their knowledge in terms of reliable (classical) statistics about the outcomes of measurements.
Our notion of effective state spaces captures the concept of beables of a theory: aspects (or classes) of states that can in fact be physically observed and distinguished [3,16]. Our approach highlights that beables are observer-dependent: for example, what appears to be a gauge may turn out to be only a local gauge [3], and the same applies to 'global' phases of quantum states or yet-to-be-discovered microscopic details of some structure. We can never rule out the existence of a more refined underlying theory, but with effective state spaces we can tailor the descriptions used in a theory to the level of detail needed for a particular application. This goes in the direction of the work of Colbeck & Renner [17], who showed that quantum theory is complete for the task of guessing measurement outcomes, and further refinements would be irrelevant.
As presented here, our framework simplifies the modelling of agents for the pedagogical purpose of highlighting the advantages of this general direction. In appendix C, we show how one could relax some of our assumptions to model agents that are limited in time or who can only approximately distinguish states. In the following, we discuss further applications and relation to other work.

(a) Non-signalling
One natural application of our extended notion of secrecy is the traditional non-signalling condition. To see this, imagine that the two agents are cooperating, so that Alice is trying to communicate information to Bob by means of some action g A ∈ T A on her side. Bob can now either directly apply post-processing f B ∈ T B , or he can wait for some time to pass, as represented by a function u t ∈ T that implements global time evolution over time t. If Alice and Bob are mutually secret in the presence of u t , for all t ≤ T, we conclude that they cannot signal to each other in this time window.
In appendix E, we show explicitly how our notion of extended secrecy implies traditional non-signalling in the framework of generalized probabilistic theories [18,19] for the case of two parties performing binary measurements (two inputs, two outputs on each side), where the state space consists of probability distributions over outcomes of possible measurements on physical systems. The generalization to finitely many inputs and outputs is straight forward.

(b) Reconstructing space-time
Building on the example above, if two agents cannot signal in the presence of u t for t ≤ T and in addition can signal in the presence of u t for t > T, this can be used to define a distance between the two agents, via d ∝ T. The proportionality constant can be interpreted as the speed of signal propagation, for example the speed of light.
The challenge to obtaining a meaningful distance is two-fold: firstly, choosing a 'natural' family of transformations {u t } t to represent time evolutions, and secondly, choosing a family of agents that do not conflate different types of coarse-grainings. For example, locality and macroscopicity each give rise to a natural notion of distance, relating to the space between agents and to precision of observation, respectively; the latter could be used to quantify chaos given a family of time evolutions.
More generally, we can try to use signalling between agents to infer properties of space-time of a given theory, as illustrated in figure 1. Some steps in this direction have been given, for example, in [3,20,21]. This would be of particular interest in the context of field theories [10,22,23]. We leave the generalization of the operational approach depicted in figure 1 to reconstruct position as future work.

(c) Relation to modular approaches
Our global approach complements modular, bottom-up constructions [24], like process theories based on symmetric monoidal categories [5][6][7][8]25]. For the purpose of comparison with our work, modular theories can be understood as theories of individual systems (or 'objects') and local actions (processes) on those systems, which allow for parallel and sequential composition of processes on different systems. Typically, they assume the following. (1) Processes with matching (figure 4b). This last assumption implies that processes act locally without disturbing other systems, and that actions on independent systems always commute. This allows us to represent process theories in terms of diagrams that can be easily composed ( figure 4). Our approach is more general in that we do not assume the strong subsystem structure imposed by conditions (2) and (3). As such, our work strengthens Coecke et al.'s [7] argument that non-signalling can be derived from a simpler condition (appendix B). In general, our topdown view can be taken as a precursor and sanity check for process theories. In complex global theories, a strong subsystem structure may not be clear-cut from the start. The cautious researcher can first use our approach to test different reduced descriptions for independence conditions. If she succeeds in finding independent effective spaces-which is not always possible-she may then frame them as subsystems and attempt a modular construction.
At a conceptual level, our approach gives a global interpretation to aspects of process theories that are more epistemic than physical. For example, if we think of subsystems as building blocks of a global space, it appears natural to see 'discarding a subsystem' as a physical action, like throwing away a piece of Lego ( figure 4c). However, if we start from the global space and see subsystems as arbitrary restricted descriptions, then 'discarding a subsystem' corresponds to a coarse-graining over the relevant degrees of freedom (for example, going from Ω AB to an effective space Ω A ), a change of perspective rather than a physical transformation.

