[
  {
    "argument": "Speed is useful only after authority and consequence boundaries are established; technical access must not create its own mandate.",
    "claim": "Every automated protection action and any external mission support is traceable to a competent authority, named asset scope, allowed effects, prohibited outcomes, duration, stop conditions, and review route.",
    "defeaters": [
      "missing authority",
      "expired approval",
      "ambiguous asset ownership",
      "unresolved jurisdiction",
      "action outside approved effect envelope"
    ],
    "evidenceRequirements": [
      "signed authority record",
      "asset and identity scope",
      "allowed-action matrix",
      "prohibited outcomes",
      "deconfliction record",
      "expiry and revocation evidence",
      "review and appeal path"
    ],
    "hazards": [
      "unauthorized access",
      "third-party impact",
      "mission conflict",
      "unreviewed escalation"
    ],
    "id": "AC-K05-C01",
    "name": "Authority and mission boundary is explicit",
    "recoveryObjectives": [
      "automatic action stop on authority failure",
      "preserve signed decision state",
      "restore least-privilege baseline"
    ],
    "siteTailoring": [
      "operator and licensee roles",
      "government mission authority",
      "third-party service boundaries",
      "jurisdiction and contract"
    ],
    "slug": "authority-and-mission-boundary",
    "sourceIds": [
      "SRC-WH-CYBER-CRIME-MEMO-2026",
      "SRC-NRC-10CFR-73-SUBPART-J-2026"
    ]
  },
  {
    "argument": "Consequence-driven engineering focuses scarce assurance effort on outcomes that can defeat safety, continuity, or mission objectives even after perimeter compromise.",
    "claim": "The facility identifies the cyber-enabled physical and mission consequences that must be prevented, their initiating pathways, critical functions, and independent protections.",
    "defeaters": [
      "unmodeled dependency",
      "unknown external service",
      "new plant configuration",
      "hidden network bridge",
      "protection sharing a common failure mode"
    ],
    "evidenceRequirements": [
      "HCE register",
      "system-of-systems dependency model",
      "critical-function list",
      "attack-path abstractions",
      "independent protection inventory",
      "hazard acceptance records"
    ],
    "hazards": [
      "radiological consequence",
      "loss of heat removal",
      "unsafe load rejection",
      "cooling loss",
      "loss of essential compute",
      "corrupted restoration"
    ],
    "id": "AC-K05-C02",
    "name": "High-consequence events are identified and bounded",
    "recoveryObjectives": [
      "prevent HCE progression",
      "reach approved safe state",
      "retain essential telemetry",
      "recover critical function within site target"
    ],
    "siteTailoring": [
      "reactor design",
      "electrical one-line",
      "cooling architecture",
      "compute mission priorities",
      "fuel and logistics"
    ],
    "slug": "high-consequence-events-are-bounded",
    "sourceIds": [
      "SRC-INL-CCE",
      "SRC-NIST-800-82R3"
    ]
  },
  {
    "argument": "Physical or independently assured boundaries reduce dependence on the correctness of compromised enterprise software and autonomous models.",
    "claim": "Safety-significant and critical OT functions cannot be commanded from lower-trust datacenter or external networks through an unverified software path.",
    "defeaters": [
      "bidirectional maintenance path",
      "shared management plane",
      "unapproved remote access",
      "boundary bypass",
      "common timing or identity dependency"
    ],
    "evidenceRequirements": [
      "network and data-flow diagrams",
      "hardware boundary inventory",
      "one-way-flow tests where used",
      "independent interlock tests",
      "configuration hashes",
      "change-control evidence"
    ],
    "hazards": [
      "IT-to-OT pivot",
      "unauthorized control command",
      "loss of deterministic behavior",
      "hidden common-mode failure"
    ],
    "id": "AC-K05-C03",
    "name": "Deterministic separation protects safety functions",
    "recoveryObjectives": [
      "isolate affected trust zone",
      "preserve safety function",
      "restore verified boundary configuration"
    ],
    "siteTailoring": [
      "license basis",
      "data historian flow",
      "vendor maintenance",
      "emergency communications",
      "support-system dependencies"
    ],
    "slug": "deterministic-separation-protects-safety-functions",
    "sourceIds": [
      "SRC-NRC-10CFR-73-54",
      "SRC-NRC-10CFR-73-SUBPART-J-2026",
      "SRC-NIST-800-82R3"
    ]
  },
  {
    "argument": "A compromised management plane can bypass controls in the host workload and persist below ordinary endpoint visibility.",
    "claim": "Privileged identities, workload identities, signing keys, BMCs, firmware, update systems, model artifacts, and management networks are separately protected and continuously evidenced.",
    "defeaters": [
      "unknown firmware",
      "default credentials",
      "shared administrative identity",
      "unverified update",
      "attestation failure",
      "unmonitored BMC egress"
    ],
    "evidenceRequirements": [
      "asset and firmware inventory",
      "secure-boot and attestation evidence",
