Cybersecurity and the Zero-Trust Boundary

L7 hardens the single external door with zero-trust identity, strict segmentation, and physics-limited authority, so no external compromise can drive the machine unsafely.

The boundary is the defense

Concentrating all external interaction at one gateway is a security decision as much as an architectural one: there is a single boundary to harden, monitor, and reason about. L7 treats every external actor as untrusted (zero trust): identity is proven cryptographically per request, authority is scoped narrowly, and no network position confers privilege. A compromised credential is contained by its scope, and even full scope cannot exceed plant physics.

Defense in depth

• Identity: mutual TLS, short-lived certificates, hardware-backed keys for writes
• Segmentation: external gateway isolated from L1 control and L3 twin networks
• Least privilege: narrow role scopes, deny by default, per-resource policy
• Physics limit: every write clamped to the certified safe operating envelope
• Observability: tamper-evident audit trail on every action

The most important control is the last resort: the safe operating envelope. Even an attacker with a valid dispatch credential cannot command the burner above its certified extraction limit or perturb the breeder outside its equilibrium bounds, because L1 clamps every intent against the twin-certified envelope and the autonomous hardware failsafe remains authoritative. Cybersecurity here is backed by physics, not only by software.

# every external write passes identity, scope, THEN physics
def guarded_write(req):
    ident = mtls_identity(req)               # zero-trust identity
    require_scope(ident, req.action)         # least privilege
    cmd = validate(req)                       # schema, idempotency
    cmd = clamp(cmd, certified_envelope(req.unit))  # physics limit
    return L1.stage(cmd)                      # failsafe still authoritative

Segmentation keeps the blast radius small. The external gateway sits in its own network zone with no direct route to the high-rate control networks; it communicates with internal services through narrow, validated interfaces. A breach of the gateway does not grant a path to actuation, only to the same scoped requests any authenticated client could make, all still envelope-clamped.

Aegis defense installations raise the bar further: their telemetry and models stay local under fleet learning's federated pattern, and their external exposure is minimized. Security posture is validated today against the twin and adversarial testing, so the boundary is proven before it protects operating hardware from FOAK ~2030.