BLADE-INFRA-OT Governance Node

Why This Platform Exists

The IT/OT bridge is the most failure-prone interface in critical-infrastructure cybersecurity. BLADE-INFRA-OT is a focused variant of BLADE-INFRA that addresses this interface explicitly with the AUTHREX governance pipeline. Operational-technology environments, including water utilities, electric substations, gas pipelines, and building-management systems, have historically been protected by network segmentation alone.

The Purdue Reference Model assumed adversaries could not cross from the corporate IT zone into the control and field zones. That assumption has eroded. Rather than rely on segmentation as a static boundary, BLADE-INFRA-OT treats the boundary as an active adjudication point: it reads, classifies, governance-checks, and then forwards or quarantines every cross-boundary message.

Federal and Industry Anchors

BLADE-INFRA-OT is framed against current operational-technology security guidance. It is positioned as a reference implementation of the December 2025 CISA / Five Eyes joint principles for governing AI-influenced operational technology, and its audit-ledger output is structured to support utility-sector reporting obligations.

What OT Segmentation Does Not Provide

Conventional IT/OT defense relies on static segmentation: firewalls, data diodes, and zone boundaries that assume an adversary cannot cross from the corporate network into the control network. Segmentation is binary and context-free. It does not reason about who issued a command, whether the command pattern is consistent with normal operations, whether the operator holds sufficient authority for the current plant state, or whether an AI-generated script is attempting to drive a physical actuator. Once traffic is permitted through a conduit, nothing adjudicates the individual command.

BLADE-INFRA-OT closes that gap. It treats each cross-boundary command as a governed event, adjudicated against provenance, message pattern, operator authority tier, and the active operational regime before it is allowed to reach a field device.

Extending AUTHREX to the IT/OT Bridge

BLADE-INFRA-OT is the ninth instantiation of the AUTHREX authority-governance framework and the operational-technology companion to BLADE-INFRA. It reuses approximately 70% of the parent platform and applies the seven governance architectures in IT/OT-specific roles: SATA for boundary provenance, IFF for OT-target authentication, HMAA for operator authority-tier enforcement, ADARA for AI-script deception detection, MAIVA for inspection-node consensus, FLAME for bounded deliberation on high-stakes writes, and CARA for deterministic isolation on detected compromise, with ERAM providing risk-based gating across the pipeline.

Parse, Score, Adjudicate

BLADE-INFRA-OT is a bump-in-the-wire appliance at the IT/OT segmentation boundary. All cross-boundary traffic is read, classified, governance-checked, and then forwarded or quarantined. Each command is resolved to one of three actions.

Four OT authority regimes (NOMINAL, ELEVATED, LOCKDOWN, SAFE-HALT) change how strictly commands are adjudicated. Malformed input fails closed by default. Every decision is written to a seed-deterministic, SHA-256 hash-chained, tamper-evident audit ledger.

Eight-Stage AUTHREX Pipeline, Applied Per Message

Every cross-boundary message is evaluated through eight AUTHREX stages before an adjudication is issued.

BLADE-INFRA-OT reuses approximately 70% of the parent BLADE-INFRA platform, extending it for operational-technology bridge operations rather than re-deriving the governance core.

Dual-Plane Compute with a Hardware Root of Trust

The governance plane runs on a Xilinx Kria K26 industrial system-on-module; the network plane runs on a separate x86 fanless single-board computer, isolating packet handling from adjudication. A Microchip ATECC608 secure element provides the hardware root of trust, a TPM 2.0 module anchors platform state, and a Form C fault relay drives a fail-safe output. A managed Ethernet switch with SFP+ uplinks segregates IT-side and OT-side interfaces, and an out-of-band management module supports administration without traversing the data path.

Industrial Protocol Awareness

The appliance parses and adjudicates the industrial protocols common at the IT/OT boundary, such as Modbus/TCP, DNP3, OPC UA, EtherNet/IP, and IEC 61850. Adjudication operates at the command level: for example, a SCADA pump-start issued as a Modbus write-holding-register is checked for operator provenance, baseline-consistent message pattern, and authority tier before it is permitted to propagate to the field device.