      "key status",
      "BMC isolation tests",
      "signed update provenance",
      "privileged-session logs",
      "SBOM and vulnerability status"
    ],
    "hazards": [
      "ring-minus-three persistence",
      "cluster-wide destructive control",
      "supply-chain compromise",
      "identity replay"
    ],
    "id": "AC-K05-C04",
    "name": "Identity, firmware, and management planes remain trustworthy",
    "recoveryObjectives": [
      "revoke affected identities",
      "quarantine management segment",
      "restore signed firmware",
      "re-attest before service return"
    ],
    "siteTailoring": [
      "hardware vendor",
      "BMC implementation",
      "HSM and key custody",
      "maintenance contractor",
      "air-gapped update process"
    ],
    "slug": "identity-and-management-plane-remain-trustworthy",
    "sourceIds": [
      "SRC-NIST-800-207",
      "SRC-NIST-SSDF",
      "SRC-NIST-800-82R3"
    ]
  },
  {
    "argument": "Machine-speed containment can reduce loss only when false-positive effects cannot exceed the threat being controlled.",
    "claim": "Autonomous defenders act only through pre-authorized internal actions whose physical consequence, confidence threshold, rollback, evidence, and safe-state behavior have been tested.",
    "defeaters": [
      "unbounded tool access",
      "unknown physical consequence",
      "model drift",
      "poisoned telemetry",
      "rollback failure",
      "conflicting agent state"
    ],
    "evidenceRequirements": [
      "allowed-action policy",
      "causal dependency model",
      "threshold and uncertainty records",
      "rollback tests",
      "false-positive consequence analysis",
      "model and data provenance",
      "decision receipts"
    ],
    "hazards": [
      "self-inflicted outage",
      "unsafe OT isolation",
      "cascading agent failure",
      "evidence loss"
    ],
    "id": "AC-K05-C05",
    "name": "Autonomous defense is bounded, causal, and reversible",
    "recoveryObjectives": [
      "stop action on uncertainty",
      "restore last known-good state",
      "retain incident chronology",
      "escalate unresolved state"
    ],
    "siteTailoring": [
      "action tier",
      "protected process",
      "latency requirement",
      "operator authority",
      "maintenance state"
    ],
    "slug": "autonomous-defense-is-bounded-and-reversible",
    "sourceIds": [
      "SRC-NIST-800-82R3",
      "SRC-NIST-800-207",
      "SRC-WH-GOLD-EAGLE-2026"
    ]
  },
  {
    "argument": "No single model or sensor should convert uncertain perception into destructive action, and technical confidence does not create legal authority.",
    "claim": "Physical-security autonomy separates sensing, classification, access denial, non-destructive protection, authorized responder routing, and any force-enabled response into independently governed layers.",
    "defeaters": [
      "single-sensor dependency",
      "unknown object class",
      "compromised clock",
      "adversarial input",
      "missing authority",
      "unsafe collateral envelope"
    ],
    "evidenceRequirements": [
      "multi-sensor confidence record",
      "sensor-health evidence",
      "disagreement policy",
      "access-control tests",
      "authorized responder interface",
      "force-authority record where applicable",
      "runtime assurance tests"
    ],
    "hazards": [
      "misclassification",
      "harm to authorized personnel",
      "airspace interference",
      "fratricide",
      "unauthorized force"
    ],
    "id": "AC-K05-C06",
    "name": "Sensor and model disagreement cannot directly control force",
    "recoveryObjectives": [
      "degrade to tracking and delay",
      "notify authorized responder",
      "preserve sensor evidence",
      "disable suspect actuator path"
    ],
    "siteTailoring": [
      "site perimeter",
      "airspace environment",
      "public access",
      "authorized federal support",
      "local emergency response"
    ],
    "slug": "sensor-and-model-disagreement-does-not-control-force",
    "sourceIds": [
      "SRC-DODD-3000-09",
      "SRC-FAA-CI-UAS-NPRM-2026",
      "SRC-USC-6-124N",
      "SRC-USC-47-333"
    ]
  },
  {
    "argument": "Cybersecurity is incomplete when digital manipulation can drive an otherwise valid physical command into an unsafe state.",
    "claim": "The facility can detect corrupted or unavailable power, cooling, environmental, and timing data; reject unsafe commands; and transition to approved operating states without relying on the compromised channel.",
    "defeaters": [
      "single timing source",
      "physics-unaware anomaly model",
      "untested load step",
      "shared cooling control",
      "unavailable manual or independent fallback"
    ],
    "evidenceRequirements": [
      "physical plausibility models",
      "independent sensors",
      "load-rejection tests",
      "islanding and resynchronization tests",
      "cooling-failure tests",
      "timing holdover evidence",
      "safe-state procedures"
    ],
    "hazards": [
      "false relay trip",
      "grid instability",
      "thermal excursion",
      "coolant loss",
      "compute damage"
    ],
    "id": "AC-K05-C07",
    "name": "Power, cooling, and timing failures do not defeat protected functions",
    "recoveryObjectives": [
      "maintain safety and essential cooling",
