Conservation Protocol: A Foundational Model of Information Integrity, Defection Mass, and Execution Lock

A Systems-Theoretic Model of Information Integrity, State Uncertainty, Resource Allocation, and Execution. By Maurice Turner Jr.

Scope & Epistemic Boundary

The Conservation Protocol is a proposed systems-theoretic framework for modeling information integrity, state uncertainty, resource overhead, and system execution in governed systems. Its mathematical constructs describe relationships proposed by Indeimo and are not presented as established universal laws of physics. In particular, Defection Mass is a systems-level construct and does not assert that moral choices, deception, or information possess literal physical mass.

The Conservation Protocol is presented as an applied systems-theoretic framework, not as a newly discovered physical law. It draws upon established concepts from information theory, thermodynamics, computing, systems theory, control, and reliability engineering while proposing its own system-level constructs and relationships. The generalized equations presented here define the public conceptual formulation. System-specific parameterization, calibration, threshold derivation, telemetry rules, scoring methods, and experimental implementation remain part of Indeimo's continuing research program.

Public Formulation and Research Boundary

The equations presented in this article define the generalized public formulation of the Conservation Protocol. They establish the theoretical relationships and variables without disclosing system-specific calibration, proprietary parameterization, experimental implementation, or other research methods used to operationalize the framework. Those elements remain part of Indeimo's continuing research program.

Every organized system exists under constraint. A biological organism has finite metabolic resources. A computational system has finite processing capacity, memory, bandwidth, and power. An institution has finite time, capital, attention, personnel, and authority. None can devote unlimited resources to every possible problem. Each must therefore allocate a limited resource base between maintaining its internal condition and performing the work for which the system exists. [1]

The central proposition of Conservation Protocol is that the stability of such systems depends in part on the integrity of the information and interactions that connect their components. When those interactions become unreliable, the system must compensate. It verifies, monitors, reconciles, repairs, isolates, renegotiates, or otherwise spends resources maintaining a state that would not have required the same overhead under reliable conditions. The theory proposes that this compensatory burden can be modeled, measured, and compared across computational, biological, and institutional systems.

The word morality is used here in an operational rather than metaphysical sense.

Human morality ordinarily refers to shared or individual rules concerning right and wrong, obligation, harm, fairness, trust, and conduct. The Conservation Protocol does not require resolving the philosophical dispute between moral subjectivism and moral objectivism. It instead examines a narrower question: what happens to an organized system when its participants cannot reliably depend on the information, commitments, or boundaries governing their interactions? The framework proposes a system-level relationship that can be tested independently of any claim that morality itself is a fundamental physical law.

The theory therefore begins with a distinction between a moral judgment and a system consequence. Whether an action is morally right may depend on values, culture, circumstances, or philosophical commitments. Whether an unreliable action creates additional verification or coordination requirements is a separate empirical question. A system does not need to agree on the ultimate meaning of morality for its participants to experience the consequences of unreliable information. A corrupted database requires reconciliation whether corruption is morally condemned or not. A contract dispute requires additional administrative work whether the parties describe the dispute as unethical or merely mistaken. A computational system receiving inconsistent state information must resolve the inconsistency before safely proceeding. Conservation Protocol is concerned with this measurable layer.

The central claim can therefore be stated simply. Reliable interaction permits a system to devote a greater proportion of its available resources to intended work. Unreliable interaction creates additional state-management requirements. Those requirements consume resources. As the burden increases, productive capacity can decline. If the cost of maintaining system integrity approaches the resources available for useful execution, the system may enter what this theory calls execution lock: a state in which continued operation becomes dominated by verification, defense, remediation, or coordination rather than the work the system was designed to perform. This is a proposed systems mechanism, not an assertion that every social, biological, or computational failure follows an identical physical pathway.

The conservation principle follows from the constraint itself. A finite system cannot simultaneously allocate the same unit of available capacity to useful execution and to administrative correction. If additional verification, remediation, security, or coordination is required, that capacity must come from somewhere. The theory therefore treats system integrity as an allocation problem. The question is not whether a system can eliminate all uncertainty. No real system can. The question is whether the system can contain uncertainty at a cost that remains compatible with continued useful execution.

