Building BIOS Architecture

Control Authority Management defines which person, service, component, Cartridge, robot, AI agent, or external system may issue commands affecting building operation.

Every control authority assignment shall specify:

controlling identity;

controlled entity or function;

permitted commands;

operating mode;

location or zone;

validity period;

priority;

required supervision;

revocation conditions;

audit requirements.

Authority levels may include:

observe only;

recommend;

request;

operate within limits;

configure;

maintain;

override;

emergency command;

administrative authority.

AI services shall not receive implicit control authority. Their permissions shall define whether they may observe, recommend, request, or directly control specific functions.

Manufacturer services shall not control installed products without building-level authorization.

Authority shall be context-sensitive. A maintenance technician may control equipment only while Maintenance Mode is active and the relevant work authorization is valid.

Emergency authority may temporarily supersede normal operational authority, but its scope, duration, and termination shall remain controlled.

Authority delegation shall be explicit, limited, revocable, and recorded. Possession of network access or credentials shall not automatically grant unrestricted physical control.