(d) Relation to causal structures
Our notion of secrecy between agents is analogous to causal independence between events in graphs used to study causality in physics. Causal structures [1,[26][27][28][29][30] try to capture the causal relations between events within a larger context (figure 5). Both causality (as expressed by Reichenbach's principle) and secrecy are guiding principles of a certain way of representing a theory (causal structures and restricted agents, respectively) that help us understand a complex situation-they Let us illustrate this. In classical causal graphs, events are represented by random variables, in principle subject to intervention (figure 5a). As we move from purely classical scenarios to more physical situations, like those involving quantum measurements, the formalism of causal structures is evolving to focus on agents and on explicit physical transformation as carriers of causal influence, similarly to our approach. For example, in the quantum causal structures of [31], events can correspond to quantum systems where agents can act locally (figure 5b). Generally speaking, 'events' embody a particular coarse-graining of a global picture into variables or subsystems of interest. As such, a single causal graph cannot reveal all the features of a complex theory-a different decomposition may explore new causal relations. 6 The choice of relevant nodes can be guided by operationalism: (i) we start by picking 'variables' that we care about (like the outcomes of an experiment, or a subsystem corresponding to the perspective and range of intervention of an agent); (ii) we then use Reichenbach's principle and independence conditions to complete the causal graph, by identifying further nodes and constraining the channels between them. 7 This procedure is similar in spirit to how in the present work we could start with the description of a few agents and use secrecy and commutation constraints to identify other subspaces and transformations of interest, or build a notion of locality. How successful we are in this endeavour depends largely on the (subjective) starting point-a poor initial choice of events or agents could make it impossible to find a meaningful causal graph or independent agents.
Even with a clever choice of initial variables, it could be that the guiding principle is not powerful enough to provide meaningful representations for all physical situations. This is likely to be the case in both approaches, which are still rooted in classical intuitionsresulting in concepts like agents, Reichenbach's principle and time order. In trying to explain a physical scenario in terms of these classical notions, we risk running into paradoxes such as the inconsistencies between quantum agents in [32]. It remains to explore whether both our approach and causal models can handle this kind of physical challenge, and whether extensions to cover them would still be intuitive enough to help us make sense of the world.
Data accessibility. This article has no additional data. Authors' contributions. The authors contributed equally to this paper. Competing interests. The authors declare that they have no competing interests. Acknowledgements. We thank Bob Coecke and Barry Sanders for discussions on discarding and non-signalling; Lucien Hardy, Ryszard Paweł Kostecki and Renato Renner for discussions on locality; John-Mark Allen and Mirjam Weilenmann for discussions on causality; David Jennings and Markus Müller for bringing up approximate distinguishability; Roger Colbeck for feedback on this manuscript; Miyuko for sanctuary; and Sandu Popescu for the mantra 'one idea, one paper'. This one goes out to Matt and Rob-let us disagree again soon. Proof. For each direction:

Appendix A. Proofs
1 → 2. We build the equivalence relation in Ω B as

Proposition A.3 (Robustness of extended secrecy). If an agent A only uses secret operations g A ∈ T S
A with respect to the agent B in the presence of f ∈ T , then further pre-and post-processing cannot lift the secrecy, that is

Corollary A.4 (Restricted agents and secrecy). Let A, B and C be three agents, such that C is more restricted than B, that is
If T B was secret towards A (in the presence of f ∈ T ), the same is true of T C . If T A was secret towards B (in the presence of f ), it is still secret towards C (idem).
Proof. As T C ⊆ T B , it is secret towards A. This also restricts the post-processing that C can do, and since ρ ∼ B σ ⇒ ρ ∼ C σ , we have that T A is secret towards C.  Figure 6. Terminality and non-signalling in process theories [7]. (a) Terminality: discarding a system A after applying a function f A is the same as discarding the system directly. (b) Non-signalling: in this set-up, a global preparation process f ⊥ distributes two systems to Alice and Bob, who perform local operations f A and f B , respectively, on these systems and additional inputs A and B. Given terminality, if system A is discarded after this, no information about the original input on A can travel to system B.

Proposition A.5 (Secrecy for commuting agents). If A and B commute, then if there exists a subset of actions T S
To show secrecy in the presence of f , we use Lemma A.6. The perspective ∼ ¡

A induced by a submonoid T A ⊆ T is an equivalence relation in Ω.
Proof. By construction ∼ ¡ A is transitive, reflexive and symmetric.