The Conservation Principle

The framework begins with the observation that organized groups use rules and values to distinguish permitted from prohibited conduct and to coordinate behavior within a governed system. It then moves toward the observation that human values must be translated into operational rules when they are implemented in software, institutions, policies, or other structured systems. A machine does not possess a human conscience. It executes defined states and transitions. An institution similarly requires procedures, permissions, boundaries, and enforcement mechanisms if its stated values are to affect actual behavior. The important point for Conservation Protocol is not that every moral value can be reduced to code. It is that any value intended to govern a system must eventually appear as an operational constraint if the system is expected to act on it.

This establishes a foundational definitional proposition of the theory: a governed system is a system whose permitted state transitions are constrained by rules, whether those rules are encoded in software, contracts, physical architecture, institutional procedures, or biological regulation. A system can therefore be evaluated without first deciding whether its governing rules are universally moral. The relevant question is whether the system can maintain the state required for its intended operation while absorbing the disturbances introduced by its environment and its own components.

Established Foundations

The Conservation Protocol builds upon established bodies of work rather than treating its underlying scientific domains as newly discovered. Relevant foundations include information theory, thermodynamics and statistical physics, computing and information-processing theory, control and dynamical systems, game theory, reliability engineering, and organizational systems research.

Claude Shannon's work established the mathematical foundations of information theory and formalized information, uncertainty, redundancy, and communication within a rigorous mathematical framework. [2]

Rolf Landauer's work established an important connection between logically irreversible computation and physical energy dissipation. The Conservation Protocol draws upon that physical foundation only to the extent that information-processing operations have physical implementations and resource requirements; it does not extend Landauer's principle into a claim that semantic truth or falsehood possesses intrinsic physical energy or mass. [3]

These established foundations provide context for the framework developed here. The Conservation Protocol's proposed contribution is not the invention of information theory, thermodynamics, control theory, or systems analysis, but the proposed integration of information-integrity conditions, state uncertainty, compensatory system burden, resource allocation, and execution capacity into a common systems framework.

Thermodynamics / Biology / Game Theory

Thermodynamics provides an important physical background, but it must be used precisely. The framework recognizes that the analogy between entropy and social disorder is not itself a thermodynamic proof of morality. Thermodynamic entropy is a physical quantity governed by physical laws. [4] Social distrust, corruption, or conflict should not be described as thermodynamic entropy merely because both can be associated with disorder. Physical systems require energy and material exchange to maintain organized states, and engineered systems likewise require resources to maintain their operating condition. [5] The theory does not claim that the second law of thermodynamics proves that honesty is morally correct. It proposes that finite organized systems incur resource costs when maintaining their required state, and that information integrity can influence some of those costs.

Biology provides another relevant observation without requiring the stronger claim that biology proves morality. Living organisms continuously maintain internal organization through regulated exchanges of energy and matter. Homeostasis, repair, waste removal, signaling, and metabolic regulation all require resources. A biological system therefore illustrates the broader principle that persistence requires active maintenance. The useful proposition is instead that living systems provide an example of organized systems whose continued operation depends upon controlled internal states and bounded responses to disturbances.

Game theory contributes a different piece of the framework. Repeated interactions create conditions in which cooperation, reputation, punishment, reciprocity, and defection can affect future outcomes. Trust is not merely an emotional condition in this context. It can function as an informational assumption that reduces the amount of defensive coordination required before an interaction can proceed. [6] The framework uses ordinary transactions to illustrate this mechanism: when parties expect reliable performance, fewer resources may be required for protective measures; when reliability is uncertain, contracts, verification, security, dispute resolution, and other safeguards may increase. The theory does not require the stronger claim that trust always maximizes wealth or that cooperation is universally optimal. It requires only the narrower and testable proposition that, under otherwise comparable conditions, certain forms of reliable interaction can reduce transaction and verification overhead. [7]

This is the point at which morality enters the theory as a system rule rather than a physical substance. Rules against deception, unauthorized alteration, breach of commitment, or harmful interference can be interpreted as mechanisms for protecting the reliability of state transitions between interacting components. Such rules may have moral significance, but Conservation Protocol evaluates them through their operational consequences. A rule is useful to the system when it reduces preventable uncertainty, preserves valid state information, limits unnecessary conflict, or protects the conditions required for continued execution.

