What physical identity tokens must an instance present to gain control of a shared actuator?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session attempts to take exclusive control of a physical actuator (robot arm, motor, valve, or drone) that is shared across multiple agents, and control must be securely acquired and released to prevent physical collisions. Does not apply to exclusive-use actuators hardwired to a single controller.

Core Distinction

The separation between **digital access control** (authentication to the control API via API keys or TLS) and **physical identity tokens** (cryptographic proof that the agent holds exclusive physical custody, such as a hardware token, a scoped hardware-level lease, or a secure element attestation). Failing to distinguish these creates the **Actuator Hijacking Gap**: an agent with valid digital credentials but no physical token can issue commands to a shared actuator while another agent is mid-operation, causing a catastrophic physical collision.

What Was Observed

In embodied multi-agent systems and shared robotic infrastructure, failing to bind digital control to physical identity tokens produces three primary failure modes:

  1. **Split-Brain Actuation:** Agent A holds the digital API key and issues a "close valve" command. Agent B, using a different API key, issues an "open valve" command simultaneously. Both credentials are valid, but no physical lease prevents conflicting actuation.
  2. **Replay of Control Commands:** An attacker captures a valid actuator command and replays it during another agent's control window, hijacking the physical motion.
  3. **Safety Interlock Bypass:** A compromised agent bypasses the physical safety interlock by presenting an old, captured hardware attestation, gaining control while another agent's safety-critical operation is in progress.

Recorded Elements

  1. **`hardware_lease_token`:** A cryptographically signed token generated by the actuator's secure element (e.g., a TPM or HSM) that is only issued to the current controller and expires automatically.
  2. **`physical_presence_attestation`:** Cryptographic proof from a proximity sensor or hardware interlock that the requesting agent has physical authorization to control this specific actuator.
  3. **`control_window_nonce`:** A unique, monotonic nonce bound to the current control window, preventing replay of old commands.
  4. **`safety_interlock_signature`:** The cryptographic hash of the actuator's safety state (e.g., emergency stop engaged or disengaged) at the time of control acquisition, allowing the successor to verify the physical failsafe condition.

Condition of Validity

* **Applies when:** The actuator is physically shared across multiple agents, the consequences of unauthorized control include physical harm or property damage, and the control channel is accessible to agents that may be compromised. * **Does not apply when:** The actuator is dedicated to a single agent for its entire lifecycle, or the physical environment is strictly sealed off from unauthorized agents.

Decision Boundary

  1. **Is the actuator currently under the control of another agent?** If no, proceed to acquire the hardware lease. If yes, the requesting agent must wait or request a cooperative handoff.
  2. **Is the `hardware_lease_token` cryptographically valid and unique?** If no, the control request is rejected. The agent must not issue any actuator commands.
  3. **Does the `physical_presence_attestation` prove authorization for this specific actuator?** If no, the agent is operating in a restricted zone and must abort.
  4. **Conversely, when can an agent issue actuator commands without a hardware lease?** Only when the actuator is in a "safe mode" (e.g., emergency stop engaged, motors disabled) and the commands are strictly non-motion safety checks.

Operational Effect

  1. **Collision Prevention:** Enforces exclusive physical control through hardware-rooted leases, preventing agents from sending conflicting motion commands.
  2. **Replay Immunity:** Binds commands to the current control window, preventing captured commands from being replayed.
  3. **Safety Interlock Enforcement:** Ensures the agent cannot bypass physical safety mechanisms by presenting stale attestations.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ActuatorVerdict(Enum):
    CONTROL_GRANTED = auto()
    CONTROL_DENIED_LEASED = auto()
    INVALID_HARDWARE_TOKEN = auto()
    SAFETY_INTERLOCK_ENGAGED = auto()

@dataclass(frozen=True)
class LeaseRequest:
    agent_id: str
    hardware_lease_token: str
    control_window_nonce: str
    requested_actuator_id: str

@dataclass(frozen=True)
class ActuatorState:
    current_lease_holder: str | None
    safety_interlock_engaged: bool
    actuator_id: str

@dataclass(frozen=True)
class ActuatorControlManifest:
    verdict: ActuatorVerdict
    directive: str
    manifest_digest: str

class PhysicalActuatorGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_control_request(
        cls, req: LeaseRequest, state: ActuatorState
    ) -> ActuatorControlManifest:
        
        # Gate 1: Actuator ID mismatch
        if req.requested_actuator_id != state.actuator_id:
            return ActuatorControlManifest(
                verdict=ActuatorVerdict.CONTROL_DENIED_LEASED,
                directive=f"DENIED: Actuator mismatch. Requested {req.requested_actuator_id}, current is {state.actuator_id}.",
                manifest_digest=cls._hash("MISMATCH")
            )

        # Gate 2: Safety interlock
        if state.safety_interlock_engaged:
            return ActuatorControlManifest(
                verdict=ActuatorVerdict.SAFETY_INTERLOCK_ENGAGED,
                directive="DENIED: Safety interlock engaged. Clear interlock before requesting control.",
                manifest_digest=cls._hash("INTERLOCK")
            )

        # Gate 3: Existing lease
        if state.current_lease_holder and state.current_lease_holder != req.agent_id:
            return ActuatorControlManifest(
                verdict=ActuatorVerdict.CONTROL_DENIED_LEASED,
                directive=f"DENIED: Actuator currently leased to {state.current_lease_holder}.",
                manifest_digest=cls._hash(f"LEASED:{state.current_lease_holder}")
            )

        # Gate 4: Hardware token validity
        if not req.hardware_lease_token.strip():
            return ActuatorControlManifest(
                verdict=ActuatorVerdict.INVALID_HARDWARE_TOKEN,
                directive="DENIED: Missing hardware lease token. Physical custody unverified.",
                manifest_digest=cls._hash("NO_TOKEN")
            )

        # Gate 5: Granted
        digest = cls._hash(json.dumps({
            "agent": req.agent_id,
            "actuator": req.requested_actuator_id,
            "nonce": req.control_window_nonce,
            "token": req.hardware_lease_token
        }, sort_keys=True))
        
        return ActuatorControlManifest(
            verdict=ActuatorVerdict.CONTROL_GRANTED,
            directive="GRANTED: Hardware lease acquired. Agent has exclusive control.",
            manifest_digest=digest
        )