      "stabilize electrical state",
      "restore trusted time",
      "rejoin service through verified sequence"
    ],
    "siteTailoring": [
      "grid topology",
      "reactor and turbine response",
      "UPS and storage",
      "cooling technology",
      "critical workload tiers"
    ],
    "slug": "power-cooling-and-timing-fail-safely",
    "sourceIds": [
      "SRC-NIST-800-82R3",
      "SRC-NERC-CIP-CATALOG-2026",
      "SRC-NRC-10CFR-73-SUBPART-J-2026"
    ]
  },
  {
    "argument": "Availability under attack depends on prepared restoration, not only detection or backup existence.",
    "claim": "Critical services can be restored from independently protected, provenance-verified states while preserving evidence and preventing reinfection or unsafe configuration reintroduction.",
    "defeaters": [
      "backup shares compromise",
      "unknown dependency order",
      "stale credentials",
      "unverified image",
      "evidence overwritten",
      "unsafe OT restart"
    ],
    "evidenceRequirements": [
      "recovery architecture",
      "immutable or protected backups",
      "gold-image hashes",
      "clean-room procedure",
      "restore rehearsal results",
      "dependency order",
      "post-restore attestation",
      "incident ledger"
    ],
    "hazards": [
      "reinfection",
      "loss of forensic continuity",
      "unsafe process restart",
      "prolonged mission loss"
    ],
    "id": "AC-K05-C08",
    "name": "Recovery is clean, evidenced, and repeatable",
    "recoveryObjectives": [
      "restore safety first",
      "recover essential control and cooling",
      "recover mission compute by priority",
      "re-establish evidence continuity"
    ],
    "siteTailoring": [
      "RTO/RPO by function",
      "licensing constraints",
      "fuel and staffing",
      "external service dependencies",
      "data classification"
    ],
    "slug": "recovery-is-clean-evidenced-and-repeatable",
    "sourceIds": [
      "SRC-NIST-800-82R3",
      "SRC-NIST-800-53"
    ]
  },
  {
    "argument": "Architecture, code, a signature, or a successful demonstration proves only a bounded property; evidence must match the claim being made.",
    "claim": "Every public or procurement readiness state is traceable to exact releases, tests, defects, deployment identity, authority, incidents, uptime, restoration, and independent-verification status.",
    "defeaters": [
      "missing artifact",
      "stale verification",
      "unresolved critical defect",
      "unknown deployment identity",
      "unavailable incident log",
      "marketing statement exceeds evidence"
    ],
    "evidenceRequirements": [
      "release hash",
      "SBOM",
      "test coverage",
      "defect and waiver records",
      "deployment record",
      "uptime window",
      "incident history",
      "independent verification",
      "last observation"
    ],
    "hazards": [
      "false procurement confidence",
      "unsafe deployment",
      "unreviewed residual risk",
      "loss of public trust"
    ],
    "id": "AC-K05-C09",
    "name": "Evidence supports readiness without overclaiming",
    "recoveryObjectives": [
      "downgrade readiness automatically",
      "publish correction",
      "suspend affected claim",
      "restore evidence chain"
    ],
    "siteTailoring": [
      "mission assurance level",
      "customer acceptance criteria",
      "regulatory recordkeeping",
      "classified evidence boundary"
    ],
    "slug": "evidence-can-support-readiness-without-overclaiming",
    "sourceIds": [
      "SRC-W3C-PROV-O",
      "SRC-NIST-SSDF"
    ]
  },
  {
    "argument": "Internal defense and external state action have different authorities, target risks, third-party effects, and escalation consequences.",
    "claim": "External cyber surveillance or effects support is never triggered solely by a facility defensive model and proceeds only through a separately approved mission package, federal or other competent authority, deconfliction, effect constraints, and post-operation accountability.",
    "defeaters": [
      "private self-authorization",
      "uncertain target ownership",
      "unresolved third-party infrastructure",
      "missing state authority",
      "critical-outcome risk",
      "scope expansion"
    ],
    "evidenceRequirements": [
      "mission package",
      "written approval and direction",
      "target adjudication",
      "deconfliction evidence",
      "critical-outcome assessment",
      "abort and minimization procedures",
      "execution and effects report"
    ],
    "hazards": [
      "sovereignty violation",
      "collateral system damage",
      "intelligence conflict",
      "escalation",
      "state responsibility"
    ],
    "id": "AC-K05-C10",
    "name": "Authorized external effects remain separate from facility defense",
    "recoveryObjectives": [
      "cease outside parameters",
      "minimize unintended access",
      "notify authority",
      "preserve evidence",
      "conduct post-operation review"
    ],
    "siteTailoring": [
      "mission sponsor",
      "target class",
      "jurisdiction",
      "allied equities",
      "classified annex"
    ],
    "slug": "authorized-external-effects-remain-separate-from-facility-defense",
    "sourceIds": [
      "SRC-WH-CYBER-CRIME-MEMO-2026",
      "SRC-USC-6-124N"
    ]
  }
]