1
DISCO: Distributed Spectrum Compliance and Orchestration for Scalable IoT Coexistence
arXiv:2607.21387v1 [cs.NI] 23 Jul 2026
Lyes Saad Saoud and Moussa Ayyash
Abstract—Massive Internet of Things (IoT) deployments increasingly share spectrum with incumbent, licensed, and unlicensed systems under uncertain traffic, fading, mobility, and intermittent coordination. Existing mechanisms, including fixed power limits, listen-before-talk procedures, spectrum access databases, and learning-based resource allocation, address important aspects of coexistence, but they do not provide a common control plane to translate a network-wide interference risk budget into lightweight guidance for many autonomous devices. This article introduces Distributed Spectrum Compliance and Orchestration (DISCO), a hierarchical architecture that separates local spectrum learning from edge-level compliance regulation and slower cloud or non-terrestrial-network context adaptation. DISCO is not presented as a new reinforcementlearning optimizer or as a replacement for statutory spectrum rules. Its contribution is a deployable compliance plane that monitors violation statistics, broadcasts a compact governance signal, and adjusts policy aggressiveness without centralizing every transmission decision. A 30-seed UAV coexistence case study illustrates the efficiency–risk trade-off: the reported mean throughput is 81.0 Mbps, 73% above fixed-power control, while the mean violation rate is 0.053 compared with 0.126 for uncoordinated learning. Because the 95% confidence interval, [0.030, 0.076], crosses the nominal target of 0.06, the evidence supports statistical regulation near the target, not guaranteed regulatory compliance. Deployment, complexity, adoption boundaries, and open validation requirements are discussed explicitly. Index Terms—Artificial intelligence, distributed spectrum management, Internet of Things, non-terrestrial networks, probabilistic governance, spectrum coexistence.
I. I NTRODUCTION Shared-spectrum systems already use several forms of governance. In the U.S. Citizens Broadband Radio Service (CBRS), a Spectrum Access System (SAS) authorizes devices and protects higher-priority users through a three-tier framework [1], [2]. In 5G New Radio operation in unlicensed spectrum, channel access procedures such as listen-beforetalk regulate when a transmitter may occupy a shared channel [3]. Open Radio Access Network (O-RAN) architectures add programmable near-real-time and non-real-time control functions, creating practical locations for monitoring and policy applications [4]. These mechanisms are valuable, but they solve different problems: SAS grants and coordinates access, listen-before-talk controls short-term contention, and a RAN Intelligent Controller optimizes network behavior. None of them, by itself, specifies how thousands of autonomous IoT learners should collectively remain near an operator-defined Moussa Ayyash is with the Department of Computing, Information, and Mathematical Sciences and Technologies, Chicago State University, Chicago, IL 60628, USA (e-mail: [email protected]).
interference-risk budget as local conditions and coordination quality change. The scale problem is particularly acute for massive IoT. Large populations transmit asynchronously, observe only local radio conditions, and may use different access technologies. Static power or duty-cycle restrictions are predictable but often conservative. Cognitive-radio and edge-assisted designs improve adaptability [5]–[7], while distributed multi-agent reinforcement learning (MARL) can learn channel and power decisions without full centralization [9]–[11]. However, unconstrained local optimization can shift interference risk from an individual link to the network as a whole. Constrained Markov decision processes and safe reinforcement-learning methods provide mathematical tools for handling expected costs [12], [13], but an optimization method alone does not define where compliance is measured, who owns the target, how multiple learners receive policy pressure, or how the system degrades when a remote coordination link is unreliable. DISCO addresses this architectural gap. The device learner remains local and algorithm-agnostic. An edge compliance controller converts aggregate violation statistics into a compact governance signal. A slower cloud or non-terrestrial-network (NTN) policy layer selects an operating target from preauthorized regimes. This separation creates a clear boundary between optimization and governance: devices optimize performance, the edge regulates collective behavior, and the policy plane defines which risk envelope is admissible. The central claim is deliberately narrower than in the rejected version. DISCO does not guarantee legal compliance from simulation, and the projected dual-style update is not itself novel. The novelty is the distributed compliance plane: (i) a reusable interface between heterogeneous local learners and a network-wide risk budget; (ii) a separation of fast device actions, medium-timescale edge regulation, and slow policy adaptation; and (iii) an operational pathway that can coexist with hard regulatory mechanisms rather than replacing them. This article makes three contributions. First, it positions DISCO against concrete spectrum-control mechanisms and clarifies what is new and what is inherited from prior work. Second, it specifies the device observation/action/reward interface, the safety mask, the edge feedback loop, and the role of the NTN context indicator at a level suitable for system implementation. Third, it reinterprets the existing case study conservatively, adds deployment and complexity analysis, and states the evidence boundary without introducing new or fabricated results.
