A Setpoint Write Is Not Actuation: Finality for ICS, Grid, and Robot Command
draft-das-ot-actuation-finality-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | Sangam Das | ||
| Last updated | 2026-10-08 (Latest revision 2026-08-26) | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Additional resources |
Report- The 85.B2 Challenge: Does This Earlier Disclosed AI-Agent Architecture is Similar to Meta Muse/Sentinel?
|
||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-das-ot-actuation-finality-00
Network Working Group S. Das
Internet-Draft Independent Inventor
Intended status: Informational 27 August 2026
Expires: 28 February 2027
A Setpoint Write Is Not Actuation: Finality for ICS, Grid, and Robot
Command
draft-das-ot-actuation-finality-00
Abstract
Industrial systems already know how to move a breaker, a valve, a
robot joint, or a turbine setpoint. They do not know whether this
write — this tag, this value, this device, from this operator session
or this agent — is the write that was authorized to become motion. A
signed OPC UA call, a valid DNP3 control, an IEC 61850 command, or an
MQTT publish onto the plant bus can all be protocol-correct while the
act is wrong. The protocol authenticates a channel. It does not
bind a Candidate Act at the actuation sink.
That gap is now an agent gap. Copilots sit on historians and work-
order text. They propose "explain this alarm" and then "set this
point." If the gateway treats a well-formed write as authority,
reconstruction of plant state becomes physical consequence. Past
incidents stole engineering workstations. Present incidents steal
the jump host or the agent seat. Future incidents let the model
format the command.
This document specifies an OT-side execution-finality profile. A
write remains an Actuation Candidate Act. A Protected Enforcement
Domain binds principal, zone, device, tag, value envelope, mode
(local/remote, auto/manual), safety interlock state, policy epoch,
and intended actuation sink, then commits evidence before scoped non-
bearer authority is issued. The sink that would actually drive I/O
verifies that authority against the live write and consumes it. A
setpoint write is not actuation.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Das Expires 28 February 2027 [Page 1]
Internet-Draft OT Actuation Finality August 2026
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 28 February 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. How OT Command Abuse Changed . . . . . . . . . . . . . . . . 4
2.1. Past: Steal the Engineering Station . . . . . . . . . . . 4
2.2. Present: Steal the Jump Path that Can Write . . . . . . . 4
2.3. Future: Compute the Setpoint, Then Actuate . . . . . . . 4
3. Requirements Language . . . . . . . . . . . . . . . . . . . . 5
4. Problem Space . . . . . . . . . . . . . . . . . . . . . . . . 5
5. Existing Solutions and What They Do Not Bind . . . . . . . . 5
5.1. IEC 62443, Zones, and Conduits . . . . . . . . . . . . . 5
5.2. OPC UA, DNP3, IEC 61850, Modbus, MQTT . . . . . . . . . . 5
5.3. Safety PLC and SIS . . . . . . . . . . . . . . . . . . . 6
5.4. Jump Hosts, Privileged Access, and MFA . . . . . . . . . 6
5.5. Change Tickets and Permit-to-Work . . . . . . . . . . . . 6
5.6. Robot and ROS Command Buses . . . . . . . . . . . . . . . 6
5.7. What This Profile Adds . . . . . . . . . . . . . . . . . 6
6. Industrial Applicability . . . . . . . . . . . . . . . . . . 6
6.1. Transmission and Distribution . . . . . . . . . . . . . . 6
6.2. Process, Refining, and Batch . . . . . . . . . . . . . . 6
6.3. Water, Waste, and Pipelines . . . . . . . . . . . . . . . 7
6.4. Discrete Manufacturing and Robots . . . . . . . . . . . . 7
6.5. Rail, Tunnel, and Building Life-Safety . . . . . . . . . 7
6.6. OT Copilots and MCP on the Plant LAN . . . . . . . . . . 7
6.7. How an Operator Would Pilot . . . . . . . . . . . . . . . 7
7. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 7
8. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 7
Das Expires 28 February 2027 [Page 2]
Internet-Draft OT Actuation Finality August 2026
9. End-to-End Workflow . . . . . . . . . . . . . . . . . . . . . 8
10. Actuation Pseudocode . . . . . . . . . . . . . . . . . . . . 9
11. JSON Interoperability Profile . . . . . . . . . . . . . . . . 10
11.1. ActuationCandidateAct Schema . . . . . . . . . . . . . . 10
11.2. Evidence, Authority, Allow, Deny . . . . . . . . . . . . 13
11.3. Complete Allow Transaction . . . . . . . . . . . . . . . 15
12. Load-Bearing Bindings . . . . . . . . . . . . . . . . . . . . 15
13. Worked Denials . . . . . . . . . . . . . . . . . . . . . . . 15
14. Dual Control, LOTO, and Permit-to-Work . . . . . . . . . . . 16
15. Informative Protocol Mappings . . . . . . . . . . . . . . . . 16
15.1. OPC UA Write / Call . . . . . . . . . . . . . . . . . . 16
15.2. DNP3 Select/Operate . . . . . . . . . . . . . . . . . . 16
15.3. IEC 61850 Operate . . . . . . . . . . . . . . . . . . . 16
15.4. ROS / Robot Trajectory . . . . . . . . . . . . . . . . . 16
16. Practical Feasibility: Latency and Legacy . . . . . . . . . . 16
16.1. Scan-Time Budget . . . . . . . . . . . . . . . . . . . . 17
16.2. Hot-Path Envelope . . . . . . . . . . . . . . . . . . . 17
16.3. Coexistence with OPC UA and DNP3 . . . . . . . . . . . . 17
16.4. Coexistence with Modbus . . . . . . . . . . . . . . . . 17
16.5. Coexistence with SIS . . . . . . . . . . . . . . . . . . 17
16.6. Coexistence with HMIs . . . . . . . . . . . . . . . . . 17
16.7. What This Profile Does Not Require . . . . . . . . . . . 18
17. Combined Agent Tool Call and Actuation . . . . . . . . . . . 18
18. OT Threat Catalog . . . . . . . . . . . . . . . . . . . . . . 18
19. Failure Codes . . . . . . . . . . . . . . . . . . . . . . . . 19
20. Implementation Checklist . . . . . . . . . . . . . . . . . . 19
21. Security Considerations . . . . . . . . . . . . . . . . . . . 19
22. Privacy Considerations . . . . . . . . . . . . . . . . . . . 19
23. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20
24. Intellectual Property Note . . . . . . . . . . . . . . . . . 20
25. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 20
26. Normative References . . . . . . . . . . . . . . . . . . . . 20
27. Informative References . . . . . . . . . . . . . . . . . . . 20
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 21
1. Introduction
The command path in a plant, grid, water system, warehouse robot
cell, or rail interlocking is now:
HMI / MES / agent / work-order bot
-> write {device, tag, value}
-> OPC UA / DNP3 / IEC 61850 / MQTT / ROS
-> PLC / RTU / drive / robot controller
-> physical change
Das Expires 28 February 2027 [Page 3]
Internet-Draft OT Actuation Finality August 2026
This document controls the last arrow. The computer may compute a
setpoint. The fieldbus may authenticate the client. Neither fact is
authority for this value to leave the logic solver toward this
actuator in this mode and epoch.
The profile uses the chain in [I-D.das-6g-finality] and the tool
objects in [I-D.das-agentic]. It specifies only physical-actuation
predicates: tag and value binding, zone and device binding,
operating-mode binding, interlock and permit-to-work inputs, and
coexistence with existing ICS protocols that remain the transport.
2. How OT Command Abuse Changed
2.1. Past: Steal the Engineering Station
Historical OT incidents stole the thing that already issued commands:
an engineering workstation, a vendor laptop, a PLC project file, a
default password on an HMI. Defense was island-centric. Air-gap the
cell. Lock the cabinet. Patch when the outage window allows. The
valuable object was the workstation that engineers already trusted to
write.
2.2. Present: Steal the Jump Path that Can Write
Present incidents often leave the PLC password in place. The
attacker takes a jump host, a VPN into the DMZ, an MES API that
forwards setpoints, or an agent seat allowed to "help operations."
