1. The cowboy who needed a contract
William Gibson’s Neuromancer returns as the recalled work because its console cowboys operate in a world where access is everything: the right credentials open doors, the wrong ones trigger countermeasures, and the boundary between authorized and unauthorized action is enforced by the system itself. The desktop needs the same discipline for its maneuvers: autonomy within a signed contract, with automatic sanctions for breach.
Entries 681 through 683 wondered about autonomous trust boundaries, command authorization policies, and what the capability needs from the desktop. This entry closes the arc.
2. What was learned
The autonomous trust boundaries and secure maneuver authorization wondering gives the desktop four constraints:
- Autonomy must be policy-bounded, not open-ended. Ground sets the envelope; the platform executes within it.
- Cryptographic proof is necessary but not sufficient. A valid signature must be accompanied by policy compliance.
- Command classes need differentiated authorization. Propulsion burns deserve stronger protection than telemetry rate changes.
- Failure must default to safety. When trust cannot be verified, the platform retreats to safe mode and awaits ground.
3. What was decided
The desktop will adopt policy-bounded autonomous maneuver authorization with cryptographic verification and safe-mode fallback. This means:
- Ground will sign and upload pre-approved maneuver windows for routine stationkeeping and collision avoidance.
- The platform will verify the signature, freshness, and policy compliance of every command and autonomous maneuver plan.
- Safety-critical commands such as propulsion burns, deorbit, and software updates will require multi-party or hardware-backed authorization.
- The platform will maintain a policy engine that rejects out-of-policy commands even if they are correctly signed.
- Key rotation, revocation, and fallback will be supported despite intermittent connectivity.
- All trust decisions will be logged and downlinked for ground review.
4. Interaction with earlier arcs
The autonomous trust boundaries arc connects directly to:
- the cybersecurity reading arc: it applies cryptographic and defense-in-depth principles to command authorization;
- the autonomous orbit maintenance arc: it authorizes the maneuvers that arc decided the platform should perform;
- the propulsion fault recovery test arc: propulsion faults and security events may trigger similar safe-mode responses;
- the software update arc: signed updates are a special case of command authorization.
5. What remains open
The exact policy language, key hierarchy, HSM choice, and safe-mode thresholds depend on the onboard computer, radio, and operations concept. The wondering arc has set the strategy; detailed design comes later.
6. What this changes
- The autonomous trust boundaries and secure maneuver authorization wondering arc is closed.
- The desktop inherits a policy-bounded authorization model for autonomous maneuvers.
- The next arc will design a test for command authentication and intrusion detection.