2
Fig. 1. DISCO separates policy ownership, edge compliance regulation, and local spectrum learning. The edge broadcasts compact governance parameters rather than scheduling every transmission. The cloud/NTN layer operates on a slower timescale and cannot override hard regulatory limits.
II. W HERE DISCO F ITS IN THE S PECTRUM -C ONTROL S TACK DISCO should therefore be viewed as an overlay that complements existing controls. For example, a CBRS device would still require valid SAS authorization, and an NR-U transmitter would still follow the applicable channel-access procedure. DISCO acts inside those hard boundaries, regulating how aggressively autonomous devices exploit their permitted choices. Likewise, an O-RAN deployment could host the edge controller as an xApp or equivalent edge service and host slower target selection in the non-real-time control plane. III. A RCHITECTURE AND O PERATIONAL C ONTRACT A. Device-Level Learning and Safety Filtering Each IoT or UAV device maintains a local spectrum-access policy. The architecture does not require a particular optimizer: a value-based learner, actor–critic method, contextual bandit, or rule-based adaptive policy can use the same interface. In the reported case study, the relevant local decision is a candidate channel/power transmission action. The observation contains locally available context such as sensed channel occupancy, received signal or interference measurements, position/context information, and the most recently received governance parameters. The local objective is high communication utility, represented in the case study by link throughput. The edge governance signal adds a cost to actions associated with interference violations. This is conceptually related to a Lagrangian penalty, but DISCO treats the penalty as a network service rather than embedding one fixed dual variable inside one learner. Consequently, devices can use heterogeneous learning algorithms while responding to the same compliance pressure. Before execution, a safety mask removes candidate actions whose estimated interference risk exceeds a configured
threshold τ . The mask is a preventive screen, not a proof of zero interference. A practical implementation must define a conservative fallback, for example, minimum permitted power, a protected channel, or no transmission, when no candidate survives. Hard technology and regulatory constraints always take precedence over the learned policy and the DISCO signal. B. Edge Compliance Controller The edge layer is the architectural core. Devices and, when available, protected-receiver monitors send compact statistics rather than raw high-rate observations. Over a sliding window, the edge estimates the empirical violation rate v̄. A violation is the positive output of the simulator’s configured interferencethreshold test; the reported violation rate is the empirical fraction of evaluated decisions marked as violations. The edge compares v̄ with the active target ε. If the rate is above target, it increases the nonnegative governance variable λ in proportion to the gap; if the rate is below target, it relaxes λ toward zero. The update is projected at zero so that the signal cannot become a reward for risky behavior. Two implementation parameters determine responsiveness: the observation-window length and the update step size. A longer window reduces noise but delays reaction; a larger step reacts faster but can oscillate. The original simulation record supplied with this manuscript does not contain the numerical values of these two parameters. They are therefore not invented here, and no reproducibility claim is made for them. A release intended to support exact replication must publish these values, the aggregation rule, the threshold test, and the simulator code. The downlink control payload is small: the edge broadcasts λ, the safety threshold τ , the active target identifier, and a validity time. The architecture avoids per-device centralized scheduling. Its monitoring work grows approximately linearly with the number of device reports in each window, while the governance update itself is constant-size. These are structural
3
TABLE I P OSITIONING OF DISCO RELATIVE TO REPRESENTATIVE SPECTRUM - CONTROL MECHANISMS . T HE COMPARISON IS ARCHITECTURAL ; IT DOES NOT IMPLY THAT THE MECHANISMS ARE MUTUALLY EXCLUSIVE .
