Autonomous agents in critical infrastructure.

A monitoring agent can summarize telemetry, while a controller can change equipment state. The difference is not cosmetic. Authority should specify asset, area, operation, duration and operating mode. Local interlocks and safety systems remain independent of a software authorization decision.

An organization should identify the exact protected command rather than attach a broad “AI allowed” role to a controller. A human operator may need to approve changes outside a narrow automatic envelope.

A control action valid during maintenance can be impermissible during live operation, after a protection alarm or when communications are degraded. The runtime decision should consider current context and define a safe fallback when required signals are missing.

Delegation is equally important: a planning agent may pass a diagnostics task to a child without passing switching or movement authority.

Record intent, authority, policy, decision, operator approval, controller response and observed equipment state separately. A command acknowledgement is not proof of a safe final state. This architecture supports review without replacing domain engineering or asserting a deployment in any particular sector.

Authorization should never be described as replacing an industrial controller’s protective logic. A central service may decide that a task is permitted, but a local controller still needs to enforce safe operating limits and emergency stops. If communications fail, the system needs a documented degraded mode rather than assuming an old approval remains valid forever.

The evidence trail should identify which decisions were made centrally and which were made locally. During an outage, claiming a central service approved an action it never saw would weaken rather than strengthen accountability.

Critical infrastructure covers different environments, but each has an important distinction between analysis and control. A grid agent may recommend load redistribution; a telecommunications agent may suggest a route change; a facility agent may detect a cooling fault. Their authority to issue equipment commands should be defined separately from their authority to observe and recommend.

Identify the asset, command, operator, operating state, maintenance window and local safety rule for a concrete scenario. An authorization service can reject an out-of-scope request, but it does not replace protective relays, industrial interlocks or other domain safety systems. The local executor remains responsible for enforcing its physical limits.

A central service may be unavailable during an incident. The architecture must state which read operations may continue, which commands require a short-lived local grant, and which stop until connectivity returns. An old central approval should not become indefinite permission. Local decisions and their evidence need timestamps and provenance so later synchronization does not imply that the central service saw them in real time.

Test revocation propagation, clock drift, stale telemetry and an operator takeover. Record the requested action, applicable grant and policy, local decision, controller response and observed state separately. These distinctions support accountability without asserting that ProofGrid controls any particular infrastructure deployment.