The sections so far have concerned records and outputs: provenance describing a value's handling, policy deciding its use, attestation certifying a process, and machine learning emitting a confidence that does not certify a basis. This section follows the same fault line out of software and into the physical world, where the consequence of acting on an unfounded value changes character. In an information system a wrong value corrupts a record, which can often be corrected. In an operational-technology system the same wrong value can open a valve or trip a turbine, and while the action may be reversible the consequence frequently is not. This is why the contribution is grounded in operational technology: it is the domain where the distance between what a value asserts and what its basis supports is measured not in data quality but in physical events.
Supply-chain integrity certifies the artefact, not the act
The software supply-chain security field is the mature discipline for establishing that what crosses a boundary was produced as declared. Its systematisation organises the field around secure-design principles, and the property most relevant here is separation: compartmentalising a pipeline so that a compromise in one stage cannot propagate to the next (Okafor et al., 2024). This is a genuine and powerful discipline, and it is worth noting, because it recurs, that its central move is the same one network security makes with a demilitarised zone and operational technology makes with its zones. Three fields arrive independently at compartmentalise-so-compromise-cannot-propagate. But separation, like every integrity property surveyed here, secures the provenance and integrity of an artefact as it moves; it does not adjudicate whether the artefact's content is well founded enough to act on at the far end. The supply chain can guarantee that a build was not tampered with and still deliver, intact and authenticated, an output whose basis does not warrant the action a consumer takes on it.
The field's flagship transparency instrument, now mandated for software sold to the United States government, makes this limit unusually explicit. A software bill of materials is a formal, machine-readable inventory of the components and dependencies used to build a product, and the defining government text states its own boundary in the same breath as its definition: an SBOM "will not solve all software security problems, but will form a foundational data layer on which further security tools, practices, and assurances can be built" (NTIA, 2021). It records what is present so that a judgement can be made elsewhere; it does not itself judge whether what is present is fit for the use to be made of it, and the first empirical study of the practice finds that even this inventory is contested on trustworthiness, completeness, and tamper-resistance (Xia et al., 2023). The nearest the ecosystem comes to a judgement of fitness is the Vulnerability Exploitability eXchange, which asserts whether a component "is or is not affected" by a known vulnerability (CISA, 2023). This is closer to the mark, because it speaks to whether a weakness matters in context rather than merely whether a component is present, and yet it lands squarely on the descriptive side of the line: it is an authored, signed assertion whose author is responsible for its content, it is explicitly permitted to be incomplete, and it conveys a status without carrying across the basis on which the status was reached. The supply chain's closest approach to adjudication is, on inspection, an attested claim of status, which is precisely the kind of conveyed claim whose elevation to an acted-upon fact this work is built to govern.
Where integrity becomes physical, and irreversible in consequence
Operational-technology security is the field that governs the boundary at which a value becomes a physical action, and its own framing establishes why the stakes differ. The field orders its security objectives differently from conventional information security. The authoritative guidance states that operational-technology security typically prioritises integrity and availability, followed by confidentiality, with safety as an overarching priority (Stouffer et al., 2023). The reason it gives is the consequence model: because logic executing in operational technology has a direct effect on the physical world, a failure risks not a disclosed record but equipment damage, environmental release, or loss of human life (Stouffer et al., 2023) (Cyber Security of OT Networks, 2025). The systems are organised on the Purdue reference model into levels from field devices and controllers up to enterprise networks, with segmentation between them, and the surrounding survey literature maps the threats and defences across those levels (Bhamare et al., 2020) (Humayed et al., 2017) (Makrakis et al., 2021) (Li et al., 2023). What matters for this work is the consequence model the field assumes: a control action manifests immediately in the plant, and although the command itself may sometimes be reversed, the physical event it causes often cannot be. The distinction is worth drawing precisely, because it is easy to overstate: it is not that operational-technology actions are irreversible, but that their consequences frequently are, and a discipline for deciding whether to act must respect that acting, not acting, and deferring are all consequential. The failure this work names appears, moreover, in the field's own catalogue of incidents: the guidance lists among the ways an operational-technology system can be harmed the sending of inaccurate information to system operators, whether to disguise unauthorised changes or to cause operators to initiate inappropriate actions (Stouffer et al., 2023). That is conveyed state acted upon as though its basis were sound, named as a hazard in an official standard.
