Authentication, Authorization, and Zero-Trust Boundary

Mutual TLS proves who is calling, scoped RBAC decides what they may do, and every external actor is treated as untrusted until cryptographically identified.

Prove identity, then scope authority

The gateway assumes zero trust: no network location, no prior session, and no claimed identity is believed without proof. Each caller presents a client certificate; mutual TLS establishes a cryptographic identity before any request body is read. Machine-to-machine callers (a grid dispatcher, a fleet controller, a supplier system) hold short-lived certificates issued by the Kronos internal CA and rotated automatically.

Role-based scopes

Identity is necessary but not sufficient. Every action is checked against a role with an explicit scope. A grid operator may read availability and write dispatch setpoints within the certified envelope, but may not read isotope inventory. A regulator may read compliance and byproduct-material records but may write nothing. An isotope customer may place and track offtake orders for their own shipments only.

Rows above are grid operator, isotope customer, regulator, and fleet controller; columns are the coarse permission scopes. Fine-grained policy narrows these further per resource instance.

Authorization decisions are logged with the deciding policy and the caller identity, so any grant or denial is reconstructable. Denials fail closed and are rate-tracked: a caller repeatedly probing scopes it lacks is throttled and flagged to L5 compliance and security monitoring.

Because the write plane can move a real machine, dispatch and actuation-adjacent scopes require the strongest posture: hardware-backed keys, per-command idempotency keys, and clamping against the L1 safe operating envelope. No credential, however privileged, can command the plant outside its certified limits. All of this is exercised today against the digital twin; live certificates and regulator identities are provisioned at commissioning.