Information Has Physical Implementation

Information is not an immaterial process detached from the physical world. It must be represented in physical states. Computer memory, electrical charge, magnetic orientation, optical states, molecular configurations, and other physical substrates can encode information. Processing information therefore requires physical resources. [3] Landauer's principle does not establish that semantic information such as a lie possesses a unique physical mass, nor does it establish that one particular proposition requires more energy merely because it is false. Those claims are removed.

The stronger and more defensible proposition is that information-processing operations have physical implementations and therefore can have measurable resource requirements. A computation may consume electrical power, occupy memory, require communication bandwidth, produce heat, or trigger additional operations. The physical cost of an information process depends on the implementation and operation performed. Conservation Protocol therefore does not attempt to assign a physical weight to truth or falsehood. It instead asks whether unreliable information causes additional system operations and whether those operations impose measurable resource costs.

This distinction is essential. The content of a statement and the system's response to that statement are different variables. A truthful statement can be computationally expensive to process. A false statement can be computationally trivial. The theory therefore makes no universal claim that truth is inherently cheaper to encode than falsehood. The proposed mechanism operates at the level of system response: when an input cannot be trusted, additional processing may become necessary to establish its validity, reconcile conflicting states, protect downstream operations, or repair consequences caused by the unreliable input.

Information integrity consequently becomes a central variable. Information integrity does not mean that every system must disclose everything. It means that information presented as authoritative for a particular operation should correspond sufficiently to the state the receiving system is entitled to rely upon. Privacy and integrity are therefore distinct. A system may legitimately conceal internal information while still providing accurate outputs at an agreed boundary. The framework identifies this distinction through the engineering concept of encapsulation, which becomes one of the strongest mechanisms in the theory.

The distinction also prevents the theory from confusing secrecy with deception. Encapsulation limits what information crosses a system boundary. Deception introduces information that causes another component to form an inaccurate representation of a relevant state. The first can reduce unnecessary communication. The second can increase the work required to determine what state actually exists. This difference becomes important when designing governance systems because requiring complete disclosure can itself produce unnecessary administrative overhead. A conservation protocol should therefore preserve relevant state integrity without requiring universal visibility into every internal process.

Trust as a Reduction in Required Verification

Trust is treated here as an operational variable representing the degree to which a receiving component can accept another component's state or output without additional verification under defined conditions. [10]

High trust does not mean that verification disappears. It means that verification can remain proportionate to expected risk. Low trust does not necessarily mean that a system immediately fails. It means that the system must compensate through additional controls, redundancy, audits, authentication, reconciliation, or restricted permissions. The framework describes this as friction cost. Security and verification can be necessary and productive expenditures. They become administrative overhead in this theory when they are required primarily because the underlying interaction cannot be safely relied upon.

This produces the second major proposition: when system reliability declines, the resources required to maintain an equivalent level of operational confidence may increase. The proposition is falsifiable. A controlled system can be given equivalent useful workloads under different levels of input reliability. Researchers can then measure verification operations, latency, communication volume, compute consumption, personnel hours, error correction, or other defined overhead. If unreliable inputs do not produce additional overhead under conditions where the architecture is expected to respond to them, the proposed relationship fails for that architecture.

Trust therefore functions as a mechanism for reducing uncertainty-management requirements rather than as an absolute moral good. A system can be highly secure without being highly trusting. A zero-trust architecture, for example, may intentionally verify every relevant interaction. That does not contradict Conservation Protocol. It demonstrates that trust can be replaced by verification. [8] The theory predicts a resource tradeoff, not that trust must always be maximized. If verification is cheap enough, a system may rationally operate with low implicit trust. If verification is expensive, reliable relationships or validated state representations may become more valuable.