The Triton incident, in which an intrusion reached the safety-instrumented system of a petrochemical plant, is the canonical illustration of what is at stake at this boundary (INL/DOE CyOTE, 2022) (MITRE, n.d.). It is used here as an illustration and not as evidence for the specific mechanism this thesis concerns. Triton demonstrates, with physical stakes, that a conveyed state can be acted upon when its basis does not warrant the action, which is the general handover failure the work names. It does not, on its own, establish anything about probabilistic generation, and it is not offered to. Its role is to make concrete why a boundary that adjudicates basis matters where the downstream event is irreversible in consequence.
The perimeter is orthogonal to admissibility, and now it is learned
Operational-technology security guards this boundary with layered perimeter defence: segmentation, zone-and-conduit architecture, and intrusion detection, arranged so that a failure of one layer is caught by the next (Li et al., 2023). This is effective and it is orthogonal to the question this work asks. Figure 3 places the two on the Purdue model to make the orthogonality visible: the perimeter sits between the enterprise and the plant, guarding the crossing, while admissibility sits downstream of it, at the actuation point, guarding the act.
Defence in depth establishes that a value reached a controller by an authorised path, from an expected source, over a permitted protocol; it does not establish that the value is well founded. A reading can be perfectly authorised, correctly addressed, cryptographically intact, and still be an unfounded inference no measurement supports. The perimeter inspects where a value came from and how it travelled; it does not inspect whether the value's basis suffices for the action about to be taken on it. A firewall in this setting is best described as enforcing permitted flows over observable or derived attributes, not as adjudicating the content that flows.
That orthogonality persists, and arguably sharpens, as the perimeter itself becomes a learned classifier. Intrusion and anomaly detection in these systems is increasingly performed by machine learning, at the network level over packets and at the physical-process level over plant behaviour, with the detected anomalies reported to plant engineers expected to act on them (Umer et al., 2022); the deep-learning branch of the field organises these methods by the anomaly score they emit and documents their deficiencies (Luo et al., 2021). A learned monitor returns a score, which is a distributional statement about how unlike the training data an input is, not a warrant that a value is sound enough to act on, so the learned perimeter inherits the wrong-category problem this review has already drawn. The point is not merely that such monitors are imperfect: they are defeatable by construction, as the operational-technology literature has shown directly, with adversarial samples reducing the accuracy of standard intrusion classifiers by sixteen and twenty percentage points and passing malicious data through as benign (Anthi et al., 2020). A second learned boundary guards the plant's picture of itself: state estimation is increasingly defended by machine-learning detectors, because false-data-injection attacks can be crafted to bypass conventional bad-data detection (Sayghe et al., 2020).
When the model makes the decision, not just watches the boundary
Machine learning is now moving from watching the boundary to making the control decision, and here the operational-technology field's own most advanced work confirms the problem from the inside. Deep reinforcement learning is being used to control power and energy systems directly, and the critical review of this trend states plainly that such controllers often fall short in guaranteeing safety, which is the field's foremost concern in critical infrastructure (Bui et al., 2024). The formal machinery built to constrain a learned policy, the constrained Markov decision process, bounds the probability or expected value of a violation rather than warranting a particular action, which is the wrong shape of guarantee where exceeding a limit even once can be catastrophic (Kushwaha et al., 2026). The estimate a controller acts on can be corrupted beneath it, since false-data injection can pass the controller's checks (Irfan et al., 2023). And the trust layer the field reaches for is post-hoc explanation: predictive-maintenance systems adopt explainable AI precisely because operators must trust decisions in life-threatening settings (Cummins et al., 2024), and the state of the art couples a reinforcement-learning agent that emits physical control setpoints with a feature-attribution explainability pipeline presented as delivering trustworthy control (Bezold et al., 2025). That last system is the thesis's problem built in good faith: a probabilistic decision about an irreversible-in-consequence action, made trustworthy in name by a plausible explanation of how the model behaved rather than by a representation of whether the decision's basis warrants the act.
What this section establishes
Carrying the argument into operational technology changes the stakes without changing the gap. Supply-chain integrity certifies the artefact and not the act; the perimeter, whether a firewall or a learned classifier, authorises transit and not basis; and when machine learning makes the control decision, safe reinforcement learning constrains it probabilistically, the estimate beneath it can be falsified, and the trust bolted on top is post-hoc explanation. Every safeguard the field deploys lands somewhere other than admissibility, and it does so in the one domain where acting on an unfounded value produces a consequence that cannot be corrected by fixing a record. This is the precise setting the contribution addresses: not a better perimeter or a safer controller, but a representation, carried with a value and adjudicated at the boundary, of whether its basis suffices for the physical action about to be taken on it.