Theorem A.7 (Deriving secret agents). Commuting submonoids T A , T B ⊆ T give rise to descriptions of mutually secret agents
for all ρ ∈ Ω, g A ∈ T A and f B ∈ T B . By proposition ??, we only need to show g A (ρ) ∼ ¡ A ρ, for all ρ ∈ Ω, g A ∈ T A . This holds since id ∈ T A (as T A is a monoid), and so g A (ρ) ∼ ¡ A id(ρ). We proceed analogously to find the effective state space of A.

Appendix B. Relation to terminality
In [7], Coecke argues that a process theory [8,25] is non-signalling if it satisfies a simpler condition dubbed terminality. Terminality states that local processes on a system right before 'discarding' it cannot have any observable effect (figure 6a). Discarding subsystems is a concept that corresponds to tracing out or coarse-graining over local information. For example, in quantum theory, it is implemented by the partial trace: terminality is naturally satisfied for completely positive tracepreserving operations on the discarded systems, but does not hold for non-deterministic effects such as projections onto particular outcomes of measurements [7]. In our language, the condition of terminality corresponds to the independence condition f A (ρ) ∼ B ρ, where f A are local functions on a system A and ∼ B corresponds to the local picture of other systems B outside A. Recall that the assumptions behind process theories like [7] impose some structure on transformations and agents, in particular, commutation between agents' local actions. As we saw in proposition 4.2, this independence condition together with commutation already implies secrecy.
It remains to see if our secrecy condition is equivalent to the non-signalling of [7], depicted in figure 6b. This non-signalling corresponds roughly to secrecy under pre-and post-processing, as implemented by an initial state preparation f ⊥ and a deterministic effect f . In our picture, robustness of secrecy under pre-and post-processing is ensured by proposition A.2. In this case, pre-processing with a function f ⊥ can be included without loss of generality in the initial state. On the other hand, post-processing with f is eliminated by the choice of local perspective ∼ B .
Hence, the result of [7] that terminality implies non-signalling follows from our propositions A.2 and A.5 together. Our premise that actions by different local agents commute is weaker than the assumptions employed by Coecke et al. [7]. In conclusion, our approach strengthens the argument in [7] for the significance of a condition like terminality. At the same time, we take a more general approach to subsystems than the bottom-up model of process theories in [7], thus highlighting the role of commutation in the context of defining local agents and non-signalling.

Appendix C. Relaxing some assumptions
Let us now give some guidelines on how to relax two of the assumptions of our framework, in order to cover more realistic representations of agents.

(a) Approximate distinguishability
Often agents may not have clear-cut distinguishability criteria. For example, an agent may categorize light frequencies into basic colours such as green and blue-there may be some frequencies that the agent could file as both green and blue. In the language of PBR [33], the reduced states 'blue' and 'green' would be epistemic and not ontic (with respect to the underlying state space of frequencies Ω). Agents could also have a notion of approximate distinguishability, for example, of the sort 'I can distinguish these two states with probability 1 − p. ' We propose a simple approach to address these cases. (i) Build a generous effective state space Ω B by assigning different reduced states to every two states in Ω that can be distinguished in principle by the agent. (ii) Build an approximation structures in the effective state space [2]. An approximation structure comprehends all neighbourhoods {B (ρ)} ρ∈Ω B , ∈E parametrized by whatever measure E is operational for the agent. For example, one valid approximation structure for quantum states corresponds to the -balls induced by the trace distance; another could be just the cover {blue, green, . . . } of the possible colours assigned to each frequency. (iii) Build notions of approximate secrecy, where we can demand, for example for all ρ ∈ Ω, g A ∈ T A , f B ∈ T B , instead of the stricter condition of secrecy, where we demand that the two final states are completely indistinguishable from B's perspective. The properties of approximate secrecy are inherited from the approximation structure.

(b) Time-limited agents
In this work, we model local actions as monoids T A and T B . When applying secrecy to find nonsignalling conditions between time-limited agents, the monoidal structure of actions is only a convenient approximation, which allows us to concatenate post-processing actions indefinitely. The intuition behind this approximation is that Alice and Bob's actions can be implemented essentially instantaneously, compared to the relevant time scales. One example would be the action of choosing a bit as an input to a measurement, by pressing a button in Alice's laboratory (see appendix E). With this interpretation, T A and T B can consistently be modelled as monoids, because it is assumed that the concatenation of two instantaneous actions can again be implemented instantaneously. In this model, time evolution is explicitly modelled by global functions u t ∈ T ; this could include the actual effect of pressing the button.
When functions in T A and T B on Alice's and Bob's sides take some finite time t > 0 to implement, we may instead of full monoidal structure only have f A • g A ∈ T if the functions f A and g A together take less than a given time T to implement. In this case, the notion of secrecy or nonsignalling and our results that relate to it can still be recovered for functions and concatenations of functions that do not exceed this time-frame T.

