15.2.1. Different perspectives on non-user roles
When a given non-user role R falls into the perspective of some user roles but not that of others, a change to that role should be distributed to just the first group of users. This is the base case of differential synchronisation. We have the PDR send changes just to those users with a perspective on the changed object.
15.2.1.1. An aside: trusting transactions
A PDR receives transactions from peers. These transactions reach it through a messaging service (in essence, each user has a message box on some server that others may send transactions to). Anticipating on malicious agents, we ask ourselves the (rhetorical) question: should we trust each incoming transaction? The answer is no, as it is quite possible that the address of an inbox will be stolen. Consequently, a denial of service attack could be mounted on that PDR. We can mitigate the gravity of such an attack by abiding by the simple rule that we accept transactions from peers only.
This may seem to implicate that perspectives on peers should always symmetrical (run both ways). This is not so. A peer is not the same as another user role in the same context. Peers are instances of the User role in the PerspectivesSystem context. Consequently, perspectives need not be symmetric for PDR’s to accept transactions coming from the peers behind them.