IEC 62443 zones are drawn. The write is still just a write.
Business-email compromise had a plant cousin: a lawful operator
session, a new target tag, a valid protocol signature.
2.3. Future: Compute the Setpoint, Then Actuate
The coming incident does not require the attacker to speak DNP3. The
model speaks the gateway's JSON and the gateway speaks DNP3. "Open
this valve, the work order says so" is a Candidate Act that looks
like ordinary assistance. If the I/O server accepts any
authenticated write from that worker, language becomes motion.
Safety PLCs still trip. This profile does not replace SIS. It
exists so a protocol-valid write that is safety-irrelevant or that
sits below the SIS threshold still cannot complete without current
actuation authority.
Das Expires 28 February 2027 [Page 4]
Internet-Draft OT Actuation Finality August 2026
3. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Failure to establish current actuation authority MUST NOT be
converted into permission to energize, stroke, step, or otherwise
change a physical output.
4. Problem Space
An OT write is a Candidate Act whose consequence class is PHYSICAL or
NETWORK_CONTROL. After the coil changes, rollback is a process, not
a protocol. First-class failures:
* Value substitution (80.0 authorized, 800.0 sent).
* Tag substitution (authorized PCV-12, live PCV-21).
* Device or zone substitution (cell A authority used on cell B).
* Mode violation (remote write while the device is Local or Locked-
out).
* Replay of a consumed jog or close pulse.
* Permit-to-work expired while the command sat in a queue.
* Agent or wrapper substitution (approved historian bot, executing
write bot).
* Safety-bypass or interlock-ignore flags set after approval.
5. Existing Solutions and What They Do Not Bind
5.1. IEC 62443, Zones, and Conduits
Zoning answers which hosts may talk. It does not consume single-use
authority for this tag and this value at the I/O server.
5.2. OPC UA, DNP3, IEC 61850, Modbus, MQTT
These authenticate and structure writes. A valid signed call can
still be the wrong act. Modbus in particular is often a raw register
write with no act object at all.
Das Expires 28 February 2027 [Page 5]
Internet-Draft OT Actuation Finality August 2026
5.3. Safety PLC and SIS
SIS is the last physical backstop. It is not an authorization system
for every non-trip command. Most harmful writes never reach a trip
setpoint.
5.4. Jump Hosts, Privileged Access, and MFA
They authenticate the operator session. Possession of the session is
bearer-like for every tag that session can see.
5.5. Change Tickets and Permit-to-Work
A ticket is class approval. It MAY be a PED input. It MUST NOT by
itself be actuation authority for a particular write.
5.6. Robot and ROS Command Buses
A trajectory topic is a write. Auth on the bus does not bind a pose
digest at the motion controller.
5.7. What This Profile Adds
* the write remains an Actuation Candidate Act;
* device, tag, value, mode, and zone are in the digest;
* authority is non-bearer, sink-bound, epoch-bound, and consumed;
* legacy fieldbus remains the transport;
* hot-path envelopes exist so a 20 ms loop is not forced through a
remote ledger.
6. Industrial Applicability
6.1. Transmission and Distribution
Sink is the RTU or gateway that would emit the 61850/DNP3 operate.
Authority for breaker A MUST fail on breaker B. Overflight-like
jurisdiction epochs from the NTN profile are not required; yard and
voltage-level epochs are.
6.2. Process, Refining, and Batch
Sink is the DCS write service or PLC put. Batch recipe download is a
Candidate Act whose digest includes recipe id and unit.
Das Expires 28 February 2027 [Page 6]
Internet-Draft OT Actuation Finality August 2026
6.3. Water, Waste, and Pipelines
Remote pump and valve writes are the classic low-staffing surface.
Envelope ceilings on flow and pressure are load-bearing.
6.4. Discrete Manufacturing and Robots
MES "start job" and robot "execute trajectory" are separate acts. A
job start MUST NOT authorize an arbitrary pose.
6.5. Rail, Tunnel, and Building Life-Safety
Interlocking commands and fire-system overrides are cold-path
default. Timeout MUST NOT actuate.
