Critical infrastructure

The control action fired. The authority for it is a matter of reconstruction.

Grid, water, pipeline, rail and plant operators are automating control decisions faster than they can evidence them.

On this page

The problem Control actions are automated faster than they can be evidenced, and authority becomes a matter of reconstruction.
Who the record has to satisfy A sector regulator, an accreditation authority, an incident investigator, an insurer and a safety case author.
Where it bites first Authority, conformance and attribution, in that order.

The problem

Safety-critical industries already know how to govern a decision. Authority to operate is bounded, procedures are written in advance, and the operator who takes an action outside the envelope is identifiable afterward. The regulatory regimes built on top of that — reliability standards, safety cases, accreditation — all assume a named human being at the point of action.

Automated and AI-assisted control erodes that assumption quietly. A setpoint changes, a breaker opens, a valve closes, a maintenance action is deferred. The system logs that it did so. What the log does not carry is the authority the action was taken under, or any way for a regulator to test that authority without the operator's cooperation.

The consequence is felt at the worst moment. After an incident, the organization is asked to show that automated actions stayed inside the approved envelope, and the showing is an exercise in reconstruction, performed by the operator, from the operator's own records, under pressure, in the window where credibility matters most.

An operator who has to reconstruct authority after an incident is defending a record, not producing one.

Who the record has to satisfy

Each of them arrives after the event and reads what the system left behind.

An incident investigator does not want the operator’s summary. The investigator wants the sequence, timed, from a source the operator did not write.

A sector regulator examining whether automated actions stayed inside the envelope
An accreditation authority deciding whether the system may operate at all
An incident investigator reconstructing a sequence after the fact
An insurer pricing an operational risk that nobody can evidence
A safety case author who must argue the system is adequately controlled

Where it bites first

Three of the six, in this order.

AUTHORITY

Showing that an automated control action was inside the approved operating envelope at the moment it fired.

CONFORMANCE

Producing evidence for a regulator on demand, rather than assembling it by hand after an event.

ATTRIBUTION

Distinguishing a fault from a misconfiguration from an intrusion, while the incident is still live.

All six →

The demonstration

Built around your problem, not around our example.

An agent proposes, the decision is adjudicated against authority, and anyone you authorize can verify it afterward. Tell us which of the six is costing you, and that is the one we will build.

Start a conversation Read the argument

We are not asking you to trust us. We are asking you to let us prove it.

The control action fired. The authority for it is a matter of reconstruction.

Each of them arrives after the event and reads what the system left behind.

Three of the six, in this order.

A Combatant Commander cannot prove an autonomous action stayed within authority. No fielded system can.

The decision was automated. The accountability was not.

On whose authority was that clinical decision taken?

You sign the attestation. What actually stands behind the signature?

Built around your problem, not around our example.