⚡ Critical infrastructure
Critical Infrastructure
"Control state" means the declared operating mode (automatic or manual), the active alarm thresholds, the planned fallback mechanisms, and any human overrides - often distributed across several connected systems, not a single localized action. After a disruption, the question rarely concerns a single event: it concerns whether and how that state changed over time.
After a service disruption or security incident, can an independent examiner reconstruct which AI-generated signal, which control state, which configuration, and which human intervention governed the system at the relevant moment - and whether that state changed during the event?
Capabilities
● Standard Intake
● ESB Buffer
● External Artifacts
⚓ EVIDE ANCHOR
Without EVIDE
- Available logs document sensor observation, not the state of the control decisions that preceded it
- No independent way to establish which configuration version was active at the time of the incident, distinct from versions modified afterward
- A human override exists as an entry in an internal operational log, with no declared authority or structured rationale
- It cannot be established whether the control state remained constant during the event or changed without the change being tracked separately
With EVIDE
- The declared control state - operating mode, active thresholds, available alarms, planned fallback - is anchored at the moment it is declared
- The configuration in effect at the relevant moment is identified by reference (configuration_reference), distinguishable from earlier or later versions without having to anchor the entire configuration
- Active thresholds and available alarms are themselves external references, not free strings dependent on a single vendor's internal naming
- A human override, when declared, carries its own authority object distinct from that of the control system. If the control state changes during the event, each declared transition remains a separate, reconstructable element
Key evidentiary questions for critical infrastructure
After a disruption or security incident, can these questions be answered independently?
- 1 Which system and which specific component were involved in the event?
- 2 Which configuration (configuration_reference) was declared active at that moment?
- 3 Which control mode (automatic, manual, mixed) was declared operative?
- 4 Did the control state change during the event, with each transition tracked separately?
- 5 Were alarms available that did not produce an intervention - and do they remain documented as such, through a verifiable reference?
- 6 If a human override is declared, does it carry an authority distinct from that of the control system?
- 7 What external dependencies are declared as relevant to the event?
- 8 Which elements of the control state remain unverifiable with the available data, including oscillations between one anchored declaration and the next?
Example evidentiary record for critical infrastructure
A real, API-conformant payload example - verified against the EVIDE intake schema v2.1.
{
"evide_schema": "2.1",
"source_system": "GridControlPlatform",
"source_reference": "EVT-2026-0703-1145",
"source_timestamp_utc": "2026-07-03T11:45:20Z",
"decision": {
"type": "control_state_transition",
"status": "finalized",
"closure_timestamp_utc": "2026-07-03T11:52:08Z",
"summary": "Declared control state transition closed following automated threshold breach and manual bypass"
},
"authority": {
"id": "grid_control_system_A",
"role": "Autonomous Grid Control Agent",
"dapi_number": "DAPI-XXXX",
"verification": "DAPI-XXXX"
},
"control_state": {
"operating_mode": "automatic",
"configuration_reference": "https://example.org/configs/grid-sector-7-config-v3.4",
"active_thresholds_reference": "https://example.org/thresholds/grid-sector-7-alarm-thresholds-v2.1",
"available_alerts_reference": "https://example.org/alerts/grid-sector-7-available-alerts-20260703",
"fallback_declared": "manual_bypass_procedure_C",
"state_changed_during_event": true
},
"human_override": {
"is_declared": true,
"authority": {
"id": "control_room_operator_09",
"role": "Certified Grid Control Operator",
"dapi_number": "DAPI-YYYY",
"verification": "DAPI-YYYY"
},
"override_timestamp_utc": "2026-07-03T11:52:08Z",
"declared_rationale": "Manual bypass activated following declared threshold breach on sector 7 feeder"
},
"intervention": {
"type": "declared_event",
"classification_status": "stable",
"classification_context": {
"taxonomy_reference": "https://example.org/taxonomies/critical-infrastructure-control-state-taxonomy-v1.0",
"threshold_reference": "https://example.org/policies/grid-anomaly-response-policy-v1.1",