6.6. OT Copilots and MCP on the Plant LAN
A historian explain tool is INFORMATIONAL. A write tool is this
profile plus [I-D.das-agentic]. Discovery of an MCP server in the
DMZ is not permit-to-work.
6.7. How an Operator Would Pilot
Pick one outbound write API used by a new assistant or by a single
OEM gateway. Deploy consume next to the existing command log. Leave
the dedicated HMI on existing dual control. Measure unauthorized-
would-have-written denies and added latency on the supervised path.
Expand zone by zone. No PLC firmware rewrite is required for v1 if
the gateway is in-line.
7. Terminology
Actuation Candidate Act
A generated or selected write that would change a physical or
safety-adjacent output, but has not been permitted to do so.
Actuation Sink
The last software component that can still refuse before I/O
changes. If that component can be skipped, it is not the sink.
Write digest
Hash over canonical device, tag, value, units, mode, zone, and
interlock flags.
8. Architecture
Das Expires 28 February 2027 [Page 7]
Internet-Draft OT Actuation Finality August 2026
HMI / MES / agent emits write
|
v
ACTUATION CANDIDATE ACT
|
v
Non-Effective State
|
v
Protected Enforcement Domain
principal, zone, device, tag
value envelope, units, mode
interlock / LOTO / PTW inputs
policy and revocation epochs
intended actuation sink
|
v
evidence + scoped authority
|
v
ACTUATION SINK
|
+-- PASS -> drive I/O once, consume
|
`-- FAIL -> no physical change
Figure 1: Actuation-time finality
9. End-to-End Workflow
1. Write constructed. Status NON_EFFECTIVE.
2. Canonicalize device, tag, value, units, mode. Compute write
digest.
3. Build ActuationCandidateAct.
4. PED validates envelope, mode, interlock, PTW, epochs.
5. Fail: deny, do not write.
6. Pass: commit evidence.
7. Issue scoped Actuation Finality Authority.
8. Carry the write on the legacy protocol together with authority
reference.
Das Expires 28 February 2027 [Page 8]
Internet-Draft OT Actuation Finality August 2026
9. Sink verifies live fields immediately before I/O.
10. Atomic consume + actuate, or deny with no I/O.
Value canonicalization MUST include scale and units. 1.5 bar and 150
kPa are the same act only if policy says so before hashing.
expires_at is authority TTL, not process dead-time. A queued write
MUST re-validate mode and interlocks at the sink, not only at queue
entry.
10. Actuation Pseudocode
function ON_WRITE(w, ctx):
act = ActuationCandidateAct{
candidate_act_id: fresh_id(),
act_type: map_write(w),
zone: w.zone,
device_id: w.device_id,
tag: w.tag,
value: canonical_value(w),
units: w.units,
mode: w.mode,
write_digest: HASH(canonicalize(w)),
policy_state: current_epochs(),
freshness: {nonce: fresh_nonce()},
finality_sink: ctx.actuation_sink,
expires_at: now() + short_ttl
}
HOLD_NON_EFFECTIVE(act)
return PED_VALIDATE(act, w)
function PED_VALIDATE(act, w):
if malformed(act):
return DENY(MALFORMED_ACT)
if not fresh(act.freshness.nonce):
return DENY(REPLAY_OR_STALE)
if act.policy_state != current_epochs():
return DENY(EPOCH_MISMATCH)
if w.mode in {LOCAL, LOTO, OUT_OF_SERVICE}:
return DENY(MODE_FORBIDDEN)
if interlock_open(w) and not override_authorized(act):
return DENY(INTERLOCK)
if not ptw_covers(act):
return DENY(PTW_MISS)
if not value_in_envelope(act):
return ESCALATE_OR_DENY(VALUE_ENVELOPE)
evidence = COMMIT_PROTECTED_EVIDENCE(act)
authority = ISSUE_SCOPED_AUTHORITY(act, evidence)
Das Expires 28 February 2027 [Page 9]
Internet-Draft OT Actuation Finality August 2026
return ALLOW(authority)
function ACTUATION_SINK_WRITE(act, authority, live):
live_digest = HASH(canonicalize(live))
if authority missing or integrity_fail(authority):
return DENY(NO_OR_INVALID_AUTHORITY)
if live_digest != act.write_digest:
return DENY(WRITE_SUBSTITUTION)
if authority.sink_id != THIS_SINK:
return DENY(SINK_MISMATCH)
if live.tag != authority.tag or
live.device_id != authority.device_id or
canonical_value(live) != authority.value:
return DENY(FIELD_MISMATCH)
if live.mode != authority.mode:
return DENY(MODE_MISMATCH)
if expired(authority) or consumed(authority):
return DENY(STALE_OR_USED)
ATOMICALLY:
consume(authority)
result = drive_io(live)
record_sink_evidence(act, authority, result)
return result
drive_io() is unreachable when any check fails. A protocol ACK after
a failed check is non-conforming.