The practical implication is that system designers should not attempt to maximize trust independently of architecture. They should minimize the total cost of maintaining reliable state. Sometimes that means increasing trust through authentication, reputation, transparency, or reliable commitments. Sometimes it means reducing exposure through encapsulation. Sometimes it means verifying an event. Sometimes it means isolating a compromised component. The conservation objective is not trust for its own sake. It is preservation of useful execution under finite resource constraints.

Defection Mass

An earlier formulation treated deception as physically measurable by associating additional information storage with a greater physical burden. The current formulation rejects that interpretation and instead defines Defection Mass as a systems-level measure of additional operational burden.

Defection Mass, denoted ΔD\Delta D, is defined as the additional burden imposed on a system by an input, action, or state transition that increases the amount of verification, reconciliation, coordination, remediation, or protective isolation required to maintain valid operation. It is not physical mass. It is not measured in kilograms. It is a bookkeeping construct for system burden.

ΔD = wᵤU + wᵥV + w꜀C + wᵣR

Where the terms represent generalized components of system burden and the coefficients are system-specific parameters whose calibration depends on the architecture and measurement framework under study.

The coefficients are system-specific parameters whose calibration depends on the architecture and measurement framework under study. They are not universal constants. The public formulation intentionally defines the structure of the quantity without publishing proprietary calibration weights, empirical parameterization, or implementation-specific scoring methodology. A false statement does not automatically possess Defection Mass. It produces Defection Mass only when it causes a measurable increase in system-management requirements relative to the appropriate baseline. A truthful statement can also create a burden if it introduces complexity, ambiguity, or a large verification requirement. Conversely, a false statement that is never relied upon may create little or no measurable burden. The quantity therefore belongs to the interaction between information and architecture, not to the semantic label of the information itself.

Defection Mass can be understood as state-management burden. If a system receives one reliable state, it may proceed with one expected transition. If it receives conflicting or unreliable states, it may need to preserve multiple possibilities until uncertainty is resolved. The receiving architecture may need to ask which state is authoritative, whether another component has been compromised, whether prior actions must be reversed, and whether downstream outputs can still be trusted. Each unresolved question expands the operational state the system must manage.

This connects the framework to the established systems concept of state-space expansion. [9] For k unresolved binary contingencies, the number of possible combinations can grow as high as Ω ≤ 2ᵏ under the simplifying assumptions described below.

This expression is not a claim that every real system literally enumerates all 2k2^k states. It describes an upper bound on the number of binary combinations that may have to be distinguished if each contingency is independent and relevant to the decision process. The practical burden depends on architecture, correlations, pruning strategies, prior information, and the cost of resolving each uncertainty.

The importance of this distinction is substantial. The theory no longer says that deception bends space, creates gravitational fields, or adds literal mass to a person or computer. It says that unreliable state information can increase the number of conditions a system must distinguish before safely executing its intended operation. That increase can produce additional computational, administrative, temporal, or physical resource requirements. The proposition can therefore be measured without inventing a new physical force.

The relationship can be represented as a causal chain:

Unreliable Input→State Uncertainty→Verification or Reconciliation→Administrative Burden→Reduced Available Capacity for Intended Work.

This is the core mechanism of Conservation Protocol.

It does not require every system to behave identically. It requires that, where the architecture responds to uncertainty through additional state-management operations, those operations consume measurable resources. The magnitude of the effect becomes an empirical question.

Administrative Entropy

Within the Conservation Protocol, “Administrative Entropy” is used as a proposed systems variable describing the accumulation of system-management activity required to preserve operational integrity as uncertainty, conflict, or unreliable state conditions increase. The term itself is not presented as a claim of linguistic or historical priority; the proposed contribution lies in how the construct is defined and integrated into the Conservation Protocol's broader systems model.