Mechanism
Primary decision
Typical timescale
Strength
Gap addressed by DISCO
Fixed power/dutycycle rule CBRS SAS
Device operating limit Authorization, channel and power grants Whether/when a node may transmit Policy optimization subject to a cost Programmable monitoring and RAN control Collective policy pressure and admissible risk regime
Configuration time Database/control transactions
Predictable and simple to audit
Slot/channelaccess time
Technology-defined discipline
Training and decision time
Directly couples reward and constraints
Near-real-time and non-realtime Edge window plus slower policy update
Practical control placement and open interfaces
Conservative under changing density and channel conditions Does not continuously shape the joint behavior of heterogeneous local learners Does not expose a network-wide probabilistic risk budget to autonomous policies Usually binds the constraint to one training formulation rather than a reusable governance plane Requires an application-specific compliance contract and aggregation rule Must still be integrated with hard rules, certified measurements, and audited deployment procedures
NR-U sharedchannel access Constrained safe RL O-RAN RIC DISCO
or
Protects priority tiers through an established regulatory framework contention
Separates local learning, compliance monitoring, and policy ownership
complexity observations, not measured runtime or signalingoverhead results. C. Cloud/NTN Context Adaptation The rejected manuscript used the phrase “satellite visibility,” which can mean geometry, elevation angle, coverage probability, or link quality. In this article, the term is replaced by NTN control-link quality/availability. It denotes a coarse context state indicating whether the remote coordination path is nominal or degraded. The present case study does not simulate orbital geometry, satellite handover, propagation delay, or a standard-specific NTN link budget. “NTN shadowing” is therefore a scenario label for degraded observability/coordination, not a claim of a complete satellite-channel model. The cloud/NTN layer operates more slowly than the edge. It selects among pre-authorized targets, here ε = 0.06 in the nominal regime and ε = 0.10 in the degraded regime. In a real deployment, this layer must never relax a statutory interference limit autonomously. A higher numerical target is admissible only when it represents an operator-defined internal metric within an already legal envelope, or when the metric changes because measurement confidence has changed. Policy provenance, authorization, and expiration must be logged. D. What Is New—and What Is Not Projected dual updates, expectation constraints, safety masks, edge computing, and MARL are established ideas [9], [12], [13]. DISCO’s contribution is their system-level organization into a three-timescale compliance service. First, the edge owns a network-wide violation statistic rather than each learner maintaining an isolated constraint. Second, the interface is learner-agnostic: heterogeneous devices receive the same compact governance contract. Third, the policy plane changes the target regime without entering the fast action
loop. Fourth, the architecture explicitly supports audit data, validity time, conservative fallback, and coexistence with hard spectrum rules. These properties distinguish DISCO from simply applying constrained MARL to another resource-allocation problem. IV. C ASE S TUDY AND E VIDENCE B OUNDARY A. Scenario and Compared Configurations The existing case study uses a 1000 × 1000 m2 urban micro-cell, eight primary users, six channels, and secondary UAV agents. Each run contains 200 training episodes with 50 decisions per episode, yielding 10,000 decision steps. Episodes 100–199 apply the degraded NTN-context condition; thus the transition occurs at decision step 5,000. The nominal setting has more primary users than channels, creating contention without the 50% increase used in the stress setting, where the primary-user count rises from eight to twelve. These choices are suitable for an architecture stress illustration but are not claimed to represent one specific commercial deployment. Three configurations are reported. The deterministic baseline uses fixed 10 dBm power and serves as a conservative reference. The no-edge ablation uses the same local learning mechanism without compliance feedback, isolating the effect of the governance plane. DISCO combines local learning, the safety mask, edge feedback, and the two context targets. Stronger algorithmic baselines such as constrained policy optimization, Lagrangian MARL, interference-aware heuristics, or an O-RAN xApp are important future comparisons, but numerical results for them do not exist in the supplied experiment and are not fabricated. Table I provides only a conceptual comparison. The reported throughput is the simulator’s aggregate secondary-network throughput, and the violation statistic is produced by its fixed interference-threshold test. The source
4
TABLE II R EPORTED CASE - STUDY RESULTS . N O NEW NUMERICAL EXPERIMENT HAS BEEN ADDED .
