Assured Agentic Intelligence for Contested Logistics and Critical Infrastructure

Authority, operational safety and verified outcomes in distributed autonomous systems.

Abstract

An autonomous system can produce a plausible plan while lacking the authority, information or physical capacity to execute it. This distinction becomes decisive when logistics networks and critical infrastructure operate under communications loss, adversarial information, changing permissions and irreversible physical consequences. We investigate the conditions under which a learning system may contribute to operational decisions without becoming the authority that certifies its own actions. Our thesis is that useful autonomy requires a verifiable relationship between intent, permission, evidence, resource commitment and observed outcome.

We develop an assurance architecture for a proposed Lutine implementation in which language and learning components generate candidate actions, while a separate enforcement path controls access, checks operational invariants and records execution evidence. The design combines a typed action interface, contextual authority, provenance-aware information handling, bounded delegation during disconnection, risk-constrained planning and independent completion verification. We specify the trust assumptions, derive conditional safety properties, and show why immediate global revocation, unrestricted disconnected availability and globally exclusive resource allocation cannot all be guaranteed together.

The analytical contribution is an explicit composition contract between these mechanisms. We distinguish security authorisation from operational safety, data provenance from factual correctness, and an accepted command from its physical completion. Bounded executable exercises examine resource conservation, permission races, information-flow labels and completion predicates. Their purpose is to expose counterexamples and check the mathematical construction. An accompanying experimental protocol defines how an implementation would be evaluated using independent scenario generation, matched baselines, adversarial disturbances, component ablations and confidence intervals.

The principal conclusion is that the defensible unit of autonomy is a constrained action with a checkable execution record. The architecture supports bounded continuation where local rights and safety conditions can be established, and controlled deferral where they cannot. Its practical value must be assessed jointly through mission completion, unsafe or unauthorised effects, delay, recoverability and the burden placed on human operators.

Contents

1 Research problem and contribution

The assurance problem

Logistics decisions connect information to scarce physical resources. A decision to reserve a replacement pump can alter a maintenance schedule, remove stock from another service, trigger a purchase commitment and change a transport allocation. Infrastructure decisions have similar coupling: a maintenance instruction may affect energy availability, cooling, communications and the ability of other facilities to recover. A decision system therefore cannot be judged solely by the quality of its recommendation. It must also be judged by the authority under which it acts, the dependencies it consumes and the state it leaves behind.

We use contested to describe conditions in which communications, observations, supply availability or decision processes are disrupted or manipulated. The term includes interference, malicious records, infrastructure failure, severe weather and contradictory reporting. The architecture addresses continuity and protection of logistics and essential services. Its decision objects are inventory, maintenance, routing, restoration and information release, rather than targeting or force employment.

We use agentic intelligence to mean software that selects intermediate steps, obtains observations and proposes actions in pursuit of an objective. This definition accommodates symbolic planners, learned policies and language models. It does not require a language model, unrestricted tool use or a claim of general intelligence. A conventional optimisation system can produce an unsafe authorised action, just as a language model can; the assurance problem attaches to the action pathway.

Our central research question is: under what explicit assumptions can an adaptive planner improve operational usefulness while a smaller, independently inspectable mechanism constrains its effects? Four subsidiary questions follow. Which properties can be enforced before an action occurs? Which invariants survive disconnected execution and reconciliation? How should uncertainty and evidence age restrict autonomy? What observations justify declaring an objective complete?

What the study contributes

We propose a composition of authority, information handling, state validation and outcome verification. The contribution lies in defining their interfaces and failure semantics for a coupled logistics and infrastructure setting. It is not a claim to have invented reference monitors, access control, replicated data types or constrained planning. Those foundations are established in the literature and are identified where used.

The first contribution is an action contract that binds a proposed operation to a principal, purpose, resource scope, evidence set, policy epoch, state preconditions and expiry. The second is a distinction between authority that can be exercised locally and authority that requires renewed coordination. The third is a set of conditional propositions about mediation, resource conservation and restricted information release. The fourth is a reproducible analytical supplement and an implementation evaluation protocol that separates goal achievement from policy compliance.

We call the candidate integration Lutine throughout the manuscript. This name identifies the proposed architecture, interfaces and research programme described here. Statements that use “we define” or “we propose” concern this design. Executed results are restricted to the small analytical models in Section 12 and the accompanying computational supplement. End-to-end system performance remains an experimental question.

The decision boundary

The system boundary includes the action gateway, authority service, policy interpreter, resource ledger, evidence store, tool adapters and completion verifier. Physical devices, suppliers, remote identity authorities and communications networks are external dependencies with explicit contracts. The planner operates inside a restricted process but outside the trusted enforcement base.

The boundary must be drawn around every route to an effect. A restriction on a nominal “dispatch” tool is ineffective if the planner can modify an inventory database directly, invoke a general shell, write a queued message consumed by an actuator or change the policy interpreter. Likewise, a hidden retry worker is part of the action pathway. We therefore treat credentials, queues, scheduled jobs, exports and administrative interfaces as enforcement surfaces rather than implementation detail.

2 Research method and technical foundations

Evidence selection and analytical method

We use identifiable primary research, university theses, standards and official technical publications available by that date. Where a work has subsequent revisions, the reference identifies the eligible version. For example, the language-action study by Yao et al. is the first arXiv version dated 6 October 2022, not its subsequent conference version. Publication dates are checked against publisher or repository records, rather than inferred from a web page retrieval date.

The method is an architectural synthesis followed by formal decomposition and bounded counterexample analysis. We first identify the operational property being claimed, then identify the mechanism that might enforce it, and finally state the assumptions that make the inference valid. A claim unsupported by an enforcement mechanism becomes an experimental hypothesis or an unresolved obligation. This procedure prevents a collection of individually useful technologies from being mistaken for a composed assurance argument.

This is a focused technical review rather than a claim of an exhaustive systematic review. The selection prioritises mechanisms with inspectable semantics: reference mediation, information flow, application invariants, constrained sequential decisions and physical safety envelopes. Language-model studies establish the feasibility of producing and grounding candidate actions; they do not establish the safety of consequential autonomy.

Research strands and the gaps between them

Saltzer and Schroeder (1975) motivate complete mediation, least privilege and simple protection mechanisms. Schneider (2000) characterises an important class of policies enforceable by observing and restricting execution. These foundations support a separate enforcement path, but they do not make a policy correct or ensure that sensors describe reality. A monitor can faithfully enforce a mistaken rule.

Information-flow research distinguishes permission to read an object from permission to transmit information derived from it (Goguen and Meseguer, 1982; Sabelfeld and Myers, 2003). This distinction is essential when an agent combines operational reports and then writes a summary. A text summary, embedding, ranking or tool argument can reveal protected information even when it contains no copied source sentence.

Distributed systems research identifies conditions under which local updates can be reconciled while preserving an application invariant (Bailis et al., 2014; Bailis, 2015). Replicated data types establish convergence under defined update and delivery assumptions (Shapiro et al., 2011). Convergence alone does not ensure that a shared inventory was never overcommitted. We therefore analyse the operation and invariant together, rather than designating an entire database “safe offline”.

Planning under partial observability represents uncertainty about operational state (Kaelbling, Littman and Cassandra, 1998). Chance-constrained planning adds explicit limits on modelled violations (Santana, Thiébaux and Williams, 2016). These methods make a risk budget expressible, but the budget is meaningful only if the event, horizon and transition model are specified. A probability printed by a language model is not sufficient evidence for any of them.

Language-grounded action research provides a useful separation between linguistic relevance and executable capability. Ahn et al. (2022) connect high-level instructions with learned robotic skills and their affordances. Yao et al. (2022) investigate interleaved reasoning and action. Nakano et al. (2021) demonstrate a model that obtains supporting information through a browsing interface. None of these contributions establishes permission to act in a particular organisation or verifies a downstream physical effect. Our design places those obligations outside the proposal generator.

Comparison of foundations and proposed obligations

The resulting research gap is compositional. An action can satisfy each component's local interface and still be unacceptable if the components refer to different resource versions, clocks, identities or definitions of success. The remainder of the manuscript makes those shared semantics explicit.

3 System model and assurance claims

State and observations

Let the operational state at step t be st = (xt, qt, pt, et, ct, ht). Here x is physical and workflow state; q is resource ownership and reservation state; p is policy and delegation state; e is available evidence; c is communications and timing state; and h is the accepted action history. The planner receives observations ot through authorised views, not direct access to st. Some observations are delayed, false or absent.

A candidate action a contains a typed operation and parameters. It is accompanied by a contract k containing the requesting principal, delegation chain, purpose, resource identifiers, policy version, object versions, evidence references, validity interval, expected effect and completion predicate. The gateway evaluates the pair (a, k), rather than interpreting a free-text instruction as executable authority.

The trusted enforcement base comprises mechanisms whose failure can invalidate a stated property: identity verification, policy interpretation, capability validation, label propagation, the relevant resource transaction, the dispatch adapter and the observation pathway used for completion. Its scope varies by claim. A confidentiality claim does not depend on the same components as a pump-temperature safety claim. We maintain a separate dependency list for each.

Admission and execution

An action is admissible only if every required predicate holds at its specified consistency point. We write the admission predicate as follows.

Equation 1. A denotes authority, F permitted information flow, I application invariants, R evidence and risk requirements, and C capability and execution preconditions.

Passing this predicate authorises an attempted effect under a contract. It does not prove the effect occurred. The distinction is represented by a lifecycle: proposed, checked, reserved, dispatched, acknowledged, observed and verified. Alternative states include denied, expired, uncertain, cancelled and compensated. Acknowledged means the receiving interface accepted a request. Verified means the completion predicate is supported by adequate observations.