11. JSON Interoperability Profile
11.1. ActuationCandidateAct Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "urn:ietf:params:json-schema:ot-finality:candidate-act:1",
"title": "ActuationCandidateAct",
"type": "object",
"additionalProperties": false,
"required": [
"version", "object_type", "candidate_act_id", "act_type",
"created_at", "expires_at", "principal", "zone",
"device_id", "tag", "value", "units", "mode",
"write_digest", "policy_state", "freshness", "finality_sink"
],
"properties": {
"version": { "type": "string", "const": "1.0" },
"object_type": {
"type": "string",
"const": "actuation_candidate_act"
Das Expires 28 February 2027 [Page 10]
Internet-Draft OT Actuation Finality August 2026
},
"candidate_act_id": { "type": "string", "minLength": 16 },
"act_type": {
"type": "string",
"enum": [
"SETPOINT_WRITE", "DISCRETE_WRITE", "PULSE",
"JOG", "BREAKER_OPERATE", "VALVE_STROKE",
"RECIPE_DOWNLOAD", "TRAJECTORY_EXECUTE",
"ENABLE_OUTPUT", "INHIBIT_OVERRIDE", "OTHER"
]
},
"created_at": { "type": "string", "format": "date-time" },
"expires_at": { "type": "string", "format": "date-time" },
"principal": {
"type": "object",
"required": ["principal_id"],
"properties": {
"principal_id": { "type": "string" },
"principal_type": {
"type": "string",
"enum": ["operator", "agent", "mes", "oem", "service"]
},
"agent_id": { "type": "string" },
"workload_id": { "type": "string" }
}
},
"zone": { "type": "string" },
"device_id": { "type": "string" },
"tag": { "type": "string" },
"value": { "type": "string" },
"units": { "type": "string" },
"mode": {
"type": "string",
"enum": [
"REMOTE", "LOCAL", "MANUAL", "AUTO",
"LOTO", "OUT_OF_SERVICE", "TEST"
]
},
"interlocks": {
"type": "object",
"properties": {
"all_clear": { "type": "boolean" },
"ptw_id": { "type": "string" },
"override": { "type": "boolean" }
}
},
"write_digest": {
"type": "object",
Das Expires 28 February 2027 [Page 11]
Internet-Draft OT Actuation Finality August 2026
"required": ["algorithm", "value", "canonicalization"],
"properties": {
"algorithm": {
"type": "string",
"enum": ["SHA-256", "SHA-384", "SHA-512"]
},
"value": { "type": "string" },
"canonicalization": {
"type": "string",
"enum": ["JCS", "implementation-defined"]
}
}
},
"policy_state": {
"type": "object",
"required": ["policy_epoch", "revocation_epoch"],
"properties": {
"policy_epoch": { "type": "integer", "minimum": 0 },
"revocation_epoch": { "type": "integer", "minimum": 0 },
"safety_config_epoch": { "type": "integer", "minimum": 0 }
}
},
"freshness": {
"type": "object",
"required": ["nonce"],
"properties": {
"nonce": { "type": "string", "minLength": 16 },
"sequence": { "type": "integer", "minimum": 0 }
}
},
"finality_sink": {
"type": "object",
"required": ["sink_id", "sink_type"],
"properties": {
"sink_id": { "type": "string" },
"sink_type": {
"type": "string",
"enum": [
"PLC_WRITE", "RTU_OPERATE", "DCS_PUT",
"ROBOT_MOTION", "DRIVE_ENABLE",
"GATEWAY_IO", "OTHER"
]
}
}
}
}
}
Das Expires 28 February 2027 [Page 12]
Internet-Draft OT Actuation Finality August 2026
11.2. Evidence, Authority, Allow, Deny
{
"version": "1.0",
"object_type": "protected_validation_evidence",
