Trace the authority to upgrade an ICP canister
A controller may itself be a canister. Following that relationship can reveal additional principals able to influence an application upgrade.
Walk the controller graph
Read the controller list for application A on its actual network. If its only controller is canister G, inspect G's controllers and the code governing its upgrade decisions. In the example a team principal can change G, so statements about governance should account for that administrative path.
application A → controller G
G → controllers [team principal, governance canister]
Separate platform and application permissions
Record the observed module hashes and time with the graph. An application method might change a fee schedule even when nobody can upgrade its module. Conversely, an empty controller list removes a route for upgrades while leaving every callable application method operational.