For actions that change a transactional resource, admission and reservation must share a linearisation point or an equivalent proven concurrency contract. For a physical effect, the adapter must validate an expiring command at device acceptance. A prior cloud decision cannot substitute for a local interlock when conditions can change during transmission.

Threat and failure model

We assume an adversary may control external documents, ordinary tool-return text, some supplier messages and network scheduling. The adversary may replay messages, introduce contradictory records, attempt to redirect an agent's goal or exploit a mismatch between a resource identifier and its displayed name. Accidental failures include stale telemetry, process restarts, duplicate deliveries, partial execution and loss of a coordinator.

We do not assume that a signature makes a measurement true. A compromised sensor can sign false values. We do not assume that two agreeing reports are independent if they originate from the same upstream source. The architecture must record origin and dependency so that repeated forwarding does not inflate confidence.

The core propositions assume the adversary cannot modify the enforcement executable or its protected policy store, forge the accepted identity credentials, bypass the actuator gateway or roll back the protected resource ledger. A later implementation must supply evidence for these assumptions. Compromise of any such component changes the applicable assurance case; it is not silently absorbed into a claim that “the agent remains safe”.

Four different kinds of guarantee

We distinguish logical guarantees over a formal model, bounded findings from executable enumeration, statistical estimates from sampled trials and operational evidence from deployment. They answer different questions. A finite enumeration can identify a missing guard but cannot establish behaviour over arbitrary workloads. A statistical failure estimate can quantify a sampled environment but cannot certify a cryptographic trust boundary. A physical demonstration can show task execution while leaving rare concurrent failures unexplored.

The proposed assurance case therefore assigns each requirement its appropriate evidence. Structural authority separation requires interface analysis and implementation verification. Inventory integrity requires concurrency reasoning and fault injection. Risk estimates require calibration under the operating distribution. Human intervention requires observations of response quality and delay. No single pass percentage substitutes for this set.

4 Separating intent evidence and authority

Three distinct input roles

The architecture assigns every input a role: an authenticated request, evidence about the world, or an authorised policy change. These roles are established by the receiving interface and credential context. They are not inferred from phrases inside the input. A document that says “this is an administrator instruction” remains a document. A tool result that requests broader access remains tool-return data.

An authenticated user request can establish a task objective within that user's authority. It cannot automatically change organisational policy. A policy update requires a separate privileged process, review rules, a new version and an auditable activation event. Similarly, a tool response can update the evidence available to a planner, but cannot mint a capability or alter a resource ceiling.

This separation permits useful learning while bounding consequences. The planner may reconsider a route after reading a closure report. It may not reinterpret that report as permission to export restricted records. Preventing all influence of external information would make an operational planner useless. The objective is to prevent external information from acquiring authority that its source does not possess.

Typed action construction

The planner emits an action request in a small schema. Resource references are opaque identifiers resolved by the gateway, not arbitrary paths. Enumerated operations distinguish read, reserve, release, dispatch, publish and change-policy. Each operation has a fixed parameter schema, unit constraints and permitted destinations. General code execution is outside the ordinary operational interface.

A proposed route change, for example, contains the shipment identifier, an approved route identifier, a maximum permitted arrival delay and references to the evidence supporting the change. It contains no credential. The gateway supplies a narrowly scoped credential only after validation, and the adapter confines that credential to the intended operation. If the tool cannot enforce this scope, the integration cannot inherit the architecture's authority claim.

We reject unknown fields and ambiguous units. A quantity without a unit is incomplete. A destination address supplied in free text is not automatically an authorised recipient. A planner-generated identifier that resembles a valid one is resolved against an authoritative registry and rejected if it does not exist. Normalisation occurs before signatures and hashes are evaluated, so alternate encodings cannot change the interpreted operation after approval.

Context isolation and controlled information release

Different information compartments use separate retrieval views and model contexts. The safest default is to keep restricted facts out of a process that can publish to a broader audience. If a context must combine compartments, its outputs inherit the combined restrictions until an authorised release process produces a less restricted artifact.

The release process is specific. A deterministic transformation may remove fields or calculate an approved aggregate, but its authority is limited to that transformation, input class and destination. A model's statement that its own summary is non-sensitive is not a release decision. Traces, exception text, logs, caches, embeddings and prompts are included in the same information-flow analysis.

Birgisson et al. (2014) demonstrate credentials that can be attenuated by contextual caveats. We use that principle to require delegation to narrow scope, duration, destinations and resource quantity. In our construction a child capability cannot confer an operation, resource or release destination absent from its parent. Offline use adds stricter limits because remote changes cannot be assumed visible.

What structural separation cannot guarantee

An adversarial report may persuade the planner to choose an inefficient but permitted action. The gateway can prevent an unauthorised export while still admitting a poor maintenance priority. We therefore evaluate goal integrity and utility separately from authority integrity. A system that merely blocks forbidden effects can remain vulnerable to costly distraction, repeated safe-looking requests or strategic denial of service.

Rate limits, reservation limits and per-task expenditure budgets constrain this form of damage. The gateway records repeated denials and oscillating plans. A task that repeatedly abandons reservations consumes a budget and may be escalated for review. These controls make the residual risk measurable; they do not imply that the planner understands the truth of every source.

5 Ontology permissions and evidence lineage

Facts as contextual records

We represent an operational assertion as a record containing subject, relation, value, source, observation time, ingestion time, validity interval, confidence basis, security label and derivation identifier. Two records may assert different values for the same relation without one overwriting the other. A pump may have an available status in the inventory system while a maintenance report declares it unserviceable. The conflict is itself decision-relevant evidence.

Observation time and ingestion time serve different purposes. A report received recently may describe an old inspection. A late report may improve a historical reconstruction without justifying a current action. We therefore use bitemporal records to preserve what was believed at a decision time and what was later learned about the underlying event.

PROV-O supplies a standard vocabulary for entities, activities and agents involved in derivation (Lebo, Sahoo and McGuinness, 2013). Our proposed extension attaches decision-specific obligations: evidence age, release authority, quality checks and the policy snapshot under which a derived artifact was created. Provenance documents how a conclusion was obtained; it does not certify that the original observation was accurate.

Reading acting and deriving are different permissions

An engineer may read a component's condition without authority to allocate it. A scheduler may reserve an item without authority to disclose its destination. A partner may receive an aggregate capacity figure while being barred from the underlying asset locations. We therefore evaluate permissions on operations over facts and objects, not simply on membership in an ontology class.

Attribute-based control evaluates the principal, object, operation and environmental context against policy (Hu et al., 2014). Relationship-based control adds links such as assignment to a facility or delegated maintenance responsibility. Our admission predicate requires the applicable conditions together. A favourable relationship does not override an explicit restriction, and a missing mandatory attribute produces an indeterminate decision rather than an implicit grant.

Pang et al. (2019) demonstrate why permission decisions must respect the ordering of content and access changes. In our design each protected object version records the minimum authority snapshot needed to interpret access to it. An old permission cache must not be applied to newly restricted content. For critical execution, the adapter must also meet the required policy freshness at dispatch; reading an eligible object is not sufficient authority to act on it.

Restriction inheritance

For an artifact derived jointly from sources D, let R(d) be the readers allowed by source d, and P(d) the purposes permitted by that source. Our default inheritance rule is conservative.

Equation 2. A jointly derived artifact cannot broaden either the eligible audience or the permitted purpose without an authorised release operation.

This rule is sufficient for a restricted class of explicit derivations, not a complete solution to inference control. Alternative derivations require care: a conclusion independently supported by a public source may be releasable on that basis, but the released object must be reconstructed through the public derivation without protected context. Otherwise, source selection itself can expose information. A dependency graph must distinguish joint premises from alternative support paths.

Security labels also apply to the existence of an object, graph edges, search counts and error messages. Revealing that a specific asset is present in a restricted facility can be sensitive even if its attributes are redacted. Query results therefore undergo authorisation before aggregation where required, and externally visible failures avoid distinguishing “exists but forbidden” from “unknown” when that distinction is protected.

Validation under incomplete knowledge

Ontology inference and action validation have different semantics. An open-world representation may leave a fact unknown; an actuator interface often needs a positive, current assertion. We therefore use explicit validation shapes for mandatory action fields and an evidence sufficiency check for operational preconditions. SHACL provides a standard mechanism for validating graph data against stated conditions (Knublauch and Kontokostas, 2017).

A missing inspection result cannot be treated as evidence that no defect exists. Similarly, lack of a prohibition in a retrieved fragment is not proof that an action is authorised. The gateway evaluates a complete, versioned policy bundle for the relevant operation. Unknown, conflicting and stale values remain distinct states and lead to different remedies: obtain evidence, resolve conflict or refresh the observation.

Integrity of derived operational knowledge

We separate the model's interpretation of an observation from the observation itself. An extraction process can propose that a supplier message refers to a particular shipment, but the resulting relation retains the extraction version and supporting span. A low-confidence entity match cannot silently move inventory between legal owners or facilities.

For consequential facts, two-person approval or an independent deterministic check can establish the relation before it enters an executable workflow. Corrections append a new assertion and supersession link rather than rewriting the historical evidence. This design supports reconstruction of both the original decision and the reason a later decision differs.

6 Runtime enforcement and conditional safety

The execution path

The planner submits a candidate to a gateway that has no obligation to trust its explanation. The gateway resolves identifiers, verifies the delegation chain, checks information-flow labels, evaluates state-dependent rules and reserves resources. A specialised adapter then performs the permitted operation. An observation service supplies evidence to a completion verifier. Policy administration is a separate path with separate credentials.

Figure 1. Proposed execution architecture. Evidence can influence candidate selection, but authority originates in the policy and delegation service. Tool effects and completion observations pass through separate interfaces. Device-local protection remains active during communications loss.

