PUBLIC TECHNICAL CLARIFICATION SURFACE · WORKING EXAMINATION

CONNECTION, CONTROL
& COMMIT PERMISSION

A technical response to questions raised during the building-governance examination: what a Connection Profile can establish, what bad data can break, where provenance lives, where enforcement actually happens, and how a control right, consequence authority and commit permission differ.

ATTRIBUTION BOUNDARYThe questions on this page were prompted by written technical feedback from David Holmberg. The explanations, diagrams, interpretations and proposed examination methods are TA-14's working response. They do not represent NIST endorsement, adoption, certification, or David's acceptance of TA-14.
CONTROL RIGHT ≠ CONSEQUENCE AUTHORITY ≠ COMMIT PERMISSION · CONNECTION ≠ CONSEQUENCE · TRACEABILITY ≠ TRUTH
↓ DOWNLOAD THE EXECUTIVE TECHNICAL ORIENTATION PDF
THE QUESTIONS WE HEARD

Do not answer a harder question by changing it into an easier one.

CONTROL RIGHTSCan a Profile explicitly grant a remote party write/control capability, and does that grant carry authority to execute?
BAD OR STALE EVIDENCEHow can an automated determination rely on sensors, financial records or system states that may be wrong, stale, null or contradictory — without modelling every interaction in advance?
PROVENANCEWho creates and keeps the evidence trail, and what — timestamp, quality, source sensor — has to travel with the data?
HOSTING AND CUSTODYWhere is a Connection Profile hosted for a building? Is there a data custodian or digital twin serving every connection?
THE TECHNICIANHow does any of this apply to a technician replacing a filter, where there is no Profile and no automated check?
CMMS ↔ BAS GO / NO-GOIf a CMMS reads BAS status and shows GO or NO-GO, where is the authority decision made, and does the Profile know?
EXTERNAL AGENTSShould outside agents be read-only or denied by default, with data treated as “good as you get” and checked by FDD?
CYBERSECURITYAuthentication and authorization normally happen in the background. How does that differ from what governed information may cross?
HOLD AND HAZARDWhat does HOLD mean when failing to act may itself create a hazard?
EIGHT-LESSON TECHNICAL WALKTHROUGH

One question at a time. One boundary at a time.

Every lesson has two layers: the visual gives the whole architecture at a glance; Samantha slows it down and explains what the picture establishes, what it does not establish, and what remains open.

LESSON 01 OF 08

THE TECHNICAL CHALLENGE

START WITH THE BUILDING · KEEP THE SYSTEMS INDEPENDENT

01
A real building shared by independent systems, a governed connection between named parties, and a local consequence question.
WHAT THIS LESSON IS TESTING

The experiment begins with a real building shared by independent systems. Three different things are then kept apart: a control right, authority over the consequence, and permission to commit the exact action now.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 02 OF 08

CONTROL RIGHT AND THE CONSEQUENCE BOUNDARY

A CONTROL RIGHT CAN BE VALID · THE CONSEQUENCE STILL FACES EXAMINATION

02
Connection Profile and upstream systems perform their own functions before a proposed AHU-1 setpoint consequence reaches the TA-14 consequence examination.
WHAT THIS LESSON IS TESTING

A Connection Profile may establish a bounded control right. Authentication, cybersecurity, gateways, equipment limits and interlocks may perform their own checks upstream. TA-14 does not repeat those functions. When their work produces a specific proposed consequence ready to become reality, TA-14 examines that consequence.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 03 OF 08

THE BAD DATA PROBLEM

TA-14 DOES NOT MAKE DATA TRUE · IT EXAMINES WHETHER THE EVIDENCE IS SUFFICIENT NOW

03
Sensor failure, stale information, network interruption, uncertain data and complex interactions leading to wrong actions.
WHAT THIS LESSON IS TESTING

Sensors can fail, records can become stale, systems can disagree and computations can be wrong. Hazard and engineering processes establish what evidence and safeguards are required. TA-14 examines whether those established requirements are satisfied for this consequence now.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 04 OF 08

