Separation of Duties and Two-Person Control

Consequential actions require two people in distinct roles, so no single credential holder can move the machine to a high-consequence state or bypass safety alone.

Splitting authority on purpose

Separation of duties (SoD) divides a sensitive operation so that completing it needs more than one person, and the parties hold different roles. Kronos applies it to the operations whose misuse would matter most: authorizing a cross-boundary import, changing a control policy, disabling a maintenance interlock, or committing a new model to the control plane. One person proposes; a second, in a different role, must approve before the action executes.

Two-person rule for the machine

For actions that touch the physics envelope - raising a field toward the breeder's 16.84 T peak or adjusting the burner's 26.49 T plug regime in commissioning - the two approvers must be independent (an operator and a physics-authority role), and the request is time-boxed. Neither approver's credential alone advances the state.

# Enforced two-person authorization for consequential actions
def authorize(action, approvals):
    roles = {a.role for a in approvals if a.valid()}
    need  = policy.required_roles(action.kind)   # e.g. {'operator','physics'}
    if not need.issubset(roles):
        return DENY('missing distinct roles')
    if len({a.identity for a in approvals}) < 2:  # must be two people
        return DENY('single individual')
    if action.expired():
        return DENY('window closed')
    audit(action, approvals)                       # both identities logged
    return ALLOW

Why it defeats several threats at once

• A single malicious insider cannot act alone - see insider-threat model.
• A single stolen credential is insufficient for high-consequence actions.
• The dual approval and both identities enter the lineage, making collusion attributable.
• It gates the air-gap bridge so imports cannot be a solo act.

Design status

The authorization engine, role model, and two-person enforcement run in the twin/staging environment. The mapping of roles to actual plant staff and the physical control-room procedures are defined for FOAK operation and not yet in live use.