Every rule has an identifier, version, event, predicate, required evidence, decision and reason code. Rule evaluation has explicit outcomes: allow, deny, require approval, require evidence or defer until coordination is available. An exception or timeout is not interpreted as allow. Rules that affect a quantity or ownership record are evaluated within the relevant transaction, rather than before an independently executed update.

A constrained policy language

The policy language should be deliberately limited. Predicates operate on typed fields, bounded collections and approved evidence queries. Recursion and unrestricted network access are excluded from the synchronous enforcement path. Rule execution has a time budget; failure to complete produces deferral or denial according to the operation's safety contract. This protects the gateway from both maliciously expensive requests and accidental policy complexity.

A rule for inventory reservation requires an active delegation, a matching facility and resource type, a positive quantity within the holder's remaining allocation, an acceptable evidence age and a compatible policy epoch. A release rule additionally checks the destination and the labels of every material input. A restoration rule requires a local equipment envelope and the availability of a permitted fallback state.

Rule conflicts are resolved conservatively. An explicit denial takes precedence over a grant. An unmet approval requirement cannot be satisfied by a weaker grant. However, “deny overrides” is not enough to define correctness: the policy compiler must also detect unreachable rules, inconsistent units and incompatible scopes. A policy bundle is activated only after its reference scenarios and rejection scenarios pass under the intended interpreter version.

Proposition on mediated state transitions

Proposition 1. Let S be a set of accepted system states and I an invariant over S. Suppose I holds initially; every effectful operation is mediated; the monitor evaluates the actual operation and relevant state at the operation's linearisation point; and every admitted transition preserves I. Then every state reached solely by such admitted transitions satisfies I.

Proof. The initial state satisfies I by assumption. Assume the state after n admitted transitions satisfies I. The next transition is admitted only if its precondition is checked at the specified point and the transition preserves I. The state after n + 1 transitions therefore satisfies I. Induction establishes the result for all finite admitted histories.

The proposition is intentionally conditional. It does not establish that a physical plant remains safe between sampled observations, that an external actor cannot consume the same resource, or that the implementation matches the model. Those require separate obligations. It also gives no liveness guarantee: a monitor that rejects everything preserves many invariants while providing no useful service. This distinction is consistent with the limits of execution-monitor enforcement analysed by Schneider (2000).

Proposition on authority attenuation

Proposition 2. Suppose every executable capability is issued through a protected authority service; child capabilities can only narrow their parent's operation, resource, destination and time scope; and adapters reject operations without a valid capability. Then replacing an evidence input cannot enlarge the set of operations executable under the same root delegation.

Proof. Evidence affects which candidate the planner selects, but capability issuance is determined by the protected delegation and policy state. Every capability accepted by an adapter is a subset of the root scope by repeated attenuation. A changed candidate outside that scope is rejected. Therefore a changed evidence input cannot enlarge executable authority under the stated assumptions.

This is an authority-containment property, not a claim of full behavioural noninterference. The changed evidence may alter which permitted action is selected. It may also cause excessive requests within the same scope. Bounded resource and rate allowances are therefore needed even when the proposition holds.

Proof obligations at implementation boundaries

A gateway with an excellent policy language can fail through a permissive adapter. The implementation proof obligations include canonical parsing, binding of the checked parameters to the dispatched parameters, atomic resource updates, authenticated policy versions, protected clocks, anti-replay state and credential confinement. The operating environment must prevent the planner from replacing executables or directly reaching protected interfaces.

Proof-carrying code demonstrates a general pattern in which an untrusted producer supplies evidence checked by a smaller trusted consumer (Necula, 1997). We apply the pattern narrowly: an action request may carry a derivation, resource certificate or plan certificate whose validity the gateway can check. A generated explanation is not such a certificate. The claim must be expressed in a formal language with a specified checker and trusted assumptions.

The seL4 work illustrates the depth of effort required to connect a formal specification to an implementation, including explicit assumptions outside the proof (Klein et al., 2009). A future Lutine implementation should prioritise verification of the smallest consequential components, rather than describe an entire agent stack as formally verified because one library has a proof.

7 Disconnected operation and resource conservation

Classifying operations by invariant

We classify operations by the property that must survive concurrent execution. Appending a uniquely identified observation can proceed locally if its identifier cannot collide and its sensitivity is respected. Allocating the final available component cannot proceed independently at two replicas unless ownership or spending rights have already been separated. Revoking access has a different problem: a disconnected replica cannot know that a remote decision has changed.

Invariant confluence asks whether individually valid states reachable from a shared ancestor can be merged without violating the invariant (Bailis et al., 2014). We use this as an analysis discipline. A system can contain some operations that satisfy it and others that do not. A generic “eventual consistency” setting is insufficient to make the distinction.

Exclusive local rights

Let Q be the quantity available for allocation. Before disconnection, the authority assigns each site i an exclusive local right ri, with the sum of all rights no greater than Q. The site commits qi only while qi is no greater than ri. Rights cannot be copied by cloning a process, restoring a snapshot or replaying a transfer.

Equation 3. Resource conservation follows from exclusive allocation and local spending constraints.

This elementary bound is useful because it identifies exactly what the implementation must preserve. The hard part is not the inequality; it is ensuring that a right has one spendable owner. Balegas et al. (2015) provide an established approach to numeric invariants using distributed rights. Our proposed deployment uses explicit ownership records and requires any transfer to preserve the same conservation condition.

For a ten-unit stock split into six rights at site A and four at site B, A can reserve six while B reserves four without a round trip. If A needs ten and B needs none, four rights remain stranded until they can be transferred or safely reclaimed. This loss of flexibility is the cost of preserving the invariant during disconnection. The allocation policy must be evaluated against likely demand imbalance, not only aggregate inventory.

Transfer recovery and duplicate owners

A rights transfer records a unique transfer identifier, sender epoch, amount and recipient. The sender durably disables its transferred spending authority before the recipient enables the corresponding right. A lost acknowledgement may leave rights temporarily unavailable; it must not create two valid owners. Recovery resumes the same transfer identifier rather than creating a second transfer.

If rights expire, reclamation is safe only when all effect endpoints enforce the expiry and any accepted in-flight operation is accounted for. An authority cannot reassign an offline site's rights merely because the site is unreachable. Reassignment requires proof of surrender, a fencing mechanism accepted by the effect endpoint, or an expiry protocol whose timing and execution assumptions make duplicate spending impossible.

Local durable storage must survive restart without restoring already spent rights. A virtual-machine snapshot containing an old capability and counter is an attack on this invariant unless protected monotonic state or endpoint fencing rejects it. CRDT convergence does not repair a physical over-allocation that occurred before replicas exchanged information. Shapiro et al. (2011) establish convergence properties for specific replicated structures; our resource guarantee additionally depends on the admissible operations and ownership discipline.

Revocation impossibility during partition

Consider two executions that are identical at a disconnected site. In the first, a remote authority has not revoked a permission. In the second, it has revoked it after the partition began. The site receives no distinguishing message. Any algorithm using only its local history must make the same decision in both executions. If it permits the operation, it may violate immediate revocation in the second. If it refuses, it sacrifices availability in the first.

This indistinguishability argument establishes a specific design limit. Immediate global revocation and uninterrupted local use of the affected authority cannot both be promised during an information-blocking partition. Gilbert and Lynch (2002) provide the broader distributed-systems result concerning consistency and availability under partitions. Our argument applies that reasoning to the semantics of delegated action.

We therefore offer two explicit authority contracts. Strict authority requires an online decision or a current authoritative snapshot at the operation's consistency point. Bounded offline authority permits use until a specified expiry, quantity or operating condition is reached. The second contract accepts a bounded period of remote revocation uncertainty. The contract must be selected before the outage and visible to the operator.

Strict revocation also requires an explicit linearisation contract. Reading a recent policy version and then dispatching over a network is not equivalent to an atomic authority-and-effect check. One implementable contract makes revocation complete only when every affected execution endpoint has installed a newer fencing epoch; an unreachable endpoint can delay completion of the revocation. Another uses bounded offline authority and accepts its stated revocation uncertainty. The system must not describe the second contract as the first. Where immediate coordination is required, the authority service and endpoint protocol must establish an order between revocation and effect acceptance, including operations already in flight.

Time and authority expiry

Let E be a capability's expiry in the authority's time base. Suppose the local clock error is bounded by δ, and the maximum delay from validation to effect acceptance is d. An adapter may accept only if its local time plus δ plus d is strictly less than E. Otherwise, it must refresh authority or reject. The bound concerns effect acceptance, not completion of a long-running physical action.

Leases are a well-established technique for bounding cached authority under timing assumptions (Gray and Cheriton, 1989). In our construction, loss of a trustworthy clock invalidates the lease predicate. Restart and clock rollback must not extend authority. If a physical task continues after acceptance, its continuation and abort rules are separate; expiry cannot undo an effect already committed.

Reconciliation without erasing history

Reconnection begins with identity and epoch checks, followed by transfer reconciliation, duplicate suppression and comparison of local commitments against authoritative rights. The system preserves observations of attempted and rejected actions as well as accepted ones. A conflict is not resolved by choosing the latest timestamp if that would conceal two commitments against one asset.

The reconciliation output identifies obligations still outstanding: physical deliveries awaiting observation, reservations requiring release, uncertain operations requiring investigation and incompatible state versions requiring human decision. Replanning starts from this reconciled state. Automatically replaying a stale plan can reproduce the very conflict that disconnection created.

8 Planning under partial observability and explicit risk

Belief state and admissible action set

The planner maintains a belief bt over operational states, updated from observations and a transition model. For a finite model, the usual Bayesian update is:

Equation 4. T is the transition model, O the observation model and η a normalising constant.