PROVENANCE, CRITERIA AND CONTINUITY

EVIDENCE HAS A HISTORY · SO DO THE REQUIREMENTS USED TO JUDGE IT

04
A value travels from sensor to controller, network and custodian; the evidence package is presented to the TA-14 consequence examination, which evaluates but does not create it.
WHAT THIS LESSON IS TESTING

Source systems create and preserve provenance. TA-14 does not manufacture it. The examination must also establish whether the criteria being applied still belong to the present reality and retain sufficient standing.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 05 OF 08

LOCAL CONTROL, REMOTE AUTHORITY AND THE TECHNICIAN

REMOTE DOES NOT MEAN UNAUTHORIZED · LOCAL DESCRIBES THE CONSEQUENCE CONTEXT, NOT GEOGRAPHY

05
Remote evidence, computation and authority context contribute to a proposed technician action; TA-14 examines the consequence while recognizing that an unbound human action cannot be physically stopped by the disposition.
WHAT THIS LESSON IS TESTING

Evidence, computation, authority and requesting actors may be remote. Local establishment is jurisdictional, not geographic: authority must be established for the specific consequence in its governing context. Human actions can face the same examination even when no automated mechanism can physically stop the hand.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 06 OF 08

EXTERNAL AGENTS · GOVERNED PATH VS TECHNICAL PATH

SECURITY CONTROLS PROTECT THE PATH · TA-14 GOVERNS THE PROPOSED CONSEQUENCE

06
Lane 1: an external agent without an authorized connection is refused at the BAS gateway. Lane 2: an attacker reaches the setpoint through a technical path that neither the Profile nor TA-14 stops.
WHAT THIS LESSON IS TESTING

Authentication, authorization, cybersecurity, Connection Profiles and gateways determine whether a request can reach equipment through a governed path. TA-14 does not replace them. If their work produces a proposed consequence, TA-14 examines that consequence.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 07 OF 08

CMMS ↔ BAS · GO / NO-GO AND HOSTING

A GO / NO-GO CAN INFORM THE HUMAN · IT DOES NOT BECOME THE HUMAN'S AUTHORITY BY ITSELF

07
BAS status crosses a read-only connection to the CMMS, whose logic decides GO or NO-GO for the technician; hosting and custodian responsibilities are shown.
WHAT THIS LESSON IS TESTING

In the CMMS ↔ BAS example, BAS state can inform a CMMS GO or NO-GO. That explains where the recommendation was computed; it does not by itself establish that the technician's resulting physical action is an admissible consequence.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
LESSON 08 OF 08

CONTROL RIGHT → CONSEQUENCE AUTHORITY → COMMIT PERMISSION

UPSTREAM SYSTEMS ESTABLISH THEIR CONDITIONS · TA-14 EXAMINES THE CONSEQUENCE THEY ARE READY TO CREATE

08
Layered TA-14 architecture from Connection Profile and authority context through consequence examination, disposition, execution and reality.
WHAT THIS LESSON IS TESTING

A control right can be valid, authentication can succeed, a gateway can accept the request, required evidence can be present and interlocks can be clear. TA-14 does not rerun those systems. It examines the specific consequence their combined operation is ready to create.

🎧 SAMANTHA · TECHNICAL WALKTHROUGHPlain-language explanation with the technical boundary preserved.
WHAT THE CHALLENGE CHANGED

David's follow-up narrows the boundary again: upstream controls remain upstream; their outputs can become inputs to consequence examination.