Administrative Entropy can include verification cycles, redundant communication, reconciliation, audit activity, exception handling, access-control decisions, dispute resolution, remediation, monitoring, recovery, and other operations that exist because the system cannot safely proceed on the basis of its ordinary state assumptions. Some of these activities are essential and valuable. Their classification as administrative overhead refers to their relationship to the system's primary intended execution, not to whether they are inherently useless.

The system does not necessarily waste energy simply because it verifies something. Verification may be the correct and necessary use of energy. The relevant measurement is the difference in resource requirements between comparable conditions with and without the additional uncertainty. If a verification process prevents a much larger loss, it may improve total system efficiency even though it increases immediate administrative expenditure.

The conservation problem therefore concerns optimization under uncertainty. The objective is not to eliminate verification, but to allocate verification where its expected value justifies its resource cost. This makes event-triggered governance an important architectural question examined later in the model.

Energy Accounting

The energy model must likewise be separated from any metaphorical language. The theory does not assume that moral failure directly produces a unique quantity of heat. It instead models the physical resources consumed by the operations that follow from unreliable state.

Let total system energy or resource expenditure over a defined interval be represented by:

Etotal=Φnet+Ebase+Eadmin+Ediss.

The variables must be defined according to the system being studied. Electrical power may be appropriate for a computing system. Processor time, memory operations, latency, and network traffic may provide additional measures. In an institution, personnel hours, transaction costs, legal expenditure, audit time, or delayed throughput may be more meaningful. In biology, metabolic expenditure and other physiological measures may be appropriate. These quantities should not be casually treated as interchangeable. The theory predicts a structural relationship among them, not numerical identity across domains.

Moral Efficiency, therefore, is defined within this theory as:

ηₘ = Φnet / Eavailable

The subscript m does not mean that the equation proves an objective moral truth. It identifies the proposed efficiency measure within the Conservation Protocol framework. A system can have high moral efficiency when a large proportion of resources beyond baseline operation reaches intended execution rather than additional integrity-management activity.

The value of this formulation is that it removes the unsupported assumption that perfect honesty produces zero waste. No real system has zero overhead. Authentication, error correction, redundancy, maintenance, and security may remain necessary even in a highly reliable environment. The theoretical target is therefore not zero administrative cost. It is the minimum feasible cost consistent with the required level of reliability, safety, and performance.

The resulting prediction is straightforward. If a system is subjected to an experimentally controlled increase in unresolved state uncertainty while useful workload and baseline conditions remain approximately constant, then the theory predicts an increase in the resources required for verification, reconciliation, coordination, or remediation, provided that the architecture actually performs those operations. If no increase occurs, or if the relationship reverses systematically under controlled conditions, the proposed mechanism must be revised or rejected for that system.

This is the point at which Conservation Protocol becomes falsifiable. The theory does not need to demonstrate that morality is a fundamental force. It needs to demonstrate that information integrity, trust assumptions, state uncertainty, and administrative resource requirements exhibit the predicted relationships under defined conditions.

Execution Lock

Execution Lock is the proposed limiting condition of the model. It occurs when the resources required to maintain system integrity consume the resources otherwise available for intended execution.

The threshold can be represented as:

Eadmin+Ediss≥Eavailable

Under the simplified model, the remaining capacity for net intended execution approaches zero:

Φnet≤0

These equations represent the generalized public formulation of the proposed condition. The specific operational threshold for a given architecture would require empirical calibration of the relevant resource, workload, integrity-management, and performance variables. Execution Lock should therefore be treated as a proposed architectural threshold, not as a claim of a universal physical phase transition.

This does not mean that every failing organization, computer, or biological system literally reaches a mathematical zero. It defines a limiting condition. A system may become practically nonfunctional before the theoretical boundary is reached because latency becomes unacceptable, users withdraw, resources become inaccessible, or other failure conditions emerge. Execution Lock is therefore best understood as a proposed regime in which integrity-maintenance costs dominate intended execution.