The POMDP framework makes partial observability explicit (Kaelbling, Littman and Cassandra, 1998). Our proposed planner additionally receives an admissible action set from the assurance layer. The planner cannot make a prohibited action available by assigning it a high expected reward. Authority constraints and resource ownership are hard filters; uncertainty about equipment state may instead affect a modelled risk constraint or require additional observation.

A finite representation is an approximation. Belief updates can be wrong if failures are correlated, sensors share an upstream error or the environment has changed. We therefore retain a record of model applicability, estimate confidence and contradictory observations. If the uncertainty representation no longer supports the safety argument, the permitted action set contracts to conservative alternatives.

Risk budgets over an entire mission

Let Vt denote a violation during step t and H the declared mission horizon. A mission-level constraint bounds the probability of at least one violation. A conservative decomposition uses a union bound.

Equation 5. This bound does not require independence. Each component probability must refer to the same mission experiment, or be replaced by a bound valid over the relevant conditional histories.

Santana, Thiébaux and Williams (2016) formulate planning with explicit execution-risk constraints under partial observability. Our allocation rule extends the accounting discussion to repeated replanning. The mission budget is not reset whenever the planner chooses a new path. For conditional branches, the budget must follow the actual conditional-risk construction; adding incomparable branch probabilities can either double-count or understate risk.

For illustration, ten independent actions each carrying a 0.005 violation probability produce a combined probability of approximately 0.04889. A threshold described as “half a percent per action” therefore does not imply half a percent for the mission. The union bound is 0.05. These values are arithmetic consequences of an assumed model, not measured operational reliability.

Severe outcomes and model ambiguity

A probability threshold alone does not express the severity of a failure. A low-probability event that disables several essential services may deserve greater weight than a more frequent minor delay. We therefore propose a constrained objective that includes expected service loss, delay, resource use and a tail-loss measure. Conditional Value-at-Risk provides one established way to express tail loss (Rockafellar and Uryasev, 2000).

Equation 6. L is the specified loss and α the tail level. The definition requires a loss distribution; it does not make that distribution accurate.

Loss weights require an operational owner. We do not combine lives, essential-service loss and financial costs into a hidden learned score. Hard prohibitions remain explicit, and the remaining objective exposes its units and trade-offs. The same principle applies to demand priority: protected minimum service levels should be constraints rather than preferences that can be outweighed by a sufficiently large aggregate score.

When transition probabilities are uncertain, a robust formulation considers a set of plausible models. Iyengar (2005) shows how important dynamic-programming results depend on the structure of that uncertainty set, including rectangularity. Our proposed evaluation tests both within-model performance and misspecification. An ambiguity set chosen for computational convenience must not be presented as if it captures every coordinated disturbance.

Information age and the value of observation

Evidence age is measured from the time the underlying state was observed, not merely from arrival. The age-of-information literature provides a useful distinction between freshness and communication rate (Kaul, Yates and Gruteser, 2012). Sending more messages does not ensure that a decision uses sufficiently current evidence if the messages queue or repeat an unchanged observation.

We define an action-specific validity condition. For a stable supplier registration, hours of age may be acceptable. For a rapidly changing temperature or electrical isolation state, even seconds may be excessive. The gateway's threshold comes from the hazard dynamics and observation uncertainty, not from one global time-to-live setting.

Observation itself is an action with cost, delay and possible information exposure. A useful planner compares the expected reduction in decision loss from a new observation against those costs, while respecting authority. If the evidence required to safely proceed cannot arrive before the operational deadline, the correct outcome may be a degraded service mode, a different task or an authorised human decision.

Calibrating learned estimates

Guo et al. (2017) show that neural-network confidence can be miscalibrated and investigate calibration methods. Ovadia et al. (2019) examine predictive uncertainty under distribution shift. These results motivate separate calibration and stress testing for any learned component that supplies a probability to the planner.

We require held-out evaluation of predicted probabilities against observed event frequencies in each relevant operating regime. Aggregate calibration can conceal dangerous errors in a rare facility class or a degraded sensor mode. An estimate based on clean historical data cannot be assumed valid during corrupted telemetry or simultaneous failures. Calibration drift therefore changes the operating envelope and may trigger abstention.

The planner's confidence in a sentence is not interchangeable with the probability that a replacement unit will arrive, that a route will remain open or that a repair will succeed. Each probability has its own event definition, data-generating process and validation set. The architecture preserves these distinctions in the evidence schema.

9 Physical execution and infrastructure dependencies

Capability grounding at the point of action

The proposed action catalogue links each operation to a real adapter, preconditions, resources, expected duration and failure outcomes. A planner may select only from catalogue entries compatible with its delegation. At execution time, the adapter checks whether the required skill or equipment is available and whether the local state still satisfies the contract.

Ahn et al. (2022) show the importance of grounding language-selected actions in executable robotic capabilities. Our application differs in requiring explicit authority and effect evidence as well. A maintenance robot's ability to manipulate a valve is distinct from permission to operate it, and both are distinct from the safety of operating it under the current isolation state.

Capability estimates are versioned with the equipment configuration. A changed payload, firmware version or degraded actuator can invalidate an earlier estimate. The gateway therefore binds an action to the adapter and skill versions actually used. A fallback skill must satisfy its own preconditions rather than inherit approval from the failed primary skill.

Local safety envelopes

Critical physical protection remains close to the process. Central planning may set objectives or approved setpoints, but device-local controls enforce limits on rate, temperature, pressure, isolation and other hazard-relevant quantities. The separation follows the logic of using a simpler safety mechanism alongside a more complex performance component (Sha, 2001).

For a continuous system with dynamics x-dot = f(x) + g(x)u, let the safe region be h(x) ≥ 0. Under appropriate regularity and feasibility assumptions, a control barrier condition can restrict u so that the region remains forward invariant (Ames et al., 2017).

Equation 7. α is an appropriate increasing function with α(0) = 0. Sampling, state-estimation error, actuator limits and disturbances require additional margins and analysis.

This condition is not a generic certificate for every industrial asset. The chosen safe set must be physically meaningful, and the feasible controls must remain nonempty. A tank with an uncontrollable inflow may leave the safe region despite a correct software filter. We therefore analyse physical controllability and fallback duration alongside software enforcement.

A safe stop is a plant-specific decision

Halting all commands is not always safe. A pump may need to continue cooling, a generator may need a controlled shutdown and a transport operation may need to reach a safe stopping location. Each adapter therefore specifies a degraded mode and the conditions under which it remains viable. A loss of central communications must lead to that defined mode, not to an unspecified software timeout.

Alshiekh et al. (2018) investigate shielding that restricts learning-system actions according to formal specifications. We use the general principle while keeping separate the logical specification and its physical abstraction. If the shield's state omits an important dependency, a formally permitted action can still be hazardous. Testing must include abstraction error and sensor delay, not merely violations expressible in the original model.

Coupled essential services

Rinaldi, Peerenboom and Kelly (2001) analyse interdependencies among critical infrastructures. For our purposes, a dependency graph records which services require power, communications, cooling, fuel, staff access or replacement components. An edge represents a specific dependency with a threshold and time scale, not a generic association.

Consider a communications site whose backup generator depends on fuel delivery and whose remote monitoring depends on the same network that is degraded. A planner that optimises only travel time may deliver fuel to a less critical site while overlooking a dependency that will disconnect several facilities. The loss function must therefore account for service consequences and restoration order, subject to minimum-service constraints.

A digital supply-chain twin can support scenario analysis and disruption management (Ivanov and Dolgui, 2021). In the proposed architecture it is a model used to generate and test candidates. It is not the authoritative ledger, and its predicted state is not proof of an actual effect. Divergence between the twin and observed operations is recorded as evidence requiring reconciliation.

Operational technology integration

Industrial control environments impose availability, timing and safety constraints distinct from ordinary office systems (Stouffer et al., 2015). We therefore prefer a narrow integration surface with explicit write permissions and local interlocks. The planner does not receive general administrative access to controllers or engineering workstations.

The proposed integration sequence begins with read-only observation, proceeds to recommendations reviewed by operators, and then allows bounded commands through tested adapters. Time-critical protection remains in established local systems. A gateway outage must not disable an existing protection mechanism or prevent a required local operator action.

10 Completion verification and accountable execution

Success as a state predicate

A task is complete only when its declared predicate holds in an adequately observed state. For an inventory transfer, this may require a source decrement, destination receipt, matching custody identifier and no duplicate active commitment. For maintenance, it may require the work order, test result and restored operational condition. A model-generated sentence saying “completed” supplies none of these by itself.

We define verification as a predicate over the action contract, resulting records and independent observations. The verifier checks positive requirements and forbidden side effects. A resource arriving at its destination does not make the task successful if the system also disclosed a protected route or consumed another facility's reserved stock.

Equation 8. Each term is evaluated against its own evidence and time window. Missing observations produce an unresolved result rather than a positive result.

Idempotency and uncertain effects

Every effectful request has an operation identifier tied to a canonical payload. Repeating the same identifier with the same payload retrieves the existing status; repeating it with a different payload is rejected. The adapter stores duplicate-suppression state durably and binds the identifier to the resource transaction where possible.

Physical effects create a harder boundary. If a remote device performs an operation but its acknowledgement is lost, the caller cannot infer whether the operation occurred merely from a timeout. Automatic retry is safe only when the endpoint implements a suitable idempotency or state-query contract. Otherwise the operation enters an uncertain state and requires observation before further action.

We do not assume universal exactly-once physical execution. A transactional database can provide an exactly-once logical record under specified conditions, while a crane movement or fluid transfer remains outside that transaction. The implementation must explain how it relates the record to the physical process and how it detects an interrupted or repeated effect.

Compensation and irreversibility

Sagas provide a model for long-lived transactions composed of steps with compensating operations (Garcia-Molina and Salem, 1987). We use compensation where it is semantically valid: release a reservation, cancel an unaccepted order or restore a scheduling assignment. Compensation is not necessarily a return to the original world state.