Bump-in-the-Wire, Fail-Closed

BLADE-INFRA-OT installs inline at the segmentation boundary so that no cross-boundary command can reach operational-technology assets without traversing the governance node. If the appliance cannot parse, authenticate, or authorize a message, the message is isolated rather than forwarded. The default state on fault, power loss, or tamper is closed, preserving the safety posture of the protected control zone.

Fail-Closed by Design

BLADE-INFRA-OT defaults to the safe state. A Form C fault relay drives a fail-closed output, and the appliance isolates rather than forwards whenever it cannot parse, authenticate, or authorize a cross-boundary command. On power loss, fault, or detected tamper, the bridge latches closed, preserving the safety posture of the protected control zone. Adjudication and packet handling run on physically separate planes, so a fault in the network plane cannot silently grant authority on the governance plane.

1U Fanless Reference Design

A commercial-off-the-shelf reference design in a fanless, conformal-coated, industrial-temperature enclosure. No hardware has been fabricated; the design is a research reference at TRL 2-3, with the simulation tier at TRL 3-4.

Dual-Plane Separation and Recovery

The appliance separates the governance plane (a Xilinx Kria K26 industrial system-on-module that performs adjudication) from the network plane (an x86 fanless single-board computer that handles packet I/O), so a compromise or fault in packet handling cannot bypass adjudication. A managed Ethernet switch with SFP+ uplinks segregates the IT-side and OT-side interfaces, an out-of-band management module supports administration off the data path, and a conduction-cooled, conformal-coated, industrial-temperature build (-40 to +70C) supports continuous operation. Recovery from an authority lockout follows the deterministic CARA recovery model used across the BLADE family.

System Schematic

Full subsystem node graph color-coded by type (MCU, Sensor, Actuator, Power, Module, Display). Shows the governance-plane and network-plane compute, managed switch with SFP+ ports, ATECC608 root of trust, TPM 2.0, Form C fault relay, DC/DC power, and status LEDs, connected by data, power, and ground edges.

Reference Configuration Cost

Typical configuration with industrial temperature range, fanless operation, conformal-coated PCB, and 1U rack-mount or DIN-rail mounting. Engineering margin is included.

Mechanical & Environmental

Browser-Based Governance Simulator

A deterministic, browser-based simulator demonstrates the IT/OT bridge governance pipeline across four scripted scenarios: nominal operation (a water-utility pump-start command), an attempted attack, authorized maintenance, and a multi-utility coordinated probe.

The interface adds a split IT/OT viewport, exposes the eight-stage pipeline per message, supports malformed and Byzantine forged-authority injection, clock drift, and operator-clearance delay, and records every decision to a seed-deterministic, SHA-256 hash-chained audit ledger with CSV export.

Validation Metrics

Deterministic Scenario Validation

The simulation is evaluated against documented IT/OT threat patterns using a seed-deterministic, scenario-driven methodology. Each scenario fixes the authority regime, the message stream, and the seed, so a given configuration reproduces an identical decision trace and audit ledger for independent verification.

Mapped to OT Security Guidance

Standards alignment is inherited from BLADE-INFRA and extended for IT/OT bridge operations. Under NERC CIP, the appliance supports CIP-005 electronic security perimeter, CIP-007 system security management, and CIP-010 configuration change management, with audit-ledger output structured for CIP-008 incident response. Under IEC 62443, BLADE-INFRA-OT functions as a conduit gateway between SL-1 IT zones and SL-3+ OT zones. Its cryptographic boundary aligns with the parent BLADE-INFRA cryptographic-module specification, and it is positioned as a reference implementation of the December 2025 CISA / Five Eyes operational-technology principles.

