The Governed Boundary

The TGB – Architecture of the Governed Boundary

Not a firewall. Not a network segment. The architectural mechanism through which governance is made operational at the place where it has to act.

The domain the architecture serves

OT Reference Architecture – Zone Hierarchy from Enterprise through TGB to Safety, with consequence increasing downward.
Consequence increases downward. The TGB sits at the governed boundary. Each OT zone has a defined function, failure mode, and independence.

The TGB does not operate in isolation. It sits within a domain model – the OT Reference Architecture – that classifies the operational estate by consequence. At the top, the enterprise domain: Corporate IT's territory, where failure produces commercial consequence. At the bottom, the safety zone: architecturally independent, governed by IEC 61511, where failure produces physical harm. Between them, consequence-classified zones – supervisory, edge, control – each with a defined governance identity.

The TGB sits at the governed boundary between the enterprise domain and the operational domain. It is where every digital interaction between the two domains must pass, and where the three governance logics – the Operator's consequence-ownership, Corporate IT's enterprise digital governance, and the Vendor's product-boundary governance – are reconciled through architecture rather than through negotiation.

Below the TGB, Site IT operates within the governed perimeter – local IT infrastructure that exists inside the OT domain's trust boundary. This is not Corporate IT extended southward; it is IT infrastructure under the OT governance function's authority.

Eighteen capabilities in three functions

TGB Reference Capability Map: eighteen capabilities between north and south firewalls.
Eighteen capabilities. Ten mandatory and fully deployed. Five mandatory and scaled. Three optional and site-specific. Each specified with its contribution to the three functions.

The TGB's three functions – traffic mediation, governance translation, semantic translation – decompose into eighteen specific capabilities. These are not a product feature list. They are the architectural specification of what a governed boundary must do.

Traffic mediation provides the envelope: north and south firewalls at the boundary edges, IDS/IPS for threat detection on both sides, and protocol gateways that wrap the governance and semantic layers. Nothing enters or leaves the TGB without passing through this envelope. The governed default is deny-by-default on both edges.

Governance translation provides the core: data exchange brokering, safety validation and interlock checks, historian brokering for OT data reaching the enterprise, patch staging for validated updates entering OT, jump servers for controlled remote access, identity and PKI for credential brokering, API management for governed programmatic access, and the south-side governance interface for contested-middle decisions with the vendor's control platform.

Semantic translation preserves meaning: data model and semantics for tag mapping and unit conversion, time synchronisation for timestamp authority, and lifecycle and twin preparation for configuration baselines and asset metadata. Monitoring – asset inventory and SIEM collectors – observes all layers, reports through a dedicated path, and provides corroborated evidence rather than self-reported compliance.

How traffic actually crosses

Every interaction through the TGB follows a specified crossing flow. Consider northbound data replication – operational data flowing from an OT historian into the enterprise domain:

Northbound data replication: OT Historian through TGB-SOUTH, TGB-CORE capabilities, TGB-NORTH to Enterprise Consumer.
Northbound data replication. Enterprise consumers receive a governed copy – never a direct OT connection. Every crossing produces a record.

The data enters through TGB-SOUTH, passing the south firewall and south IDS. In TGB-CORE, the historian broker collects and stages the data, the semantic translation layer applies tag mapping and unit conversion, and the data exchange capability brokers the validated output. The data exits through TGB-NORTH, passing the north IDS and north firewall. At every stage, a crossing record is submitted to TGB-MONITORING and forwarded via TGB-UPLINK to TGB-AUTHORITY.

The enterprise consumer never holds a direct connection to OT. It receives a governed copy – semantically translated, governance-validated, and independently monitored. Five crossing flow patterns are specified: northbound data replication, southbound command flow, remote vendor access, patch distribution, and monitoring telemetry. Each pattern names the capabilities it traverses and the governed defaults that apply.

The governed defaults themselves are not guidelines. They are architectural commitments: coupling direction is pull, not push. Session initiation authority is boundary-originated, never relayed. Time authority is OT time as canonical. Replay is prohibited. Partial failure degrades to non-actuation. Data is minimised. These defaults define how the boundary behaves in the absence of explicit instruction – and they persist because they are encoded in architecture, not carried in operational discipline.

Book 3 – The Governed Boundary

The architecture above is specified in full across nine chapters in The Governed Boundary – from the TGB and its boundary-integrity principles, through the Industrial Edge, the OT Reference Architecture, the functional and network architectures, zoning and segmentation, the conduit governance regime, to reference patterns across operational estates. Ten governed defaults, seven boundary-integrity principles, named failure modes, and TGB-AUTHORITY as the sovereign control plane are developed in detail that the above can only introduce.

An accompanying paper – Supplemental Use Cases and Traffic Flows – illustrates the TGB's operational working through detailed crossing scenarios, demonstrating how the architecture handles each class of interaction in practice.

The White Paper summarises the specification for the architect or ICS practitioner who wants the scope before the book.

White Paper – The Governed Boundary

← The Governance MandatePrevious NextStructural Deliverables →