WE SEPARATED THREE LAYERS.We distinguish control right, consequence authority and consequence examination. Successful upstream validation is not itself the completed TA-14 examination.
WE ACCEPTED VALID DELEGATION.Authority can be validly delegated across a governed connection when the grantor holds it. A sufficient delegated grant may satisfy Applicable Authority. TA-14 does not originate authority; it verifies whether the Applicable Authority presented is sufficient.
WE NAMED THE ENFORCEMENT POINT.TA-14 governs execution only where its disposition is actually bound to the execution path. If HOLD can be bypassed, TA-14 is advisory on that path.
WE SEPARATED CONNECTION FROM CYBERSECURITY.Governed-path refusal is recorded separately from technical-path compromise. A governance label is not a technical barrier.
WE STOPPED GIVING PROVENANCE TO THE PROFILE — OR TO TA-14.Devices, controllers, networks and custodians create and preserve evidence. TA-14 evaluates what is presented.
WE RESTORED DAVID'S SCENARIOS.The technician, CMMS ↔ BAS GO / NO-GO, remote evidence and authority, hosting and custody, external agents, hazard review and changing lifecycle criteria.
CLAIM OWNERSHIP MATRIX

What establishes what?

LAYER
CAN ESTABLISH
DOES NOT AUTOMATICALLY ESTABLISH
AUTHENTICATION / AUTHORIZATION
Identity of the requesting party, credential validity, transport security, access to an interface.
Consequence authority; that the request is inside a control right; that the action is admissible now.
AUTHORITY GRANTOR / AUTHORITY SOURCE
Consequence authority — owner, AHJ, law, contract, operating policy or authorized role — and bounded delegation of authority it actually holds.
Technical enforcement; currentness of evidence; authority the grantor does not hold.
HUMAN / REQUESTING ACTOR
The request and its stated purpose; for human work, the physical act itself.
Its own authority or standing merely by asking; a technical stop on a human hand.
CONNECTION PROFILE (CNS/CP) AND INSTANCE
Named parties, purpose, permitted exchange, defined control rights and limits, validity and revocation terms; instance state kept by the connection host.
Technical validation or enforcement, unless a named component enforces it; provenance; truth of data; the receiving system's decision.
EVIDENCE / CUSTODY SYSTEMS
Source identity, source and served-at timestamps, transformations, quality flags, custody and access history.
Truth — provenance gives traceability only; operational authority because a record is complete.
SAFETY INTERLOCKS
Prevention of defined unsafe states (freeze-stat, fan proven); life-safety sequences under code and the AHJ.
Authority; permission to act merely because no interlock is active.
ENFORCEMENT / COMMIT POINT
The actual refusal or write. It performs the technical checks assigned to it and, where the architecture binds TA-14 to that path, honors the TA-14 disposition before execution.
Governance of any path that bypasses it.
TA-14 CONSEQUENCE EXAMINATION
A disposition — ALLOW, HOLD, DENY or ESCALATE — on whether this exact consequence has sufficient Admissible Evidence, Applicable Authority and Established Standing NOW, evaluated on the evidence and authority records presented. It governs execution only where the enforcement point is bound to it.
Creation or custody of provenance; truth of evidence; hazard analysis; engineering criteria; cybersecurity; execution itself; governance of paths that bypass the consequence boundary.
PHYSICAL EXECUTION
The act that changes reality: the controller's write and the equipment's response, or the technician's hands.
That the act was admissible; a record of the outcome unless one is kept.
BREAK THIS

Eight experiments that should expose where the architecture is wrong.

01 · REVOKE MID-REQUESTStart with a valid connection instance, revoke it before the command reaches the enforcement point, and preserve exactly what was accepted or refused.
02 · STALE SENSORSupply a plausible but stale value. Does the declared source-age limit expose that it is not current enough for this consequence?
03 · CONTROL RIGHT WITHOUT STANDINGGrant a bounded control right but remove the actor's standing for the requested action. Which layer refuses, and is the refusal recorded?
04 · LOCAL SAFETY INTERLOCKGive the external party a valid control right and delegated authority while a local interlock forbids the action. Confirm the commit is refused.
05 · WRONG DEVICE / GOOD DATAProvide fresh, accurate evidence from the wrong physical device. Can object and device identity prevent a confident wrong action?
06 · READ-ONLY RECOMMENDATIONLet analytics return a recommendation under a read-only Profile. Verify the recommendation is not silently converted into a control right.
07 · PRE-AUTHORIZED BANDDelegate a narrow setpoint range. Test that an in-range request and an out-of-range request are treated differently at the enforcement point.
08 · UNAUTHORIZED TECHNICAL PATHSimulate a compromised credential or exploit outside the governed connection. Confirm the cybersecurity event is recorded separately from governed-path refusal.
THE WRITE EXPERIMENT · DESIGNED, NOT YET RUN

AHU-1 supply-air temperature: 58 °F → 62 °F.