Role in the Governance Stack

BLADE-INFRA-OT is the ninth instantiation of the AUTHREX authority-governance framework and the operational-technology companion to BLADE-INFRA. The seven governance architectures (SATA, HMAA, ADARA, MAIVA, FLAME, CARA, ERAM) are reused in their IT/OT-bridge roles, and the same governance pipeline and evidence design that runs across the BLADE family is applied to the IT/OT seam rather than re-derived.

Unified SDK Integration

BLADE-INFRA-OT is configured through the same unified governance API used across the BLADE family. The host opens the node, submits a cross-boundary command, and receives an adjudication. Only the configuration changes between domains.

domain: infra_ot
placement: bump_in_the_wire
fail_state: closed

compute:
  governance_plane: xilinx_kria_k26
  network_plane:    x86_atom_sbc

protocols: [modbus_tcp, dnp3, opc_ua,
            ethernet_ip, iec_61850]

regimes:
  NOMINAL:   permissive
  ELEVATED:  hold_high_stakes
  LOCKDOWN:  isolate_writes
  SAFE_HALT: isolate_all

audit: sha256_hash_chain   # tamper-evident

import blade_governance as bg

# Open the IT/OT bridge governance node
node = bg.InfraOT("blade_infra_ot.yaml")

# Adjudicate a cross-boundary command:
d = node.adjudicate(msg, regime="ELEVATED")
if d.action == "PROPAGATE":
    forward_to_ot(msg)
elif d.action == "HOLD":
    queue_for_operator(msg, d.reason)
else:
    isolate(msg.src)          # ISOLATE

node.audit_append(d)          # SHA-256 chained

Companion Paper & Documentation

The BLADE-INFRA-OT paper, working paper, interface-control document, assembly guide, and the complete reference-design files are deposited on Zenodo under DOI 10.5281/zenodo.20342067 (CC BY 4.0, v1.0).

Technology Readiness

BLADE-INFRA-OT hardware is at approximately TRL 2-3 (specification and reference design); the simulation tier is at approximately TRL 3-4 (a deterministic research demonstrator running real Web Crypto SHA-256). No hardware has been fabricated, and no penetration testing against an operational utility has been performed.

Future Work

Repository & Reproducible Artifacts

BLADE-INFRA-OT provides reproducible artifacts enabling independent verification of the adjudication behavior, the reference hardware design, and the simulation. All files are published open-access on Zenodo (DOI 10.5281/zenodo.20342067) and mirrored in the repository.

Independent, Openly Published Research

BLADE-INFRA-OT is a fundamental-research deliverable: a hardware reference design, an interactive simulation, an open interface-control document, and a working paper, all built from commercial off-the-shelf components and published openly under CC BY 4.0. No penetration testing is performed; the simulation is scripted against documented threat patterns rather than against any operational utility. The status frame is TRL 3-4 for the simulation tier and TRL 2-3 for the hardware tier. Within the AUTHREX program, BLADE-INFRA-OT is the ninth BLADE platform and the operational-technology companion to BLADE-INFRA.

Reference Artifacts

Hardware specification, papers, and the full Zenodo deposit. All materials CC BY 4.0.

About This Project

The BLADE-INFRA-OT Governance Node is part of the authority-governed autonomy research program by Burak Oktenli at Georgetown University (M.P.S. Applied Intelligence). It is the ninth domain instantiation of the BLADE governance framework and the operational-technology companion to BLADE-INFRA, demonstrating that the same authority and evidence design developed across defense, automotive, maritime, critical-infrastructure, orbital, counter-UAS, agentic-AI, and swarm reference designs applies to governing the IT/OT bridge.

Related architectures: SATA · HMAA · CARA · MAIVA · FLAME · ADARA · ERAM

View full research portfolio →

How to Cite

Oktenli, B. (2026). BLADE-INFRA-OT Governance Node: Authority-Governed IT/OT Bridge for Cross-Boundary OT Command Adjudication. Zenodo. https://doi.org/10.5281/zenodo.20342067