Configuration
Violation rate
Throughput (Mbps)
Enforcement density
Fixed 10 dBm No-edge RL DISCO, nominal DISCO, stress
0.022 0.126 ± 0.064 0.053 0.082
46.8 105.2 81.0 71.4
– – 0.545 0.705
package does not include the simulator implementation, channel equation, mobility trace, absolute interference threshold, or detailed signaling model. Consequently, the numerical results support comparison among the three configurations under one common simulator; they do not establish 3GPP conformance, FCC compliance, absolute field performance, or independent reproducibility. This boundary is a weakness, but stating it is scientifically preferable to inserting a channel model after the experiments were completed. Thirty independent random seeds are reported. The 95% confidence interval around a sample mean is computed using Student’s t distribution: the sample mean plus or minus the 0.975 quantile with 29 degrees of freedom √ multiplied by the sample standard deviation divided by 30. This interval quantifies uncertainty across the simulated seeds; it is not a regulatory confidence guarantee. B. Efficiency–Risk Trade-Off The fixed-power reference records the lowest mean violation rate, 0.022, but also the lowest throughput, 46.8 Mbps. Removing edge governance raises throughput to 105.2 Mbps while increasing the violation rate to 0.126. Under nominal conditions, DISCO records 81.0 Mbps and a violation rate of 0.053. The throughput gain relative to fixed power is therefore approximately 73%, and the violation rate is approximately 2.4 times lower than the no-edge ablation. These comparisons support the intended architectural effect: the edge signal sacrifices part of the unconstrained learner’s throughput to reduce collective interference exposure. The correct interpretation of the confidence interval is important. For the nominal DISCO violation rate, the mean is 0.053 and the reported 95% interval is [0.030, 0.076]. Because the upper bound exceeds the target of 0.06, the experiment does not demonstrate target satisfaction at 95% confidence and must not be described as guaranteed or certified compliance. It indicates regulation around the target across 30 seeds. Establishing a stronger claim would require more runs, a pre-specified statistical test, tail-risk analysis, and a complete measurement definition. Figure 2 shows that the governance signal can relax when the observed statistic is below the active target and rise when pressure increases. The figure’s original horizontal label, “Episode,” was corrected to “Decision step” because the simulation contains 200 episodes of 50 steps, not 10,000 episodes. This correction aligns the visualization with the stated experiment.
Fig. 2. Governance signal and active target across 10,000 decision steps. The target changes at step 5,000, corresponding to the start of the degraded-context episodes. The trajectory illustrates feedback adaptation; it is not evidence of instantaneous constraint satisfaction.
C. Stress and Sensitivity Results Increasing the primary-user count from eight to twelve raises the reported violation rate from 0.053 to 0.082 and the enforcement density from 0.545 to 0.705, while throughput decreases from 81.0 to 71.4 Mbps. The result is consistent with a controller that applies more pressure under denser coexistence. However, no confidence interval is supplied for the stress mean, so the value should not be used to claim statistically verified satisfaction of the relaxed target. The available target sweep uses ε ∈ {0.04, 0.06, 0.08}. Enforcement density decreases monotonically from 0.885 to 0.664 and 0.599 as the target is relaxed. This is evidence that the governance mechanism responds in the expected direction. The reported correlation between target and realized violation rate is only r = 0.12 for the three tested settings; with only three target points, this value is descriptive and should not be treated as a calibration result. Sensitivity to window length, update step size, device density beyond the one stress point, and severity/duration of the degraded NTN context remains untested in the supplied data. The supplied severe-shadowing trace also exposes a key limitation of feedback governance: a violation increase may precede a rise in λ because measurements are aggregated over a finite window. This lag is why DISCO cannot replace hard masks, maximum-power limits, emergency shutdown, or incumbent-protection procedures. It is also why future evaluation should report peak violation duration and uppertail metrics in addition to a mean rate. V. C OMPLEXITY, D EPLOYMENT, AND A DOPTION A. Training and Runtime Complexity
5
Fig. 3. Recommended adoption sequence. DISCO should progress from observation to advisory operation before receiving bounded actuation authority; federation is a later step, not a starting assumption.
