MAKE THE BUILDING PROVE IT

Begin with the real building. The purpose of this experiment is not to make one platform control everything. It is almost the opposite. We want several independently governed systems to understand the same building, exchange only the information they are permitted to exchange, and still keep their own ownership, responsibilities, data, and authority. ONUMA / RE1 provides the building reality for the experiment: persistent identities, spatial and semantic context, system relationships, and access to machine-readable building information. CNS/CP gives us a way to describe the governed connection between named parties. FAHA / CapControl contributes independently established asset and lifecycle evidence. Building automation, security, maintenance, energy, and other systems continue to operate in their own domains. TA-14 does not replace any of those systems. Its specific role comes later, when a receiving domain asks whether a particular proposed consequence is sufficiently supported now. The experiment is intentionally designed around separation. Shared information does not mean shared ownership. Interoperability does not mean centralization. Connection does not mean authority. The technical question is whether we can make those boundaries observable enough to test.

This is the core of the Connection Profile idea. Two named parties in different organizations connect under a named Profile for a stated purpose. The Profile is not a hidden gateway that makes downstream decisions for either party. It is the contract the parties connect under. It defines the properties of the connection and therefore what is permitted to cross through that connection. One side may send information, the other side may return information, and the connection remains in force until it expires or one side revokes it. The important discipline is to stop CNS/CP where CNS/CP stops. It does not establish that evidence is admissible. A Profile may carry evidence of bounded rights or a valid delegation when those terms come from parties with authority to grant them, but the Profile does not itself establish that the exact proposed consequence has sufficient Applicable Authority. It does not decide standing or what a receiving building must do with the information. Those are questions for the appropriate governed domains. In this experiment, the Connection Profile is valuable precisely because it lets independent parties exchange defined information without forcing either party to surrender its independently governed responsibilities or become part of a single master system.

Now we turn the Connection Profile into an observable exchange. ONUMA / RE1 can expose persistent building identifiers, spatial context, semantic relationships, and defined operational information that the Profile permits. A receiving domain can use those identifiers to understand which real building object the information refers to. It can then return its own independently owned information under the connection. The key is that the connection does not erase ownership. ONUMA still owns its building context. The receiving domain still owns the findings it creates. The Profile does not make one database authoritative over the other. It narrows the exchange to what the parties have agreed may cross. This is also where revocation matters. If the connection is revoked, the exchange ends. That connection state must be recorded separately from any local decision made using information that crossed earlier. This separation gives us something concrete to examine: what crossed, under what Profile, when, between which named parties, and what did not cross.

This layer matters because a building component and a financial asset record are not always the same thing. ONUMA may identify AHU-1 as a precise physical component in the building. The owner’s fixed-asset register may capitalize that equipment as part of a larger HVAC system, a building improvement, or a project placed in service as a group. If we fail to map those identities correctly, the systems may appear connected while the financial or lifecycle evidence is actually attached to the wrong accounting unit. FAHA / CapControl therefore contributes more than raw data. It evaluates whether the asset record is complete, reconciled, physically verified, and current as of a stated date. It can contribute lifecycle status, warranty information, ownership or lease context, responsible cost center, financial context, and findings history with superseded findings preserved. What it does not contribute is permission to execute a building action. Financial approval history may be important authority context, but capital approval is not automatically operational authority. That distinction is exactly why the domains stay separate.

This image is about one of the most important design rules in the experiment: independence survives interoperability. A building automation system may own operational points and sequences. A maintenance system may own work orders and service history. A security system may own access events and camera information. An asset domain may own its findings and lifecycle analysis. ONUMA / RE1 may provide the persistent building identity that lets those records refer to the same physical thing. A governed connection allows defined information to move among those domains, but no system becomes the master of the others. That matters for cybersecurity, accountability, and trust. If one system could silently inherit another system’s authority merely because data crossed between them, interoperability would create a new attack surface. The safer model is explicit: information may cross under defined terms; system control remains independently governed; authority may be presented through a valid applicable source or bounded delegation; no system silently inherits authority merely because information or capability crossed a connection; and every system remains responsible for the claims it makes.

Now we scale the experiment. Real buildings are ecosystems, not single applications. Different systems know different things for different reasons. ONUMA / RE1 gives the ecosystem persistent building identity and context. CNS/CP gives named parties a governed way to connect and define what may cross. FAHA / CapControl contributes asset and lifecycle evidence. BAS, CMMS, security, energy, and other systems contribute their own operational information. The objective is not to centralize these systems. It is to make their relationships inspectable. A useful interoperability result should let us answer: which system produced this fact, what object does it refer to, when was it current, under what connection did it cross, and what authority—if any—does the receiving system actually have to use it for a consequential action? This is where the experiment becomes relevant to cybersecurity. A trusted data path is necessary, but it is not the same thing as a trusted execution path.

This is where the architecture has to prove that it can handle real variation. The same building may be involved in an authorized exchange, an expired or revoked connection, or an unauthorized external attempt. The persistent building identities may be the same, but connection state and party authorization are not. CNS/CP defines the connection and what may cross. The parties act under those terms. If a valid connection is in force, permitted information may cross and a downstream local consequence examination may later be reached if a proposed consequence is received. If the connection has expired or been revoked, the exchange stops at the connection boundary. If an unauthorized actor attempts to connect, no authorized connection is established and no information crosses through that path. In both stopped cases TA-14 is not reached; there is nothing for TA-14 to HOLD, DENY, ALLOW, or ESCALATE. This distinction is central to the cyberattack experiment: a connection-layer failure must remain a connection-layer result rather than being misrepresented as a downstream TA-14 decision.

The final image joins the pieces without pretending they are one architecture owned by one organization. ONUMA / RE1 provides the persistent building reality and shared identities. CNS/CP governs connections between named independent parties and defines what may cross. FAHA / CapControl and other independent systems contribute evidence, findings, status, or context from their own domains. Those contributions can travel and reconnect around the same building object without silently creating or inheriting authority. Any claimed delegation of authority remains evidence to be examined for applicability and sufficiency for the exact proposed consequence. Only after that upstream context exists does TA-14 perform its specific function: examining whether a proposed consequence has sufficient Admissible Evidence, Applicable Authority, and Established Standing to become reality now. Even an ALLOW determination is not the physical act. Binding, Commit, Execution, and Outcome remain distinct. The workshop question is therefore not whether one coalition member should control the whole system. It is whether the independent seams can be made explicit, testable, revocable, traceable, and resistant to assumptions. If an existing mechanism already performs one of these functions, the correct result is to map the overlap. If a gap remains, the experiment should show exactly where it is.