IEC 62443
الأمن والسيادة
الفصل بين التشغيل وتقنية المعلومات، ونطاقات بيردو، ومعنى النشر المعزول فعلياً.
الأمن
IEC 62443 zones and conduits, Purdue-model segmentation, identity and role-based access at every service boundary, encryption at rest and in transit, and full audit logging. The platform is designed to run air-gapped: no licence check, no telemetry callback, no model download at runtime.
التقنيات
- IEC 62443 zones and conduits
- Keycloak / OIDC
- HashiCorp Vault
- mTLS between services
- Immutable audit log
البيانات الخارجة
- Audit trail
- Security alerts and segmentation gaps
- Access reports for compliance
الحوكمة
Data ownership, model governance, versioning and change control across every layer. Every prediction records the model version, the input snapshot and the configuration that produced it, so a decision made eighteen months ago can be reconstructed exactly — which is what an audit, or an incident investigation, actually requires.
التقنيات
- Model registry with immutable versions
- OpenLineage
- Data contracts
- Approval workflow
- Reproducible run snapshots
البيانات الخارجة
- Reproducible decision records
- Compliance and audit packages
- Impact analysis for proposed changes
Acquisition crosses the dashed boundary in one direction only, enforced by network architecture rather than by configuration.