Fuel already consumed, a disclosure already read and an elapsed service interruption cannot simply be rolled back. For these effects, the contract identifies the irreversible boundary and the evidence required immediately before crossing it. Later mitigation is recorded as a new action with its own authority and risk, rather than described as if the original event disappeared.

Evidence integrity and auditability

An execution record contains the request, canonical payload digest, relevant policy and resource versions, evidence identifiers, decision, adapter receipt, observations and verification result. It also records denials, missing observations and reason codes. The record supports reconstruction of what was known and authorised at the time of action.

Hash chaining and signatures can detect some forms of tampering, but a chain held entirely by a compromised host can be replaced or truncated. Independent checkpoints, protected signing keys and retention controls are needed for a stronger integrity claim. Evidence access follows the same confidentiality rules as operational data; an audit system must not become an unrestricted export channel.

We do not require publication of private model reasoning to establish accountability. The necessary record is the decision-relevant evidence, authorised operation, policy evaluation and observed effect. A generated rationale may aid review but is not a substitute for these records and should not be treated as a faithful causal account of model computation.

11 Integrated operational scenarios

Distributed replenishment during communications loss

Consider two depots supporting essential-service maintenance. A central ledger records ten interchangeable replacement modules. Before a communications outage, depot A receives six allocation rights and depot B receives four. Each depot has a local cache of approved suppliers, a signed policy bundle and a device-bound delegation. Neither depot can create new rights or change the other depot's ownership record while disconnected.

A technician requests five modules at A. The planner checks the task objective and proposes a reservation. The gateway verifies the technician's maintenance assignment, the local rights balance, the current equipment compatibility record and the evidence age for module condition. If the condition evidence is missing, the response is a request for inspection rather than a fabricated availability assumption. If the checks pass, the reservation and the decrement of available rights occur atomically.

Meanwhile, a supplier message contains an instruction to send the full inventory and maintenance roster to an external address. The message can contribute evidence about a delivery but carries no release authority. The planner may still propose an export; the destination and information-flow checks reject it. The event is recorded as a denied candidate. The original replenishment task can continue if its evidence remains adequate.

A second request at A seeks four further modules. The global stock may appear sufficient in an old replicated view, but A has only one uncommitted local right. It may reserve that one if partial fulfilment is authorised, defer the remainder or select a separately approved alternative. It cannot assume B's unused rights. This is a deliberate loss of local flexibility in exchange for inventory conservation.

At reconnection, the ledgers reconcile reservations and transfers by operation identifier. A locally acknowledged dispatch without a receiving receipt remains outstanding. Any new allocation plan is based on reconciled commitments and observed custody, not on the model's last narrative summary. The scenario is considered successful only if authorised demand is met within the defined constraints and no stock is committed twice.

Restoration of a coupled water and energy service

Consider a water facility with a primary pump, a standby pump and limited backup power. The objective is to preserve a minimum service level while an electrical fault is diagnosed. The system receives a stale report that the standby pump is available, a recent vibration warning and a local controller indication that the primary pump can continue at reduced output.

The ontology retains all three observations with their time and origin. The planner must not flatten them into a single “available” attribute. It proposes either a bounded reduction in load, a fresh inspection or a switch to the standby asset. The action catalogue defines which commands are available, and the local safety controller limits transitions that could exceed pressure or power constraints.

The risk model distinguishes loss of water service, equipment damage and depletion of backup energy. An apparently fast switch may be inferior if the standby condition is uncertain and the failed transition would prevent returning to the primary pump. The planner evaluates the irreversible boundary and the availability of a recoverable fallback state before requesting the switch.

If a new inspection reduces uncertainty enough to satisfy the operational risk constraint, the gateway can admit the bounded switch. The adapter rechecks the local isolation and equipment state immediately before accepting it. If communications fail during the process, the controller follows the pre-specified local sequence and protection rules. It does not wait indefinitely for a language-model response.

Completion requires more than a closed work order. The verifier examines sustained pressure and flow within the defined observation window, the actual running state of the selected pump and the remaining backup capacity. An administrative record and a physical measurement can disagree; the discrepancy prevents positive completion and initiates investigation.

This example demonstrates why the same architecture needs both discrete transaction invariants and continuous process protection. An inventory proof cannot establish hydraulic safety, and a safe local pump transition cannot establish that the replacement asset was allocated lawfully. The assurance case must connect both without collapsing their evidence requirements.

Restricted information sharing across organisations

Consider a maintenance coordination task involving an asset owner, a logistics provider and an equipment specialist. The owner can disclose a general repair requirement but restricts precise facility location and asset configuration. The provider can receive delivery instructions for an assigned consignment. The specialist can view diagnostic measurements under a limited purpose but cannot redistribute them.

The planner constructs separate authorised views for each role. A jointly derived scheduling artifact inherits the restrictions of the inputs that materially determine it. A public-facing summary is generated from an approved released view, not by asking a model that has seen all source material to “avoid sensitive details”. The release process records its transformation and authorising policy.

Suppose the equipment specialist's assignment is revoked while a derived diagnostic report is being updated. The updated object carries an authority dependency at least as recent as the revocation-sensitive content change. A cache that has not reached that dependency cannot grant access to the new version. If the requesting site is disconnected, the strict-access contract requires deferral. An existing offline delegation, if permitted for that artifact class, remains bounded by its own agreed scope and expiry.

The system also protects indirect disclosure. A query that returns “one matching asset” can reveal the existence of a facility-specific configuration. An error message that names a restricted destination can do the same. Search results, counts and logs therefore use the appropriate audience view. For permitted aggregates, the release policy defines the population, suppression rules and query budget rather than treating any aggregate as automatically safe.

The scenario's completion predicate includes receipt by the intended recipient, correct information scope, preserved purpose restrictions and an audit record linking the released artifact to its authorised derivation. A technically successful transmission to the wrong audience is a failed task.

Common interface across the scenarios

The scenarios share an action contract, a versioned policy decision, a resource or information commitment and a completion predicate. They differ in their safety dynamics, acceptable delay and ability to compensate. This is the proposed basis for reuse: common enforcement interfaces with domain-specific models and adapters. Reuse of an interface does not remove the need to validate each domain's assumptions.

12 Reproducible analytical exercises

Purpose and scope

We executed four small enumerations and a set of arithmetic checks supplied in the computational supplement. The enumerations deliberately use finite abstract states so that every case in the declared domain is inspected. They demonstrate the consequences of specific definitions and expose counterexamples to weaker constructions. They do not measure language-model behaviour, tool integration, field reliability or the performance of a deployed Lutine system.

The standard-library Python program generates the result file directly. Its inputs, loops and assertions are included, and it requires no private data, network service or model API. The cases are unweighted logical possibilities. Their proportions must not be interpreted as empirical event probabilities.

Inventory conservation and stranded rights

The inventory exercise enumerates stock Q from one to twelve units and both local demands from zero to Q. This yields 818 stock-and-demand configurations. A baseline lets each site commit against its own complete copy of Q. In 364 configurations the combined commitments exceed stock. The smallest counterexample is one unit of stock requested once at each of two disconnected sites.

The constrained construction additionally enumerates every split of the stock into exclusive local rights. Across 8,280 stock, demand and rights configurations, no commitment exceeds Q. However, in 4,732 configurations the construction serves less demand than an ideal coordinated allocator that can freely place all Q units. This count captures the availability cost of static rights allocation in the chosen finite domain.

The safety finding follows from Equation 3, while the enumeration checks the implemented arithmetic and makes the trade-off concrete. It does not validate a production transfer protocol. A protocol that duplicates rights during restart or transfer violates an assumption of the construction even if its nominal allocation arithmetic is correct.

Permission races and omitted checks

The authority exercise enumerates six Boolean conditions: permission at proposal time, permission at commit time, state-version agreement, evidence freshness, capability validity and permitted information flow. There are 64 combinations. A baseline that admits solely on proposal-time permission admits 32 and violates at least one required commit condition in 31 of those.

The guarded construction requires the five commit conditions and admits two combinations, differing only in the old proposal-time value. It admits no state defined as invalid by that contract. Removing any one of the five guards produces two invalid admitted states. These are tests of the specified predicate and its mutants, not independent evidence that a real gateway obtains truthful condition values.

The engineering implication is to test the origin and atomicity of each condition separately. A perfectly evaluated predicate remains ineffective if the “current permission” flag comes from a stale cache or if the resource changes between evaluation and commitment.

Joint-source information labels

The label exercise considers four possible readers and three joint input sources. Each source can permit any of the sixteen reader subsets, producing 4,096 combinations. A union-of-readers rule grants at least one reader access without permission from every source in 4,080 combinations. The intersection rule produces no such grant in the enumerated domain.

This exercise checks the conservative joint-source rule in Equation 2. It does not model alternative derivations, statistical inference, covert channels or declassification. Those require the additional controls described in Section 5 and separate evaluation. The result is useful precisely because its claim remains narrower than “the ontology prevents information leakage”.

Acknowledgements and actual completion

The completion exercise enumerates acknowledgement, destination condition, conservation condition and adequate evidence as four Boolean values. In seven of the sixteen combinations, an acknowledgement is present while at least one required postcondition is absent. A verifier requiring the three postconditions can declare completion in two combinations, including one in which an acknowledgement was lost but independent evidence establishes the outcome.

The example shows that an acknowledgement can be neither sufficient nor necessary for task completion under this contract. The conclusion depends on the specified postconditions and trustworthy observations. It does not mean that an application should ignore acknowledgements; they remain useful lifecycle evidence.

