When an AI system proposes an action on a live power grid or water-treatment plant, the question is not "is the AI smart?" It is "is this action authorized to reach a physical controller right now?" AUTHREX-ICS-GATE sits at the IT/OT boundary and answers that question: it authorizes the deterministic safety logic, with evidence and a pre-armed rollback, and it never makes the safety decision itself.
Operational technology, the controllers that run power grids, water plants, and pipelines, was built to be deterministic and safe. AI is now being pointed at these systems to optimize and patch them automatically. The danger is obvious: an AI that can write to a live controller at machine speed can also break it at machine speed, and OT failures are physical, a blackout, a contaminated water supply, a pipeline shutdown.
AUTHREX-ICS-GATE is the authority boundary between the AI (in the IT zone) and the controller (in the OT zone). Every action an AI proposes for OT must pass the gate first. The gate verifies the action's provenance (SATA), sets its authority tier by the criticality of the target (HMAA), enforces a human deliberation window for high-consequence writes (FLAME), and pre-arms a rollback before any change reaches the controller (CARA). The same proposed action gets a different outcome depending on what it touches: a write to an isolated test bench may execute autonomously; the same write to a live grid controller drops to a lower tier and requires human confirmation; an action based on a spoofed or untrusted reading is refused at the boundary.
The crucial distinction, and the cleanest claim in the whole framework: ICS-GATE authorizes the safety logic; it does not replace it. The deterministic safety system still makes the safety call. The gate only governs whether the AI's proposed action is permitted to reach that system at all.
A water or power utility can adopt AI-driven optimization without handing an autonomous system unmediated write access to live controllers. The gate guarantees that high-consequence actions slow down for human confirmation and can always be rolled back.
Owners get a boundary that is auditable and fail-closed: if the gate cannot verify an action is authorized, the action does not pass. A spoofed sensor reading is refused rather than acted upon, which is exactly the failure mode that causes physical incidents.
Regulators get a concrete control that maps to existing OT-security expectations (NERC CIP, IEC 62443) and to the new CISA/NSA AI-in-OT principles, expressed as an enforceable gate rather than a policy document.
Critical infrastructure is a designated national-security priority, and the government has just published guidance for exactly this problem.
The CISA/NSA "Principles for Secure Integration of AI in Operational Technology" (3 Dec 2025) calls for safe operating bounds, drift monitoring, and validating outputs before redeployment. ICS-GATE is a concrete reference implementation of those principles as an enforced boundary.
OT failures are not data breaches, they are blackouts and water-supply events that harm the public directly. A gate that refuses unauthorized actions before they reach a controller is a public-safety control, which is the strongest form of national importance.
The gate cross-walks to NIST SP 800-82, ISA/IEC 62443, and NERC CIP, the standards utilities are already held to, so it extends existing compliance rather than replacing it.
Power, water, pipelines, and manufacturing share the same IT/OT boundary problem. One gate pattern serves every critical-infrastructure sector CISA is responsible for.
Pick what the AI is trying to do and what it is trying to touch. The gate sets authority by target criticality and checks the action. A test target may execute autonomously; a live controller requires human handoff; a spoofed or untrusted action is refused at the boundary. Illustrative simulation of the boundary logic, not operational validation.
Every AUTHREX application shares one verified core. The HMAA authority state machine is specified in TLA+ and exhaustively model-checked: 48,751 reachable states verified, with 8 of 9 safety properties holding (no skip-ahead, monotonic downgrade, no zombie tier, among them). The ninth, the MAIVA CriticalSafe invariant, is flagged as a known violation in the issue register rather than hidden, which is the honest state of the work. The model checker also caught a real S5 view-change regression during development, evidence the method finds defects rather than rubber-stamping them.
Federal anchors: CISA/NSA "Principles for Secure Integration of AI in Operational Technology" (3 Dec 2025); NIST SP 800-82; ISA/IEC 62443; NERC CIP.