Insider-Threat Model
The design assumes a privileged insider may turn malicious or be coerced, and limits what any single trusted person can do without a second party detecting or blocking it.
The hardest adversary
External controls do little against someone already trusted: an operator, an engineer with maintenance access, or an administrator of the control systems. A malicious or coerced insider is the hardest adversary because they hold legitimate credentials and knowledge of the machine. Kronos does not pretend to eliminate insiders; it designs so that no single insider can cause an unsafe plasma state or erase their tracks alone.
Structural mitigations
- Separation of duties: consequential actions need two distinct roles - see separation of duties.
- Least privilege and just-in-time access: standing power is minimized - see privileged access management.
- Attributable actions: no shared accounts; every action is bound to an identity in the lineage.
- Independent safety path: the safety-instrumented system is out of the control administrators' reach.
- Tamper-evident records: an insider cannot rewrite the audit log undetectably.
Threat scenarios considered
Rows: unsafe actuation attempt, credential misuse, covering tracks, and data exfiltration. Unsafe actuation is blocked on multiple axes; exfiltration is caught by audit and constrained by the export-only diode and least privilege, though a determined insider with legitimate read access remains a residual risk that monitoring, not architecture alone, must address.
Honest limits
No design fully stops a sufficiently privileged, patient insider from misusing legitimate read access or from social-engineering a second approver. These residual risks are managed with monitoring, vetting, and rotation, which are organizational, not purely technical. Design status: the technical controls run in the twin; the personnel and vetting program is defined for plant operation and not yet operating.