Mission risk and the meaning of zero failures

For a hypothetical independent per-action violation probability of 0.005, the supplement calculates mission risks for different action counts. Ten actions produce a probability of 0.04889; fifty produce 0.22169. The corresponding union bounds are 0.05 and 0.25. Figure 2 illustrates this arithmetic and the difference between a per-action and mission-level limit.

Figure 2. Calculated probability of at least one violation under a hypothetical constant per-action risk. The independence curve is illustrative; the union bound does not require independence. These are analytical values, not system measurements.

If zero violations are observed in n independent Bernoulli trials from a stationary population, an exact one-sided 95 percent upper confidence bound on the event probability is 1 − 0.05^(1/n). It is about 0.02951 after 100 trials, 0.002991 after 1,000 and 0.0002995 after 10,000. At least 2,995 zero-event trials are needed to move this bound below 0.001 under those assumptions.

The derivation sets the probability of observing zero events, (1 − p)^n, equal to 0.05 and solves for p. Correlated repetitions, selected easy cases or a changing attack distribution invalidate the simple interpretation. A large count of passing cases is therefore incomplete evidence without a sampling model, exposure definition and test-set provenance.

13 Implementation evaluation design

Falsifiable hypotheses

H1 is that complete mediation and independent authority checks reduce unauthorised external effects relative to a planner controlled only by instructions, while preserving an acceptable rate of authorised task completion. H2 is that exclusive local rights preserve inventory invariants during communication partitions, with measurable service loss from stranded rights. H3 is that state-based completion verification reduces false success declarations relative to acknowledgement-based reporting. H4 is that explicit uncertainty and freshness limits reduce unsafe operational commitments under observation degradation, at a cost in deferral and delay.

Each hypothesis can fail. A gateway may be bypassed, an adapter may misapply a credential, the rights protocol may duplicate ownership, or observation requirements may make useful completion unacceptably rare. The evaluation must be able to reveal these outcomes. Success criteria are defined before testing and cannot be narrowed after seeing the results.

Evaluation units and scenario construction

The primary unit is a mission episode with a defined starting state, authorised objective, event schedule, completion predicate and maximum duration. The generator controls network partitions, message delay, duplicated messages, source corruption, policy changes, resource conflicts and equipment faults. An episode records all intermediate effects, including those later compensated.

We propose a starting core suite of three domains, four disturbance classes, three severity levels and ten independently generated initial states: 360 distinct scenarios. Five planner random seeds per scenario yield 1,800 episodes per architecture configuration. The three domains are replenishment, maintenance restoration and restricted information exchange. The disturbance classes are communications impairment, evidence corruption, authority change and competing resource demand.

This core suite is a design allocation, not a completed experiment. It does not substitute for mixed-disturbance cases, which are evaluated in a separate held-out stress suite. Its repeated seeds are clustered observations of the same scenario, not 1,800 independent operational situations. Analysis must preserve that hierarchy.

Baselines that isolate the mechanism

We compare four primary configurations. The first is a conventional workflow with deterministic rules and no learning-based planner. The second is the same candidate planner with instruction-only restrictions. The third adds a mediated gateway with current online checks but no disconnected rights allocation. The fourth adds the full proposed authority, rights, evidence and completion interfaces.

The configurations use the same task inputs, tool definitions, computational budget and external disturbances wherever their contracts permit. Differences in model capability, retrieval access or planner retries must not be confused with the effect of the assurance mechanism. The instruction-only baseline runs in a controlled simulator or isolated test environment; it is not granted unsafe access to live infrastructure.

Component ablations remove one mechanism at a time: commit-time permission refresh, resource-version binding, joint-source labels, duplicate suppression, evidence freshness, local rights fencing or independent completion verification. A meaningful ablation includes a scenario that should distinguish the omitted component. Removing a control that the test suite never exercises provides little evidence.

Independent outcome adjudication

The evaluator reads authoritative simulator state and instrumented effect logs. It does not ask the planner whether it succeeded. For physical tests, the evaluator uses an observation channel whose failure dependencies are documented and, where practical, different from those used by the acting system. Independence is assessed by shared sensors, credentials, software and data sources, not simply by naming a second process “verifier”.

Scenario authors define forbidden effects and expected end-state constraints before execution. Blinded review is used for outcomes requiring judgement. Disagreements are retained and resolved according to a published adjudication rule. The evaluation records unresolved outcomes separately from success and failure; it does not discard them as inconvenient data.

Metrics and denominators

Per-action rates are reported alongside episode-level rates, with repeated attempts and denied requests retained in the denominator appropriate to the claim. Latency includes median, high percentiles and missed deadlines. A lower average latency can conceal unacceptable tail behaviour. Utility reporting also distinguishes complete fulfilment, approved partial fulfilment and deferral.

Statistical analysis and repeated execution

The primary analysis compares matched scenarios between configurations. Binary outcomes can use paired tests and confidence intervals; continuous outcomes require methods appropriate to their distribution and censoring. Resampling is performed at the scenario level when multiple seeds share the same initial state. A power analysis based on a preliminary variance estimate determines the final sample size for the selected effect, rather than treating the 360-scenario allocation as universally sufficient.

Repeated execution measures consistency. If a single-run success probability were p and repetitions independent, success on every one of k runs would be p^k. With p = 0.9 and k = 10 this is approximately 0.349. Real runs may be dependent, so we report the observed proportion of scenarios that succeed in all repetitions, together with the per-scenario distribution and the dependence assumptions.

For rare violations, zero observed events lead to an upper bound with its sampling assumptions, not a claim of zero risk. Adaptive adversarial testing supplies counterexamples and coverage information but not an unbiased estimate of deployment prevalence. We therefore report adversarial findings separately from estimates from a declared operational scenario distribution.

Fault injection and held-out challenges

The protocol injects faults at the boundaries most likely to invalidate the assurance argument: after approval but before commit, after commit but before acknowledgement, during a rights transfer, at credential expiry, after a policy change and during restart. It also varies clock uncertainty, message reordering and the interval between observation and effect.

Adversarial cases attempt to promote evidence into instruction, substitute a resource identifier, induce an unauthorised destination, repeat an already committed operation, exploit an omitted ontology label or cause a verifier to accept a forged receipt. Mixed cases combine a plausible operational request with a hidden policy conflict. Test data contain synthetic operational records and no real restricted information.

The held-out suite uses unfamiliar wording, tool-return formats, resource combinations and disturbance schedules. Test generation and result adjudication are separated from prompt tuning and policy implementation. Any case used for repair is retired from the held-out pool and remains in the regression suite with its provenance recorded.

Progression to physical evaluation

Simulation is followed by hardware-in-the-loop tests of the adapter and local safety controller, then supervised shadow operation and bounded live tasks. Each stage has a defined entry condition and stopping rule. A safety or authority breach blocks progression until the cause, affected claims and repair evidence are reviewed.

The first live tasks should have observable outcomes, limited consequence and recoverable effects. Evaluation expands only when the relevant evidence supports it. A strong result in inventory reservation does not justify autonomous control of a continuous process. Domain transfer requires a new mapping from the common interface to the target system's hazards and operational constraints.

14 Human control governance and lifecycle assurance

Human authority as an operational interface

Human involvement is useful only when the person can understand the proposed effect and has time and authority to respond. Parasuraman, Sheridan and Wickens (2000) distinguish different functions and levels of automation. We adopt that distinction when allocating responsibility for information acquisition, analysis, action selection and execution.

An approval request displays the concrete operation, affected resources, irreversibility, relevant uncertainty, expiring authority and available alternatives. Approval is bound to a specific payload and version. Editing the action after approval invalidates the approval. A generic “approve plan” button does not authorise unlimited future revisions or a different resource commitment.

The evaluation measures whether operators detect intentionally inserted errors, how often they override the system and how intervention delay changes outcomes. Repeated low-value prompts can create approval fatigue. The architecture therefore routes only decisions requiring human judgement, while deterministic missing-field and permission failures receive clear machine-readable responses.

Emergency authority and escalation

Emergency authority is pre-specified, scoped and auditable. It identifies who may invoke it, which constraints may change, which remain absolute, how long it lasts and what subsequent review is required. The planner cannot create an emergency exception by asserting urgency. Where possible, emergency actions use narrower interfaces designed for the relevant contingency.

Human override does not remove physical limits. An operator may authorise a different restoration priority but cannot make an infeasible pump transition safe by approving it. The system distinguishes an organisational exception from a physical impossibility. If safe continuation is unavailable, escalation describes the conflict rather than concealing it behind a confidence score.

Hazard analysis and assurance cases

Systems-Theoretic Process Analysis examines unsafe control actions and the conditions that produce them (Leveson and Thomas, 2018). We use it to consider actions supplied when unsafe, required actions withheld, actions supplied too early or late and actions applied for the wrong duration. These categories complement software-centric threat modelling by including harmful omission and timing.

For each top-level claim, the assurance case records the operational context, supporting evidence, assumptions, unresolved objections and change triggers. A claim such as “no inventory overcommitment” links to the rights invariant, transaction semantics, recovery protocol and endpoint tests. A claim such as “no unauthorised disclosure” links to retrieval views, labels, release functions and egress enforcement. Evidence for one is not silently reused as evidence for the other.

Model policy and adapter changes

A new planner version can alter the distribution of proposed actions even when the gateway is unchanged. A new policy can alter what the gateway admits even when the planner is unchanged. A new adapter can alter the physical meaning of the same request. The release process therefore versions these components separately and evaluates their composition.

The deployment manifest binds the model, prompt configuration, retrieval schema, policy bundle, ontology version, action catalogue, adapter implementation and verifier definitions. Regression tests include prior counterexamples and contract checks. Rollback restores a compatible set, rather than mixing an old policy interpreter with a new rule language.

