Beyond Purdue

Beyond Purdue  /  The Laws of Authority

The Laws of Authority

The Laws of Authority are eight laws, under one meta-law, that decide who is allowed to act on an industrial plant. As in Asimov, a lower-numbered law always overrides a higher one.

Our plants have been full of robots for decades: turbines, pumps, breakers, valves. They do not walk, but they can kill, and people work inside them every day. Now AI is arriving in the control room, and the question is no longer whether machines can think. The question is who is allowed to act.

The laws

  1. Meta-law. The Law of Laws. No level is allowed to act unless its action is subject to these laws. [2]

  2. Law Zero. Protection. The plant is not allowed to harm people or the environment, nor, through inaction, allow harm to come to them. Protection holds this law, and no level is allowed to weaken it. A lock outranks every level. [1][3][4][17]

  3. First Law. Independence. Protection stands alone. If every level above fails at the same moment, protection still acts. [5][9]

  4. Second Law. Obedience. The controller obeys the operator, except where the command would break Law Zero or the First Law. [1][7]

  5. Third Law. Self-preservation. The machine protects its own existence, as long as this does not break the laws above. People first, machines second. [1][8][9]

  6. Fourth Law. The gate. Channels decide what is allowed to pass, and every level speaks to every other level only through a channel. Out channels carry data out, in channels carry commands in, and the two never mix. Channels never originate an action. [26][25][24]

  7. Fifth Law. The record. Data nodes hold the truth of the plant. They process, store and present it on demand, under any of their names, and they record every command, permit, lock and bypass. They grant no access and take no action. [12][11][16][21]

  8. Sixth Law. The human decides. The operator can always ignore, override, reverse or stop any advice, and must never be made dependent on it. [13]

  9. Seventh Law. See everything, touch nothing. AI is allowed to observe every tag, analyze and interpret the plant, and support the operator. It has no path to an actuator except through a human decision.

  10. Eighth Law. Authority never flows upward. Information rises on the out channels. Authority descends on the in channels. No level gains authority through failure, through the data path, or by asking.

Enforced by construction, not by programming

Asimov wrote his laws to show how they fail; nearly every story is a loophole. So these laws must not live only in software. Protection is enforced by copper, channels by light and direction through data diodes, names by signatures, credentials by a level of authority on every one. A law that lives only in software is a wish.

The levels that carry these laws are on Six levels of authority. The full wording, with the basis of every law, is in The Laws of Authority, Statement V1.0 (PDF).

Sources

  1. Asimov, Three Laws of Robotics and the Zeroth Law. https://en.wikipedia.org/wiki/Zeroth_Law_of_Robotics
  2. Clarke, Asimov's laws of robotics: implications for information technology. https://cse.buffalo.edu/~rapaport/Papers/Papers.by.Others/clarke-asimov-2.pdf
  3. IEC 61508, Functional safety of E/E/PE safety-related systems. https://webstore.iec.ch/en/publication/5515
  4. IEC 61511-1, Safety instrumented systems for the process industry sector. https://webstore.iec.ch/en/publication/24241
  5. IS/IEC 61511-1, clause 11.2.4, separation and independence of BPCS and SIS. https://law.resource.org/pub/in/bis/S05/is.iec.61511.1.2003.pdf
  6. ISO 13849-1, Safety-related parts of control systems. https://www.iso.org/standard/69883.html
  7. IEC 60255-1, Measuring relays and protection equipment. https://cdn.standards.iteh.ai/samples/100210/08c2059a2d7f406f8290ee090e93b0ee/IEC-60255-1-2022.pdf
  8. API 670, Machinery Protection Systems. https://www.intertekinform.com/en-us/standards/api-std-670-2025-97086_saig_api_api_3641258/
  9. OPC Foundation, OPC UA specifications. https://reference.opcfoundation.org/
  10. RFC 4033, DNS Security Introduction and Requirements. https://www.rfc-editor.org/rfc/inline-errata/rfc4033.html
  11. EU AI Act, Article 14, Human oversight. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14
  12. OASIS, MQTT Version 5.0. https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html
  13. ISO 14118:2017, Safety of machinery, prevention of unexpected start-up. https://www.iso.org/standard/66460.html
  14. IEC 61511 ed.2, clause 16.2, bypass authorization and bypass log (ABB summary). https://library.e.abb.com/public/52dc61cd2284462c8f66bdcafb1fefcb/11%20C%20Bratt%20ABB%20changes%20in%20IEC61511.pdf
  15. NIST glossary, data diode. https://csrc.nist.gov/glossary/term/data_diode
  16. NIST SP 800-82r3, Guide to Operational Technology Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
  17. IEC 62443-3-3, System security requirements and security levels. https://webstore.iec.ch/en/publication/7033