DISCO does not require centralized joint training. Each device pays the computational cost of its chosen local policy, which is unchanged between the no-edge ablation and the full architecture except for receiving the governance parameters and applying a risk cost/mask. The edge receives one compact report per participating device per reporting interval; aggregation therefore grows linearly with the number of reports. After aggregation, updating one scalar governance signal and one target state is constant-size work. Broadcasting the same small contract to all devices can use multicast/broadcast where available or unicast replication otherwise. These statements describe scaling order only. The current experiments do not measure processor time, memory, message size, backhaul load, or control-loop latency. A deployability study must provide those measurements and test stale, delayed, duplicated, and missing reports. It should also compare centralized aggregation with hierarchical multi-edge aggregation when a single edge domain becomes too large.
C. Regulatory and Operational Boundaries The phrase “probabilistic compliance” can be misleading if it suggests that a legal interference limit may be violated with some accepted probability. DISCO instead regulates an operator-defined statistical metric inside hard legal and technology-specific limits. A regulator, SAS administrator, or standards-based access mechanism defines the admissible envelope. DISCO helps allocate performance within that envelope and provides an audit trail showing how collective policy pressure changed. This distinction also changes the deployment claim. DISCO is not ready for autonomous real-world adoption based on the current simulation. It is an architecture and an initial case study. Before field use, the violation metric must be tied to calibrated measurements at protected receivers; the target must have a documented legal/operational interpretation; the safety mask and fallback must be tested under communication loss; and the entire control chain must be assessed for cybersecurity, false reports, and policy manipulation.
B. Deployment Mapping A realistic mapping has four roles. First, device software or firmware hosts the local learner and safety mask. Second, an edge gateway, private network controller, or near-real-time O-RAN application hosts interference aggregation and the governance update. Third, a non-real-time controller or operator cloud manages authorized targets, model versions, policy provenance, and audit records. Fourth, existing enforcement systems, such as SAS authorization, channel access rules, certified power limits, and incumbent protection functions, remain outside DISCO and retain priority. Figure 3 proposes a staged rollout. Shadow monitoring is essential because a simulator-defined violation indicator may not transfer directly to field measurements. Advisory operation then tests whether the governance signal is understandable and stable without granting actuation authority. Bounded control is appropriate only after the fallback, validity horizon, maximum actuation, and audit path are certified. Multi-edge federation should follow only after conflict resolution and policy ownership are defined.
VI. O PEN R ESEARCH I SSUES Explainability and auditability: Operators need a trace linking an observed interference event to contributing devices, the active target, the governance signal, and the action filters applied. A scalar λ is compact but not self-explanatory. Attribution and counterfactual diagnostics are needed. Scalability and dependence: Reports from nearby devices are correlated, so treating all samples as independent can make a confidence interval overoptimistic. Multi-edge aggregation must handle overlapping interference domains without double counting or conflicting penalties. Tail risk and reaction time: Mean violation rate is insufficient for incumbent protection. Future work should report maximum excursion, duration above threshold, conditional tail expectation, and recovery time, and should evaluate risksensitive or tightened targets when feedback delay is high. Security and trust: A malicious device could under-report interference, replay stale governance parameters, or manipulate the edge estimate. Signed reports, freshness checks,
6