Appendix D. Commuting agents: additional results
In the main text, we have noted that the perspective ∼ ¡ A induced by transformations T A is minimal: any agent (∼ B , T B ) whose actions T B commute with T A and towards whom transformations in T A are secret must, in fact, be described by a coarse-graining of ∼ ¡ A .

the equivalence relation induced by T A . This implies that there exists an equivalence relation
and so, due to transitivity of ∼ B , also Again due to transitivity it directly follows that

This again implies that there exists an equivalence relation
Proof. This follows from the fact that T A is secret towards ∼ ¡ B , together with proposition D.8.
The second statement follows again from proposition A.2.
Finally, the following proposition shows that equivalence classes for any f B ∈ T B and ω, ρ ∈ Ω.
Proof. From the definition of ∼ ¡ A it follows that for all ν, ω ∈ Ω. But then, because T A and T B commute, for all of ω, τ 1 , . . . , τ n , ρ it holds that , it then also follows that

Appendix E. Application to generalized probability theories
Generalized probability theories (GPTs [18,19,[34][35][36]) are a framework to infer as much as possible about a physical system without making assumptions about its inner workings (like the assumption that states can be represented as vectors in a Hilbert space). Instead, it is assumed that agents can implement and label a number of physical procedures, like preparations, transformations and, crucially, measurements. Note that the agents need not know the actual physical state prepared; in order to label a procedure, they only need to be confident that they can repeat it. Indeed, the basic assumption behind GPT frameworks is that agents can extract significant measurement statistics (for example, by repeating a procedure many times). Hence, GPTs model outputs of measurements as random variables, and agents' knowledge of procedures as probability distributions. The usual approach to build GPTs is bottom-up, starting with local procedures that can be composed to reach a global theory. Here, we are interested in the opposite direction: given a global GPT, can we find meaningful notions of local variables? Firstly, we need to model global and local knowledge.
(a) Basic formalism While we are inspired by known GPT models [18,19,[34][35][36], we take a slightly different and simplified approach here. The idea is that agents only have direct access to classical random variables (like input settings and outputs of a physical measurement). As they correspond to accessible information, we denote probability distributions over these random variables by states.
Transformations f are naturally modelled by conditional probability distributions P f Z|X that take input to output states, such that f (P X ) = P Z , with For example, suppose that we want to model an experiment where an agent performs a quantum measurement by pressing two buttons: button X prepares a quantum state ρ x and button Y measures it according to the POVM {E y z } z with possible outcomes {z} z∈Z . The distributions P XY over inputs and P Z over outputs correspond to accessible 'states.' We model the transformation as a conditional distribution P f Z|XY with P f Z|XY (z|x, y) = Tr(E y z ρ x ). The final distribution P Z of outcomes given an input distribution P XY is therefore Note that it is the conditional distribution that encodes the 'physical' information about a particular setting (like the quantum state and POVM), which may be inaccessible to the agents.
To compare with the models of [18,19], our transformations are analogous to their states. However, in our agent-driven approach, we restrict the set of allowed measurements to those accessible to a particular agent in the resource theory-in this case, they can thus be seen as a subset of the fiducial measurements that define a state in [18,19].
In our model, global states correspond to distributions over a global random variable X. Restricted agents are those unable to distinguish some of the outcomes of the global variable. We can model this via arbitrary groupings of outcomes x ∈ X into equivalence classes, i.e. events {B b } b . The reduction function h B to the effective state space of an agent B simply sums over all the probabilities of the individual outcomes x ∈ B b in each event B b and returns the probability associated with the event,

