Content-based publish/subscribe (pub/sub) is a promising paradigm for building asynchronous distributed applications. In many application scenarios, these systems are required to provide stringent service guarantees such as reliable delivery, high performance, high availability and dynamic system security.

In this paper, we address the issue of dynamic access control in a content-based system that provides reliable delivery and high availability through redundant routes. We define a deterministic service model of dynamic access controls that enables precise control over event confidentiality. Under this model, the semantics of reliable delivery is clearly defined, that is, the messages delivered in response to the same subscriptions from pub/sub clients running on behalf of the same principal will be exactly the same, regardless of their connecting locations, network latency and failures. We present an algorithm that implements this service model. The algorithm is efficient and highly available in that it enables uniform enforcement of access control and enables content-based routing to choose any path from among several redundant routes without requiring consensus among the brokers.