"evidence_id": "pve-ot-01",
"candidate_act_id": "act-ot-11aa",
"decision": "ALLOW",
"validated_predicates": {
"mode_remote": true,
"interlocks_clear": true,
"ptw_valid": true,
"value_in_envelope": true,
"epoch_valid": true,
"sink_binding_valid": true
},
"issued_at": "2026-08-27T03:10:00Z",
"protector": { "type": "HSM_MAC", "key_id": "ped-ot-2" }
}
Das Expires 28 February 2027 [Page 13]
Internet-Draft OT Actuation Finality August 2026
{
"version": "1.0",
"object_type": "actuation_finality_authority",
"authority_id": "afa-ot-44",
"candidate_act_id": "act-ot-11aa",
"evidence_id": "pve-ot-01",
"scope": {
"act_type": "SETPOINT_WRITE",
"device_id": "PIC-12",
"tag": "SP",
"value": "8.0",
"units": "bar",
"mode": "REMOTE"
},
"binding": {
"write_digest": {
"algorithm": "SHA-256",
"value": "base64url-write-digest"
},
"nonce": "0A1B2C3D4E5F6789",
"policy_epoch": 21,
"finality_sink_id": "plc-write-cell-a"
},
"lifetime": {
"issued_at": "2026-08-27T03:10:00Z",
"expires_at": "2026-08-27T03:10:05Z",
"single_use": true
}
}
{
"operation": "ActuationSinkVerify",
"decision": "ALLOW",
"consumption": { "authority_id": "afa-ot-44", "status": "CONSUMED" },
"effectuation": { "permitted": true, "io_ref": "w-9021" }
}
{
"operation": "ActuationSinkVerify",
"decision": "DENY",
"error": {
"code": "EF_WRITE_SUBSTITUTION",
"message": "Live value is not the authorized digest.",
"retryable": false
},
"effectuation": { "permitted": false }
}
Das Expires 28 February 2027 [Page 14]
Internet-Draft OT Actuation Finality August 2026
11.3. Complete Allow Transaction
{
"step_1_write": {
"act_type": "SETPOINT_WRITE",
"device_id": "PIC-12",
"tag": "SP",
"value": "8.0",
"units": "bar",
"mode": "REMOTE",
"status": "NON_EFFECTIVE"
},
"step_2_authority": { "authority_id": "afa-ot-44", "single_use": true },
"step_3_sink": { "decision": "ALLOW", "consumed": true },
"step_4_effect": "PIC-12.SP written once at 8.0 bar"
}
12. Load-Bearing Bindings
Authority for PIC-12 / SP / 8.0 bar / REMOTE / digest D1 MUST NOT
authorize 18.0 bar, PIC-13, LOCAL mode, or digest D2. ENABLE_OUTPUT
authority MUST NOT authorize INHIBIT_OVERRIDE. Cell-A sink authority
MUST fail at cell-B.
13. Worked Denials
{
"scenario": "VALUE_SWAP",
"authorized": { "tag": "SP", "value": "8.0" },
"live": { "tag": "SP", "value": "18.0" },
"code": "EF_WRITE_SUBSTITUTION",
"actuated": false
}
{
"scenario": "LOTO_STILL_HUNG",
"mode_live": "LOTO",
"code": "EF_MODE_FORBIDDEN",
"actuated": false
}
{
"scenario": "AGENT_THEN_RAW_MODBUS",
"authorized_sink": "plc-write-cell-a",
"alternate_path": "modbus-tcp:502 raw",
"rule": "if raw path can stroke the same coil it is an open alternate path"
}
Das Expires 28 February 2027 [Page 15]
Internet-Draft OT Actuation Finality August 2026
14. Dual Control, LOTO, and Permit-to-Work
Maker-checker on a write that can kill or spill is industrial
instinct. PED MUST treat missing checker shares as validation
failure. An agent MAY be the maker. An agent SHOULD NOT be the sole
checker for PHYSICAL class above the hot envelope. LOTO and permit-
to-work are mode and evidence inputs, not a reason to skip consume.
