The control group in the next release may wish to add that a control group could be assigned not just to a client session of a connection but to an application (where multiple connection are operating together)

these are some notes from discussion in spec on the issue:

(b) The Application of the one controlling the connection … this will be the case for hierarchical connections; typically for controller to device or for controller to controller if hierarchically (e.g., the line controller to the machines in the line).
For device to device (actually peer to peer) there may also be a controller controlling the connection. In this case Variables and Methods controlled by the Lock in ListToRestrict may be changed by the one being the lock owner (identified by the ApplicationUri), e.g., to dynamically adjust parameters for a processing step.

We will need to support this use case at some point of time. Consider a controller having a connection to a device. The connection manager (e.g., the controller) will apply an initial parameterization to the device when establishing the connection, However, the user application may at some point of time need to adjust some parameters.
In other words: The ConnectionEndpoint maintains the lock as not to timeout, the ApplicationUri acts as a passport to gain write access when using a session based on this applicationUri.

Maybe this is solved in a future release, when we add something to a connectionendpoint identfing the application that owns it (maybe just the application URL of the other controller. Then that controller – owns it via the connectionendpoint, but can also access it via a client server connection. don’t think we need a new parameter – just a definition of what is in the parameter that is passed and some rules around it. As long as we don’t need a parameter then we can push the details to next release.

Another some what related isue

Actually the connection could make changes via the metadata messages (they would be consider part of the connection) – again this can be defer to next session if need be
Also the application can call reassign control if it needs to shift it so it can make updates (but I would rather see it use the built in pub sub mechanism for changes.