Resilience of the assurance components

The authority service and evidence store can themselves become bottlenecks or attack targets. Rate limiting, resource isolation, bounded query complexity and local protected caches prevent a surge of candidate requests from exhausting the enforcement path. Administrative recovery uses distinct credentials and preserves auditability.

Rose et al. (2020) describe zero-trust architecture in terms of explicit resource-focused authentication and authorisation rather than implicit trust based on network location. Ross et al. (2021) frame cyber resilience around sustaining trustworthy operation under adverse conditions. Our proposed design applies these principles to the assurance components themselves: being on the operational network does not confer authority, and loss of a central service must lead to a defined degraded contract.

15 Research implications and testable expectations

Where the architecture should provide value

The architecture is most promising when the operational domain has recurring decisions, explicit resource ownership, observable outcomes and an identifiable boundary between proposal and effect. Maintenance scheduling, inventory allocation and controlled information exchange fit this structure. In these settings a learning component may improve interpretation and candidate generation while established mechanisms constrain commitments.

The architecture is less persuasive where meaningful safety state is unobservable, an effect endpoint cannot enforce scope, or no viable degraded mode exists. Adding an agent does not repair those conditions. The prerequisite research may instead be sensor integrity, adapter redesign, resource accounting or a clearer operational policy.

Conditional expectations for further research

We expect that broader language-action capability will increase the diversity of useful candidate plans and also the number of opportunities for instruction-like content to influence those plans. The testable consequence is a growing need to measure permitted effects and goal integrity separately. This expectation follows from the combination of action generation and external information access; it does not require a forecast of a particular model's benchmark score.

We expect that authority and state consistency will remain limiting factors even as planners improve. The testable prediction is that stronger proposal quality alone will not remove failures caused by stale permissions, duplicated commitments or unobserved effects. Holding the gateway constant while changing the planner should expose this separation.

We expect that disconnected usefulness will depend strongly on the granularity and allocation of local rights. A testable comparison is whether demand-aware allocation reduces stranded capacity relative to equal allocation without increasing invariant violations. The optimum may change with demand uncertainty, transfer opportunities and the cost of idle stock; no universal allocation ratio is proposed.

We expect that independent completion checks will initially reduce reported success while increasing the credibility of the remaining successes. This expectation can be tested by comparing narrative or acknowledgement-based reporting with observed end-state predicates on matched episodes. The magnitude and operational value must be measured.

Open technical questions

The hardest open questions concern composition across domains. How can a compact action certificate express both a discrete resource invariant and a continuous safety envelope? How should risk budgets be allocated among interacting facilities when disturbances are correlated? How can useful derived information be released without making conservative label propagation prohibitively restrictive? Which state abstractions remain sound when sensors degrade?

Other questions concern assurance economics. A technically correct architecture may be operationally poor if verification costs exceed the value of the tasks it enables. Research must measure integration effort, policy maintenance, calibration drift and human review burden alongside runtime performance. Reusable adapters and explicit contracts may reduce those costs, but that is a hypothesis for implementation evidence.

16 Conclusion

We have developed a reference architecture in which adaptive planning is connected to operational effects through explicit authority, information-flow constraints, resource invariants and completion evidence. The architecture's central claim is conditional: a mediated action pathway can preserve specified properties when its policy, state, timing and endpoint assumptions hold. The manuscript identifies those assumptions rather than treating a capable model as sufficient evidence of trustworthy operation.

The analysis establishes three practical boundaries. Disconnected operation requires either locally enforceable rights or acceptance of coordination delay. Immediate remote revocation cannot be guaranteed at a site with no information about the revocation. Completion must be established from the required state and observations, not inferred from the agent's statement or a tool acknowledgement.

The bounded exercises make several consequences checkable: exclusive rights preserve the modelled stock constraint but strand capacity; omitted commit checks admit invalid states; reader-set union overexposes jointly derived information; and acknowledgements can misrepresent outcomes. These findings support the structure of the proposed design while leaving implementation and operational performance to the specified evaluation programme.

For Lutine, the research priority is therefore a small, inspectable execution and verification foundation with carefully selected domain adapters. Increasing planner capability becomes useful within that foundation. Expansion of autonomy should follow evidence that the combined system completes authorised tasks, preserves its declared invariants and recovers coherently when its assumptions cease to hold.

Appendix A Action and evidence contracts

A1 Mandatory action fields

The following schema is a proposed interface contract. Fields are machine-validated before policy evaluation. A missing mandatory field produces a typed rejection. All quantities use explicit units, and all times identify the accepted time base and uncertainty.

An action's immutable fields are covered by its canonical payload digest. The digest includes the relevant schema version so that two parsers cannot legitimately interpret the same approved bytes under different meanings. Credentials are delivered directly to the adapter and are not returned to the planner as ordinary text.

A2 Gateway pseudocode

The pseudocode below specifies ordering, not a universal transaction implementation. The resource transaction and the adapter must provide the stated interfaces. A physical operation may remain uncertain even after the logical dispatch record is durable.

receive candidate and authenticated requester

parse with the declared schema and canonicalise parameters

resolve resource identities and effect destination

load the compatible protected policy bundle

validate delegation scope and the authority freshness contract

validate evidence labels, purpose, quality and age

validate the adapter capability and local safety contract

begin the resource transaction or exclusive-rights operation

reload the relevant resource and authority versions

reject if any required commit condition changed

check local rights, invariants and operation identifier

reserve resources and record the canonical dispatch intent

commit the logical transaction

send through the adapter with the same operation identifier

record acknowledgement or uncertain status

obtain the required post-action observations

verify the goal, policy, conservation and forbidden-effect rules

record verified, failed or unresolved outcome

The interval between logical commit and physical acceptance is a designed uncertainty boundary. If the adapter cannot enforce a still-valid authority token or cannot deduplicate an operation, the gateway cannot infer safe retry from the logical transaction alone. The action remains reserved and unresolved until its recovery rule obtains sufficient evidence. Resource release must not make inventory available elsewhere while the original effect may still occur.

A3 Evidence record

An evidence record contains an observation identifier, source identity, original observation time, receipt time, validity interval, clock uncertainty, relevant object version, measurement or assertion, units, integrity check, quality assessment and derivation links. If it represents a physical observation, it also identifies the sensor or inspection method and its known failure dependencies.

A derived record links to each premise and the transformation version. The record distinguishes direct measurement, reported assertion, inferred relation and model prediction. This distinction is queryable by policy. A safety precondition that requires direct local confirmation cannot be satisfied by a model prediction merely because both are encoded as Boolean values.

A4 Completion contract example

For a module transfer, the completion rule requires a matching custody identifier at the destination, a corresponding source commitment, quantity conservation, an authorised recipient and evidence within the declared receipt window. A damaged item or a mismatched serial number does not satisfy the same predicate. Partial delivery has a separate allowed state rather than being rounded up to completion.

The verifier may conclude verified, failed or unresolved. Verified means all required conditions are established. Failed means an explicit contrary condition or forbidden effect is established. Unresolved means the available evidence cannot decide. A subsequent observation may change unresolved to either other state, with the transition retained in the record.

Appendix B Assurance requirements and challenge cases

This matrix is a minimum research agenda, not a certification checklist. Each deployment requires the appropriate domain-specific hazards, operating assumptions and acceptance criteria. An unresolved obligation remains visible in the assurance case and restricts the claim that can be made.

B1 Example claims and their defeaters

Claim C1 is that no more than the available stock is committed through the proposed ledger. Its principal defeaters are duplicate rights, external commitments outside the ledger, incompatible unit conversion and resource updates not included in the transaction. Evidence must address each, not merely demonstrate that the nominal counter is nonnegative.

Claim C2 is that protected inputs do not produce an unauthorised explicit output through the controlled interfaces. Its defeaters include missing dependency labels, unrestricted logs, model contexts reused across compartments and a release function that accepts arbitrary generated text. A broad noninterference claim would additionally need a model of implicit flows and observable side channels.

Claim C3 is that the physical controller preserves a defined safe set under its operating assumptions. Its defeaters include sensor error beyond the bound, actuator saturation, missed deadlines, an unmodelled coupled process and loss of a feasible fallback. Demonstrating software conformance alone cannot defeat these objections.

Appendix C Reproduction and evaluation records

C1 Reproducing the finite exercises

Run python3 verify_models.py from the computational supplement. The program uses only the Python standard library and writes results.json. The inventory loop enumerates Q = 1 to 12, both demands from zero to Q and each split of Q between the two sites. The authority loop enumerates six independent Boolean flags. The label loop enumerates every four-reader subset for each of three joint inputs. The completion loop enumerates four Boolean flags.

The result file also contains mission-risk arithmetic, zero-event confidence bounds and sample expiry calculations. For an expiry of 120 seconds, a two-second clock-error bound and three-second maximum acceptance delay, the local acceptance check must occur before local time 115 seconds in the stated time base. Equality is rejected under the strict inequality used here.

Changing a model assumption requires changing the corresponding oracle and claim. For example, adding a second spender for the same right invalidates the conservation argument unless another mechanism serialises their use. The appropriate response is to expose the counterexample and revise the protocol, rather than merely increase the number of passing demand combinations.

C2 Minimum record for a future episode

Each future experimental episode should retain a scenario identifier, generator version, random seed, initial state, disturbance schedule, policy bundle, model and adapter versions, tool schema, action history, independent observations, goal predicate, violation predicates, termination reason and adjudication result. The record should also identify whether the case was used for development, regression or held-out evaluation.

For a run involving humans, record the information presented, the approval payload, response delay and subsequent action. For a physical run, record sensor calibration and the relationship between control observations and evaluation observations. For distributed runs, record message delivery and clock conditions sufficiently to reconstruct the race being tested.