robust aggregation, and fail-closed behavior are necessary for a trustworthy compliance plane. Baseline and reproducibility gap: The next experimental version should release the channel/mobility model, reward, action discretization, threshold, safety-mask rule, window length, step size, and seeds. It should compare fixed power, an interference-aware heuristic, constrained RL, Lagrangian MARL, and an edge/O-RAN controller under equal information and compute budgets. Hardware-in-the-loop or softwaredefined-radio evaluation is needed before making adoption claims. Policy semantics: A target such as 0.06 is meaningless without a measurement unit, population, aggregation window, protected entity, and consequence. A deployment contract should define all five and forbid remote relaxation beyond an authorized envelope. VII. C ONCLUSION DISCO introduces a distributed compliance plane for IoT spectrum coexistence. Its architectural contribution is not a new RL algorithm or a new dual update; it is the separation of heterogeneous local learning, edge-owned statistical regulation, and slower policy-context adaptation. This separation makes the control responsibility explicit and offers a practical mapping to edge gateways or programmable RAN controllers while preserving the priority of existing spectrum rules. The supplied 30-seed case study shows a meaningful efficiency–risk trade-off: 81.0 Mbps under nominal DISCO operation, approximately 73% above fixed 10 dBm control, and a violation rate approximately 2.4 times lower than uncoordinated learning. The evidence must be interpreted carefully. Because the nominal 95% confidence interval crosses the target, the results demonstrate regulation near a target rather than guaranteed compliance. The missing simulator, channel, threshold, and control-parameter details also prevent independent reproduction and field-level claims. The next step is therefore not stronger wording but stronger evidence: complete simulator disclosure, competitive constrained-learning baselines, tail-risk metrics, measured
overhead, and staged testbed validation. With those additions, DISCO could mature from a promising architecture into an auditable component of self-governing shared-spectrum networks. R EFERENCES [1] Federal Communications Commission, “47 CFR Part 96: Citizens Broadband Radio Service,” Electronic Code of Federal Regulations, 2026. [Online]. Available: https://www.ecfr.gov/current/title-47/ chapter-I/subchapter-D/part-96. Accessed: Jul. 21, 2026. [2] National Institute of Standards and Technology, “Citizens Broadband Radio Service,” 2026. [Online]. Available: https://www.nist.gov/ programs-projects/citizens-broadband-radio-service. Accessed: Jul. 21, 2026. [3] ETSI, LTE; 5G; Physical Layer Procedures for Shared Spectrum Channel Access (3GPP TS 37.213 Release 18), ETSI TS 137 213 V18.6.0, 2025. [4] O-RAN Alliance, “Near-real-time RAN intelligent controller and E2 technical specifications,” 2026. [Online]. Available: https://www.o-ran. org/specifications. Accessed: Jul. 21, 2026. [5] H. A. Bany Salameh, S. Almajali, M. Ayyash, and H. Elgala, “Spectrum assignment in cognitive radio networks for Internet-of-Things delaysensitive applications under jamming attacks,” IEEE Internet Things J., vol. 5, no. 3, pp. 1904–1913, 2018, doi: 10.1109/JIOT.2018.2817339. [6] S. Hamdan, M. Ayyash, and S. Almajali, “Edge-computing architectures for Internet of Things applications: A survey,” Sensors, vol. 20, no. 22, Art. no. 6441, 2020, doi: 10.3390/s20226441. [7] N. Yang, H. Zhang, K. Long, C. Jiang, and Y. Yang, “Spectrum management scheme in fog IoT networks,” IEEE Commun. Mag., vol. 56, no. 10, pp. 101–107, 2018, doi: 10.1109/MCOM.2018.1800030. [8] G. Hattab, P. Popovski, and D. Cabric, “Spectrum sharing for massive access in ultra-narrowband IoT systems,” IEEE J. Sel. Areas Commun., vol. 39, no. 3, pp. 866–880, 2021, doi: 10.1109/JSAC.2020.3018797. [9] L. Liang, H. Ye, and G. Y. Li, “Spectrum sharing in vehicular networks based on multi-agent reinforcement learning,” IEEE J. Sel. Areas Commun., vol. 37, no. 10, pp. 2282–2292, 2019, doi: 10.1109/JSAC.2019.2933962. [10] A. Shamsoshoara, M. Khaledi, F. Afghah, A. Razi, and J. Ashdown, “Distributed cooperative spectrum sharing in UAV networks using multi-agent reinforcement learning,” in Proc. IEEE CCNC, 2019, doi: 10.1109/CCNC.2019.8651796. [11] W. Jiang, W. Yu, W. Wang, and T. Huang, “Multi-agent reinforcement learning for joint cooperative spectrum sensing and channel access in cognitive UAV networks,” Sensors, vol. 22, no. 4, Art. no. 1651, 2022, doi: 10.3390/s22041651. [12] E. Altman, Constrained Markov Decision Processes. Boca Raton, FL, USA: Chapman & Hall/CRC, 1999. [13] J. Achiam, D. Held, A. Tamar, and P. Abbeel, “Constrained policy optimization,” in Proc. 34th Int. Conf. Mach. Learn., vol. 70, pp. 22–31, 2017.