Operational cybersecurity has advanced. Asset inventories are more accurate, monitoring more comprehensive, response faster. Most organizations can now say what is connected. Far fewer can say, with equal precision, who — or what — can command change.
For years the conversation has centered on the attack surface: reduce exposure, segment networks, watch traffic. Necessary work. But in environments that move energy, chemicals, water, or product, exposure is not defined solely by reachability. It is defined by authority.
Authority is the ability to command change
The Authority Surface of a system is the total set of human, digital, and procedural mechanisms through which change can be commanded. If a path can alter logic, modify configuration, adjust a setpoint, or override a constraint, it is part of the Authority Surface. Monitoring is not authority. Visibility is not authority. Logs do not move molecules. Authority does.
Work backward from consequence
Engineers already reason this way. Start with the worst credible physical outcome a system could produce. Then ask the smallest behavioral change that could produce it — often a modest setpoint shift, a sequencing delay, a bypass left active. That smallest change is the pivot. Now ask who, or what, has the authority to make it — not in theory, in practice.
Traced backward this way, the Authority Surface stops being abstract. It becomes a mapped set of minimum viable command paths capable of pushing a system outside its intended envelope. That is a structural conversation, not a security overlay — and it is the one most organizations have not yet had.