References
Okafor, C., Schorlemmer, T. R., Torres-Arias, S. and Davis, J. C. (2024). SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties. ACM SCORED / arXiv. arXiv:2406.10109. arxiv.org/abs/2406.10109
NTIA (2021). The Minimum Elements for a Software Bill of Materials (SBOM), pursuant to Executive Order 14028. U.S. Department of Commerce. ntia.gov
Xia, B., Bi, T., Xing, Z., Lu, Q. and Zhu, L. (2023). An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead. ICSE 2023. arXiv:2301.05362. arxiv.org/abs/2301.05362
CISA (2023). Minimum Requirements for Vulnerability Exploitability eXchange (VEX). Cybersecurity and Infrastructure Security Agency. cisa.gov
Cyber Security of OT Networks: A Tutorial and Overview (2025). arXiv:2502.14017. arxiv.org/abs/2502.14017
Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A. and Thompson, M. (2023). Guide to Operational Technology (OT) Security. NIST Special Publication 800-82r3. doi.org/10.6028/NIST.SP.800-82r3
Bhamare, D., Zolanvari, M., Erbad, A., Jain, R., Khan, K. and Meskin, N. (2020). Cybersecurity for industrial control systems: A survey. Computers & Security, 89. arXiv:2002.04124. arxiv.org/abs/2002.04124
Humayed, A., Lin, J., Li, F. and Luo, B. (2017). Cyber-physical systems security: A survey. IEEE Internet of Things Journal, 4(6). arXiv:1701.04525. arxiv.org/abs/1701.04525
Makrakis, G. M., Kolias, C., Kambourakis, G., Rieger, C. and Benjamin, J. (2021). Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures. arXiv:2109.03945. arxiv.org/abs/2109.03945
Li, Y., Wu, S. and Pan, Q. (2023). Network Security in the Industrial Control System: A Survey. arXiv:2308.03478. arxiv.org/abs/2308.03478
Idaho National Laboratory / U.S. Department of Energy CyOTE (2022). Case Study: TRITON Malware Attack Against Petro Rabigh. INL/RPT-22-67981. cyote.inl.gov
MITRE (n.d.). Triton (S1009), ATT&CK for ICS. attack.mitre.org/software/S1009
Umer, M. A., Junejo, K. N., Jilani, M. T. and Mathur, A. P. (2022). Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations. arXiv:2202.11917. arxiv.org/abs/2202.11917
Luo, Y., Xiao, Y., Cheng, L., Peng, G. and Yao, D. (2021). Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities. ACM Computing Surveys. arXiv:2003.13213. arxiv.org/abs/2003.13213
Anthi, E., Williams, L., Rhode, M., Burnap, P. and Wedgbury, A. (2020). Adversarial Attacks on Machine Learning Cybersecurity Defences in Industrial Control Systems. Journal of Information Security and Applications. arXiv:2004.05005. arxiv.org/abs/2004.05005
Sayghe, A., Hu, Y., Zografopoulos, I., Liu, X., Dutta, R. G., Jin, Y. and Konstantinou, C. (2020). A Survey of Machine Learning Methods for Detecting False Data Injection Attacks in Power Systems. IET Cyber-Physical Systems. arXiv:2008.06926. arxiv.org/abs/2008.06926
Bui, V.-H., Das, S., Hussain, A., Hollweg, G. V. and Su, W. (2024). A Critical Review of Safe Reinforcement Learning Techniques in Smart Grid Applications. arXiv:2409.16256. arxiv.org/abs/2409.16256
Irfan, M., Sadighian, A., Tanveer, A., Al-Naimi, S. J. and Oligeri, G. (2023). False Data Injection Attacks in Smart Grids: State of the Art and Way Forward. arXiv:2308.10268. arxiv.org/abs/2308.10268
Kushwaha, A., Ravish, K., Lamba, P., Kumar, P. and Mahajan, A. (2026). A Survey of Safe Reinforcement Learning and Constrained MDPs. arXiv:2505.17342. arxiv.org/abs/2505.17342
Cummins, L., Sommers, A., Bakhtiari Ramezani, S., Mittal, S., Jabour, J., Seale, M. and Rahimi, S. (2024). Explainable Predictive Maintenance: A Survey of Current Methods, Challenges and Opportunities. IEEE Access. arXiv:2401.07871. arxiv.org/abs/2401.07871
Bezold, V., Wagner, P., Hofmann, J., Huber, M. and Sauer, A. (2025). Trustworthy and Explainable Deep Reinforcement Learning for Safe and Energy-Efficient Process Control. arXiv:2512.18317. arxiv.org/abs/2512.18317