A PTW that names unit U MUST fail on unit V even if both are in the
same zone drawing.
15. Informative Protocol Mappings
15.1. OPC UA Write / Call
device_id and tag map to NodeId. value maps to the written
DataValue. mode maps to a companion property or to gateway state.
authority_id MAY travel as an additional argument on a Method call or
as a header on the gateway that fronts UA. UA signature of the
session is channel auth, not act authority.
15.2. DNP3 Select/Operate
Select/Operate is already two-step. This profile still applies:
Operate MUST present current authority for the selected point and
value. A Select that is then Operated with a swapped value is
WRITE_SUBSTITUTION. Replay of Operate after consume is EF-005.
15.3. IEC 61850 Operate
ctlVal and orCat are load-bearing and MUST enter the digest. Test
bits that would become live operate MUST be mode=TEST and MUST not
inherit REMOTE-live authority.
15.4. ROS / Robot Trajectory
A FollowJointTrajectory goal is a TRAJECTORY_EXECUTE act. Digest the
goal points or a hash the controller already computes. Start-job
from MES is a different act_type.
16. Practical Feasibility: Latency and Legacy
Das Expires 28 February 2027 [Page 16]
Internet-Draft OT Actuation Finality August 2026
16.1. Scan-Time Budget
Closed loops run in milliseconds to tens of milliseconds. This
profile is for *supervised writes and agent writes*, not for
replacing the inner PID. Hot-path enforce at a gateway is
canonicalize, hash, MAC verify, compare-and-swap — typically well
under 1-5 ms on the same host as the existing command server. Inner
loop setpoint tracking stays in the PLC. Do not put a network round
trip inside the 10 ms task.
16.2. Hot-Path Envelope
A cold evaluation MAY allow a bounded envelope: zone Z, device set D,
tag family T, value band [lo, hi], mode REMOTE, sink S, epochs (P,R),
until time U. Writes inside the envelope MAY use local validation.
Change of device, band, mode, or epoch MUST escalate. Hot does not
mean skip consume or skip digest compare.
16.3. Coexistence with OPC UA and DNP3
Place the sink immediately before the component that performs the
Operate / Write. Carry authority_id in a companion attribute or
gateway header. Field devices that cannot parse JSON still only see
writes the sink admitted.
16.4. Coexistence with Modbus
Modbus has no act object. The gateway that turns JSON into function-
code 6 or 16 IS the sink. Raw 502 exposure of the same registers is
an alternate path and MUST be closed or listed.
16.5. Coexistence with SIS
Do not move trip logic into PED. If SIS would refuse the physical
state, this profile is irrelevant. If SIS would allow it, this
profile still applies to the supervisory write.
16.6. Coexistence with HMIs
A dedicated hardwired HMI can stay on existing dual control during a
pilot. Alternate-path closure says that if the HMI can emit the same
coil change as the agent path, it eventually needs the same consume
semantics or it remains a listed exception.
Das Expires 28 February 2027 [Page 17]
Internet-Draft OT Actuation Finality August 2026
16.7. What This Profile Does Not Require
It does not require replacing IEC 61850, DNP3, or the PLC vendor. It
does not require a blockchain on the scan cycle. It does not require
the model to detect process hazards. It requires that the component
which can change I/O refuse to do so without current, consumed,
digest-bound authority.
17. Combined Agent Tool Call and Actuation
When the write is born as a model tool call, build AgentCandidateAct
for dispatch and ActuationCandidateAct for I/O. Dispatch allow MUST
NOT drive I/O if the actuation sink denies.