(b) Secrecy and non-signalling
Consider now two agents A and B whose actions commute. To guarantee secrecy of A towards B, we only need to satisfy the independence condition g A (P X ) ∼ B P X (for all global P X and all g A ∈ T A , see proposition 4.2). In our language, this condition reads For simplicity, we took Y and X to be identical random variables that represent the global state before and after the transformation, and h B is a particular coarse-graining of outcomes into events. The condition then states that h B is insensitive to the transformation (conditional probability distribution) P g A Y | X from inputs x ∈ X to outcomes y ∈ Y. If A and B commute and are mutually secret, we can ask if an additional global transformation f ∈ T allows for signalling between them (definition 3.3). Our condition for extended secrecy in the presence of f ,  Figure 7. Extended secrecy in GPTs. Consider two agents Alice and Bob and a two-bit random variable AB (the four possible outcomes are represented by vertical lines). Our global state space consists of distributions over two bits (whose names we change after each step to make a proof more readable). Let the reduction to the state space of Bob be a coarse-graining over the first bit, P Y (y) = P XY (0, y) + P XY (1, y), as shown on top. Secrecy in the presence of a function f (equation (E 1)) corresponds to P Y = P Y in the diagram. This is satisfied, for example, if f represents the use of a PR-box, while g A and f B correspond to choices of inputs and post-processing: Bob cannot guess Alice's choice of input after the use of a PR-box. This is equivalent to the traditional notion of non-signalling [17] applied to the PR-box. (Online version in colour.) Here, again for simplicity X, Y, Z, V were chosen as identical random variables, and P f Z|X = P f Z | Y both represent the conditional probability distribution corresponding to f . For a simple example in a two-bit space ( figure 7).
We can compare our definition of secrecy in the presence of f to traditional notions of nonsignalling. Consider again the simple case of a two-bit input and output space of figure 7. The definition of non-signalling found, for example, in [17] reads P Y|AB = P Y|B , or This condition formalizes the idea that Bob cannot learn anything about Alice's input a by looking solely at his output y and input b. In our framework, Alice's choice of input is encoded in a local transformation g A ∈ T A (for example, g 0 A could correspond to pressing a button to choose input 0 and g 1 A to choose 1), and therefore 'Bob's ignorance about Alice's input' translates to 'Bob's ignorance about Alice's action g A .' In the following, we establish a direct equivalence between these two notions of non-signalling in this simple case; we expect this equivalence to hold in more general settings. Let us first flesh out the assumptions behind the equivalence. A gentle warning: we have labelled all the intermediate bits differently 'to avoid confusion' (figure 7). As we assume a priori that Alice and Bob have mutual secrecy (without f ), we take that g A only acts locally on Alice's bit, AB (a, b).
Similarly, Bob's post-processing is encoded in f B ∈ T B which we also assume to be truly local, that is  To show that equation (E 3) implies the above, we choose the particular local actions This shows that, for example, PR boxes satisfy our definition of non-signalling functions. Examples for functions that are signalling are conditional probability distributions that swap the states on the two systems, or bitwise addition of the inputs a and b on the two sides into the outputs x and y.

Appendix F. Deriving secrecy without commutation
In principle, the way we have constructed an induced perspective ∼ ¡ A from a monoid T A can be extended to construct equivalence relations that yield secret agents (∼ A , T A ) and (∼ B , T B ) in the presence of a global function f , and even in the case where functions T A and T B do not commute. This is done in the following proposition, which, as is shown in the subsequent corollary, reduces to the definition of induced perspectives ∼ ¡ for all V ∈ S Ω , g A ∈ T S A , f B ∈ T B , is built as follows: Define the relation ∼ on Ω as Then define another relation ∼ as Finally, the relation ∼ B on Ω is the transitive closure of ∼ , namely through ρ ∼ B σ ⇐⇒ ∃n ∈ N, τ 1 , . . . , τ n ∈ Ω s.t. ρ ∼ τ 1 , τ 1 ∼ τ 2 , . . . , τ n ∼ σ .
Proof. Both the relation ∼ and ∼ are by construction reflexive and symmetric. The relation ∼ B is then by construction also transitive, and thus constitutes an equivalence relation. The relation ∼ B furthermore gives rise to the smallest perspective towards which T B is secret in the presence of f : ω = g A (ρ) ⇒ ρ ∼ B ω. By construction then also f B Corollary F.13. In the case of commuting T S A , T B ⊆ T , the equivalence relation ∼ B constructed in proposition F.12 that gives rise to secrecy in the presence of f simplifies accordingly and can be constructed as follows.
If in addition f = I, the relation ∼ B simplifies to

Proof.
In the case when functions in T S A and T B commute, we can see that for all f B ∈ T B . This implies the respective simplifications of the relation ∼ B , and recovers the induced perspective ∼ ¡ A of T S A in the case of f = id.