C3 Interpretation of the supplement

The finite models are transparent research instruments. They establish what follows inside their declared domains and make weaker alternatives fail visibly. They do not contain a language model, cryptographic implementation, distributed database, hardware controller or full assurance kernel. Those components belong in the implementation programme of Section 13 and require the evidence listed in Appendix B.

References

Ahn, M. et al. (2022) ‘Do As I Can, Not As I Say: Grounding Language in Robotic Affordances’, arXiv preprint 2204.01691, version 1, 4 April. Available at: https://arxiv.org/abs/2204.01691v1.

Alshiekh, M., Bloem, R., Ehlers, R., Könighofer, B., Niekum, S. and Topcu, U. (2018) ‘Safe reinforcement learning via shielding’, Proceedings of the AAAI Conference on Artificial Intelligence, 32(1). https://doi.org/10.1609/aaai.v32i1.11797.

Ames, A.D., Xu, X., Grizzle, J.W. and Tabuada, P. (2017) ‘Control barrier function based quadratic programs for safety critical systems’, IEEE Transactions on Automatic Control, 62(8), pp. 3861–3876. Available at: https://authors.library.caltech.edu/records/jnhr0-1ww05.

Bailis, P. (2015) Coordination Avoidance in Distributed Databases. PhD thesis. University of California, Berkeley. Technical Report UCB/EECS-2015-206, 30 October. Available at: https://www2.eecs.berkeley.edu/Pubs/TechRpts/2015/EECS-2015-206.html.

Bailis, P., Fekete, A., Franklin, M.J., Ghodsi, A., Hellerstein, J.M. and Stoica, I. (2014) ‘Coordination avoidance in database systems’, Proceedings of the VLDB Endowment, 8(3), pp. 185–196. https://doi.org/10.14778/2735508.2735509.

Balegas, V., Serra, D., Duarte, S., Ferreira, C., Shapiro, M., Rodrigues, R. and Preguiça, N. (2015) ‘Extending eventually consistent cloud databases for enforcing numeric invariants’, IEEE 34th Symposium on Reliable Distributed Systems. Available at: https://asc.di.fct.unl.pt/~nmp/pubs/srds-2015.pdf.

Birgisson, A., Politz, J.G., Erlingsson, Ú., Taly, A., Vrable, M. and Lentczner, M. (2014) ‘Macaroons: Cookies with contextual caveats for decentralized authorization in the cloud’, Network and Distributed System Security Symposium. Available at: https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/macaroons-cookies-contextual-caveats-decentralized-authorization-cloud/.

Garcia-Molina, H. and Salem, K. (1987) Sagas. Technical Report TR-070-87. Princeton University, 7 January. Available at: https://www.cs.princeton.edu/techreports/1987/070.pdf.

Gilbert, S. and Lynch, N. (2002) ‘Brewer’s conjecture and the feasibility of consistent, available, partition-tolerant web services’, ACM SIGACT News, 33(2), pp. 51–59. https://doi.org/10.1145/564585.564601.

Goguen, J.A. and Meseguer, J. (1982) ‘Security policies and security models’, IEEE Symposium on Security and Privacy, pp. 11–20. Available at: https://www.cs.purdue.edu/homes/ninghui/readings/AccessControl/goguen_meseguer_82.pdf.

Gray, C.G. and Cheriton, D.R. (1989) ‘Leases: An efficient fault-tolerant mechanism for distributed file cache consistency’, Proceedings of the Twelfth ACM Symposium on Operating Systems Principles, pp. 202–210. https://doi.org/10.1145/74850.74870.

Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) ‘On calibration of modern neural networks’, Proceedings of the 34th International Conference on Machine Learning, PMLR 70, pp. 1321–1330. Available at: https://proceedings.mlr.press/v70/guo17a.html.

Hu, V.C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R. and Scarfone, K. (2014) Guide to Attribute Based Access Control Definition and Considerations. NIST SP 800-162. Version incorporating updates to 2 August 2019. https://doi.org/10.6028/NIST.SP.800-162.

Ivanov, D. and Dolgui, A. (2021) ‘A digital supply chain twin for managing the disruption risks and resilience in the era of Industry 4.0’, Production Planning & Control, 32(9), pp. 775–788. First published online 21 May 2020. https://doi.org/10.1080/09537287.2020.1768450.

Iyengar, G.N. (2005) ‘Robust dynamic programming’, Mathematics of Operations Research, 30(2), pp. 257–280. https://doi.org/10.1287/moor.1040.0129.

Kaelbling, L.P., Littman, M.L. and Cassandra, A.R. (1998) ‘Planning and acting in partially observable stochastic domains’, Artificial Intelligence, 101(1–2), pp. 99–134. https://doi.org/10.1016/S0004-3702(98)00023-X.

Kaul, S., Yates, R. and Gruteser, M. (2012) ‘Real-time status: How often should one update?’, Proceedings of IEEE INFOCOM, pp. 2731–2735. https://doi.org/10.1109/INFCOM.2012.6195689.

Klein, G. et al. (2009) ‘seL4: Formal verification of an OS kernel’, Proceedings of the ACM Symposium on Operating Systems Principles, pp. 207–220. Available at: https://cgi.cse.unsw.edu.au/~kleing/papers/sosp09.pdf.

Knublauch, H. and Kontokostas, D. (eds.) (2017) Shapes Constraint Language. W3C Recommendation, 20 July. Available at: https://www.w3.org/TR/2017/REC-shacl-20170720/.

Lebo, T., Sahoo, S. and McGuinness, D. (eds.) (2013) PROV-O: The PROV Ontology. W3C Recommendation, 30 April. Available at: https://www.w3.org/TR/2013/REC-prov-o-20130430/.

Leveson, N.G. and Thomas, J.P. (2018) STPA Handbook. Massachusetts Institute of Technology, March. Available at: https://psas.scripts.mit.edu/home/get_file.php?name=STPA_handbook.pdf.

Nakano, R. et al. (2021) ‘WebGPT: Browser-assisted question-answering with human feedback’, arXiv preprint 2112.09332, version 1, 17 December. Available at: https://arxiv.org/abs/2112.09332v1.

Necula, G.C. (1997) ‘Proof-carrying code’, Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 106–119. https://doi.org/10.1145/263699.263712.

Ovadia, Y. et al. (2019) ‘Can you trust your model’s uncertainty? Evaluating predictive uncertainty under dataset shift’, Advances in Neural Information Processing Systems, 32. Available at: https://papers.neurips.cc/paper_files/paper/2019/hash/8558cb408c1d76621371888657d2eb1d-Abstract.html.

Pang, R. et al. (2019) ‘Zanzibar: Google’s consistent, global authorization system’, Proceedings of the USENIX Annual Technical Conference, pp. 33–46. Available at: https://www.usenix.org/conference/atc19/presentation/pang.

Parasuraman, R., Sheridan, T.B. and Wickens, C.D. (2000) ‘A model for types and levels of human interaction with automation’, IEEE Transactions on Systems, Man, and Cybernetics Part A, 30(3), pp. 286–297. https://doi.org/10.1109/3468.844354.

Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K. (2001) ‘Identifying, understanding, and analyzing critical infrastructure interdependencies’, IEEE Control Systems Magazine, 21(6), pp. 11–25. https://doi.org/10.1109/37.969131.

Rockafellar, R.T. and Uryasev, S. (2000) ‘Optimization of conditional value-at-risk’, Journal of Risk, 2(3), pp. 21–41. Available at: https://sites.math.washington.edu/~rtr/papers/rtr179-CVaR1.pdf.

Rose, S., Borchert, O., Mitchell, S. and Connelly, S. (2020) Zero Trust Architecture. NIST SP 800-207. https://doi.org/10.6028/NIST.SP.800-207.

Ross, R., Pillitteri, V., Graubart, R., Bodeau, D. and McQuaid, R. (2021) Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. NIST SP 800-160, Volume 2, Revision 1. https://doi.org/10.6028/NIST.SP.800-160v2r1.

Sabelfeld, A. and Myers, A.C. (2003) ‘Language-based information-flow security’, IEEE Journal on Selected Areas in Communications, 21(1), pp. 5–19. Available at: https://www.cs.cornell.edu/andru/papers/jsac/sm-jsac03.pdf.

Saltzer, J.H. and Schroeder, M.D. (1975) ‘The protection of information in computer systems’, Proceedings of the IEEE, 63(9), pp. 1278–1308. Available at: https://www.microsoft.com/en-us/research/publication/the-protection-of-information-in-computer-systems/.

Santana, P., Thiébaux, S. and Williams, B. (2016) ‘RAO*: An algorithm for chance-constrained POMDP’s’, Proceedings of the AAAI Conference on Artificial Intelligence, 30(1). https://doi.org/10.1609/aaai.v30i1.10423.

Schneider, F.B. (2000) ‘Enforceable security policies’, ACM Transactions on Information and System Security, 3(1), pp. 30–50. Available at: https://www.cs.cornell.edu/fbs/publications/EnfSecPols.pdf.

Sha, L. (2001) ‘Using simplicity to control complexity’, IEEE Software, 18(4), pp. 20–28. https://doi.org/10.1109/MS.2001.936213.

Shapiro, M., Preguiça, N., Baquero, C. and Zawirski, M. (2011) A Comprehensive Study of Convergent and Commutative Replicated Data Types. INRIA Research Report RR-7506, version 1, 13 January. Available at: https://dsf.berkeley.edu/cs286/papers/crdt-tr2011.pdf.

Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M. and Hahn, A. (2015) Guide to Industrial Control Systems Security. NIST SP 800-82, Revision 2. https://doi.org/10.6028/NIST.SP.800-82r2.

Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K. and Cao, Y. (2022) ‘ReAct: Synergizing reasoning and acting in language models’, arXiv preprint 2210.03629, version 1, 6 October. Available at: https://arxiv.org/abs/2210.03629v1.