{
"agent_candidate_act": {
"act_type": "TOOL_CALL",
"tool": { "tool_id": "plc.write", "tool_protocol": "MCP" },
"consequence_class": "PHYSICAL"
},
"actuation_candidate_act": {
"act_type": "SETPOINT_WRITE",
"device_id": "PIC-12",
"tag": "SP",
"value": "8.0",
"mode": "REMOTE"
},
"rule": "two sinks: host invoke, then I/O; neither replaces the other"
}
18. OT Threat Catalog
* T1 Stolen jump host or VPN
* T2 Stolen agent seat with write tools
* T3 Injected work-order text
* T4 Value substitution after HMI approval
* T5 Tag / device swap
* T6 Mode ignore (write while Local)
* T7 Replay of a pulse / jog
* T8 Raw Modbus beside the gated API
Das Expires 28 February 2027 [Page 18]
Internet-Draft OT Actuation Finality August 2026
* T9 PTW expiry on a queued write
* T10 Safety-config epoch rollback
* T11 Recipe download to the wrong unit
* T12 Robot trajectory swap
19. Failure Codes
EF-002 NO_FINALITY_AUTHORITY, EF-005 AUTHORITY_ALREADY_USED, EF-006
REPLAY, EF-023 WRITE_SUBSTITUTION, EF-030 MODE_FORBIDDEN, EF-031
INTERLOCK, EF-032 PTW_MISS, EF-033 VALUE_ENVELOPE, EF-040
SINK_MISMATCH, EF-070 ESCALATE, EF-080 FAIL_CLOSED. Timeout MUST NOT
actuate.
20. Implementation Checklist
1. Every supervised or agent write has a consumed authority_id.
2. Digest covers device, tag, value, units, mode.
3. Mismatch is deny, not a log line.
4. Raw protocol paths to the same coil are inventoried.
5. Timeout does not write.
6. Inner PID is not routed through this profile.
7. Added gateway latency is measured.
21. Security Considerations
If the actuation sink holds unrestricted write rights and skips
verification, the profile collapses for that path. Keys that sign
authority SHOULD live off the agent host. Override bits are cold-
path default.
22. Privacy Considerations
Tag names and values can reveal process secrets. Logs SHOULD store
digests and tag identifiers, not continuous process traces, unless
the plant already archives those traces under existing OT policy.
Das Expires 28 February 2027 [Page 19]
Internet-Draft OT Actuation Finality August 2026
23. IANA Considerations
This document requests no IANA actions.
24. Intellectual Property Note
Related concepts appear in the DAS Protocols family, including PCT/
IB2026/055615. Disclosure should follow BCP 79 [RFC8179].
25. Conclusion
Fieldbuses move coils. Agents and MES APIs now write the setpoint.
A signed OPC call, a jump-host session, or a work order is not
authority for this value to become motion on this device now. Bind
the digest. Consume at the I/O sink. A setpoint write is not
actuation.
26. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
[RFC8179] Bradner, S. and J. Contreras, "Intellectual Property
Rights in IETF Technology", BCP 79, RFC 8179, May 2017,
<https://www.rfc-editor.org/info/rfc8179>.
27. Informative References
[I-D.das-6g-finality]
Das, S., "Execution-Finality for AI-Native 5G/6G and
O-RAN", Work in Progress, Internet-Draft, draft-das-ai-
native-6g-execution-finality-01, August 2026,
<https://datatracker.ietf.org/doc/html/draft-das-ai-
native-6g-execution-finality-01>.
[I-D.das-agentic]
Das, S., "Tool Selection Is Not Execution: Finality for
Agentic Tool Dispatch", Work in Progress, Internet-Draft,
draft-das-agentic-execution-finality-01, August 2026,
<https://datatracker.ietf.org/doc/html/draft-das-agentic-
execution-finality-01>.
Das Expires 28 February 2027 [Page 20]
Internet-Draft OT Actuation Finality August 2026
Author's Address
Sangam Das
Independent Inventor
Balasore 756001
Odisha
India
Email: info@sangamdas.com
Das Expires 28 February 2027 [Page 21]