"threshold_status": "met"
},
"rationale": "Control state transition declared following automated threshold breach and manual bypass",
"trace": {
"reference": "GRID-007/sector-7-event-20260703",
"access": "restricted"
}
},
"human_oversight": {
"is_declared": true,
"declared_level": "L1"
},
"handoff": {
"boundary_readiness": {
"status": "candidate",
"readiness_gate": null,
"visibility_surface": null,
"unresolved_signals": []
},
"reconstruction_independence": "declared",
"submission_status": "not_submitted",
"acceptance_status": "not_claimed"
},
"extensions": ["evidence_references"],
"evidence_references": [
{
"artifact_type": "scada_log",
"pointer": "scada-historian://sector-7/log-20260703-1145.csv",
"declared_origin": "SCADA historian export",
"declared_description": "Control system log covering the threshold breach and manual bypass",
"hash": {
"algorithm": "SHA-256",
"value": "sha256:5e19b8...f204_example_not_for_submission"
},
"hash_scope": "full_file",
"hashed_by": "SCADA historian export tool"
}
],
"content_hash": {
"algorithm": "SHA-256",
"value": "sha256:8c94...b103_example_not_for_submission"
}
}
Verified Identity
DAPI-verified identity for the operator behind each override
When an automated control system's declared state is overridden by a human operator, the identity behind that override matters as much as the rationale itself. An internal operator ID declares who acted, but does not confirm it. The authority in the record above carries its own DAPI-verified identity - closing the gap between "an override was declared" and "we know the operator behind it was real".
DAPI Identity Certification ↑What EVIDE does not claim
EVIDE does not determine whether the underlying decision was correct, whether applicable procedures were followed, or whether the outcome was legally justified. It documents the evidentiary conditions that remain independently examinable after the event.
EVIDE anchors declared snapshots of the control state at the moments they are declared - not continuous telemetry. The state of the system between two anchored declarations remains out of scope by design, not as a technical limitation to be closed: an industrial anomaly is a dynamic event, and an anchored snapshot does not prove what the state was a second before or after, nor does it capture transient oscillations between two declarations.
⚠️ Time synchronization between independent source systems may require separate examination. EVIDE anchors declared snapshots of the control state at the moments they are declared - not continuous telemetry; the state between two declarations remains out of scope by design.
New
⚓ Example evidentiary record with EVIDE ANCHOR
The declared control_state above is a snapshot at the moment of a transition. EVIDE ANCHOR complements it with a distinct kind of statement: the operational perimeter a control agent was authorized to operate within, declared before any transition occurred.
{
"evide_schema": "2.1",
"source_system": "GridControlPlatform",
"source_reference": "EVT-2026-0703-1130",
"source_timestamp_utc": "2026-07-03T11:30:00Z",
"decision": {
"type": "operational_perimeter_declaration",
"status": "finalized",
"closure_timestamp_utc": "2026-07-03T11:30:00Z",
"summary": "Autonomous bypass authority declared for sector 7 grid control agent ahead of shift"
},
"authority": {
"id": "grid_ops_lead",
"role": "Grid Operations Lead",
"dapi_number": "DAPI-XXXX"
},
"intervention": {
"classification_context": {
"threshold_status": "not_defined"
}
},
"handoff": {
"boundary_readiness": {
"status": "candidate",
"readiness_gate": null,
"visibility_surface": null,
"unresolved_signals": []
},
"reconstruction_independence": "declared",
"submission_status": "not_submitted",
"acceptance_status": "not_claimed"
},
"extensions": ["declarations"],
"declarations": [
{
"declaration_type": "privilege_scope",
"declared_value": "autonomous manual-bypass authority, sector 7 feeder only",
"declarant": "grid_ops_lead",
"declared_at": "2026-07-03T11:30:00Z",
"authority_source": {
"declared_attribution_status": "attributed"
}
},
{
"declaration_type": "prohibited_operations",
"declared_value": "no bypass authority extends beyond sector 7; adjacent sectors require separate declaration",
"declarant": "grid_ops_lead",
"declared_at": "2026-07-03T11:30:00Z"
}
]
}
The scope of authority and its explicit boundary kept as two separate Declarations, consistent with the Atomic Declaration Rule. This declared perimeter existed before the threshold breach in the example above - it does not certify the later control_state transition was correct, only that this authority scope was stated, by whom, and when.