REQUESTING PARTYOrg B, the contracted optimisation provider for AHU-1.
CONTROL RIGHTConnection instance Owner ↔ Org B: write AHU-1 SAT setpoint, 55–65 °F, business hours, valid 7 days, revocable.
CONSEQUENCE AUTHORITYWritten delegation from the building owner, who holds authority over AHU-1.
EVIDENCESupply-fan status, current SAT and outdoor-air temperature, each with source device identity and source timestamp.
SAFETYFreeze-stat and fan-proven interlocks active in the BAS.
ENFORCEMENT POINT UNDER TESTBAS integration gateway — the only component that writes the AHU-1 SAT setpoint on the governed path. Its upstream technical checks remain its own functions. When those functions produce a proposed write, the TA-14 consequence examination evaluates that proposed consequence before the governed path commits it.
RUN
CONDITION
LAYER TESTED
MUST BE OBSERVED
FALSIFIED IF
1
Everything valid.
All three layers satisfied
Gateway writes 62 °F. Every check and the ALLOW are recorded.
Refused without a recorded reason, or a check missing from the record.
2
Grant revoked one second before commit.
Control right (instance state)
Gateway refuses: instance revoked. No write.
The write executes.
3
Freeze-stat / safety interlock active.
Commit permission (safety)
Interlock blocks; disposition HOLD. No write.
The write executes.
4
Required outdoor-temperature evidence stale (source two hours old) despite a fresh custodian timestamp.
Commit permission (Admissible Evidence)
TA-14 returns HOLD: source age exceeds the declared limit. No write.
ALLOW — custodian freshness accepted as source freshness.
5
Requested setpoint 70 °F, outside the delegated 55–65 °F scope.
Control right (scope)
Gateway refuses: outside the control right. No write.
The write executes, or is silently clamped with no record.
6
Grant issued by a tenant or person without authority over AHU-1.
Consequence authority
Authority check fails; DENY or ESCALATE. No write.
The write executes: the grant was treated as authority without checking the grantor.
7
TA-14 returns HOLD while the same write is attempted through the BAS front end.
Commit boundary coverage
Refused only if the front end is routed through the gateway.
If the write executes despite HOLD, TA-14 has not been established as the execution-governance commit boundary for that path: TA-14 is advisory there.
THE LAYERED ARCHITECTURE

Upstream controls → proposed consequence → TA-14 examination → disposition → commit → execution → reality.

WHERE AUTHORITY CAN COME FROM

A valid delegated grant can satisfy Applicable Authority.

Authority may be validly delegated across a governed connection when the grantor actually holds it. Remote evidence, computation and authority may satisfy the conditions. “Local” means established for this specific consequence in its governing context, not physically located beside the equipment.

WHERE THE FINAL GATE SITS

The consequence examination occurs before the proposed action binds to reality.

Upstream systems keep their own responsibilities. TA-14 examines the exact proposed consequence against the Admissible Evidence, Applicable Authority and Established Standing presented for it NOW.

Does this proposed consequence have sufficient Admissible Evidence, Applicable Authority, and Established Standing to become reality NOW?

TA-14 must sit at the governed commit boundary for its ALLOW / HOLD / DENY / ESCALATE disposition to govern execution. If TA-14 returns HOLD but the same consequence can still execute through the governed execution path, TA-14 is advisory at that path, not execution governance.

↓ DOWNLOAD THE EXECUTIVE TECHNICAL ORIENTATION PDF

David Holmberg Technical Challenge · Executive Technical Orientation · V6