The concept is stronger when treated as an architectural threshold rather than a universal physical phase transition. A system can respond to increasing burden by adding resources, simplifying its state space, reducing its attack surface, isolating compromised components, changing its workload, or shutting down selected functions. The location of the threshold therefore depends on architecture and available resources. The generalized condition is public; specific threshold calibration, parameterization, and empirical determination remain dependent on the system under study and are part of the continuing research program. What is predicted to remain general is the resource competition: resources devoted to integrity maintenance cannot simultaneously perform the same useful execution.

Execution Lock consequently provides a testable engineering question. Given a defined system, workload, and resource budget, can the increase in integrity-management burden be measured, and does there exist a point beyond which intended throughput, availability, or execution quality collapses? If so, can that threshold be predicted from measurable variables such as unresolved states, verification frequency, coordination requirements, and available capacity? If not, the proposed model of execution lock is incomplete.

Encapsulation, Isolation, and Useful Work

A conservation protocol cannot require unlimited disclosure. Complete transparency is not equivalent to information integrity. Systems routinely protect themselves through encapsulation. A software module exposes an interface without exposing every internal operation. A biological cell regulates what crosses its membrane. An organization may restrict internal information to authorized participants. In each case, internal state can remain private while externally relevant outputs remain subject to defined integrity requirements.

Encapsulation therefore becomes a structural mechanism of conservation. By limiting which information must cross a boundary, the system reduces communication volume, verification scope, and unnecessary exposure. The framework distinguishes this from deception: privacy keeps information within an authorized boundary, while deception causes an external component to rely on an inaccurate representation of a relevant state.

Isolation serves a related function. When a component is suspected or confirmed to have violated the system's integrity requirements, the system does not necessarily need to monitor every other component more aggressively. It can reduce the problem's scope by restricting the compromised component's ability to affect additional states. The framework describes this as a quarantine or circuit-breaker strategy. The framework does not assume that isolation is universally cheaper than enforcement. Its value is conditional: isolation is useful when the cost of limiting the affected component is lower than the expected cost of continued exposure or continuous investigation.

Useful work must likewise be defined relative to system purpose rather than external appearance. Rest can be useful for a biological organism because it contributes to recovery. Maintenance can be useful because it preserves future execution. Security can be useful because it prevents larger losses. The theory therefore distinguishes useful work from unnecessary administrative burden by asking whether an expenditure contributes to the system's defined objective or is imposed primarily to compensate for preventable uncertainty.

This distinction prevents the framework from becoming an argument against governance, security, or accountability. The objective is not to eliminate those functions. The objective is to prevent the governance layer from consuming more capacity than the system can sustain while still accomplishing its intended work.

Boundaries and Event-Driven Governance

Every system has a boundary, whether physical, computational, organizational, or conceptual. The boundary determines which inputs and outputs are governed by the system's rules. Conservation Protocol treats the boundary as a control surface rather than a demand for total isolation. A system does not need to control its entire external environment. It needs to control the conditions under which external information or resources enter and affect internal state.

This produces a boundary rule: verification should be concentrated at points where state changes cross a meaningful control boundary. Incoming data, permissions, transactions, commands, and other state-changing events can be evaluated at the interface through which they enter the governed system. Once inside, encapsulation can limit unnecessary propagation of internal complexity.

The framework's event-triggered governance architecture follows directly from this principle. Baseline execution operates with low administrative overhead. A defined anomaly signal triggers a targeted verification process. If the state is validated, the system returns to baseline. If a breach is confirmed, the affected connection or execution path is isolated.

The architecture can therefore be represented as three states: baseline execution, triggered verification, and isolation or circuit break. The purpose is not to eliminate monitoring. It is to make monitoring proportional to evidence of risk. Continuous surveillance is one possible architecture, but it carries its own cost. A system that spends excessive resources searching for hypothetical failures can reduce the capacity available for actual execution. Event-driven governance is proposed as a way to reduce that baseline burden while preserving a mechanism for escalation when evidence changes.

This architecture also creates a direct empirical prediction. If a system can detect meaningful anomalies without continuously evaluating every state, and if targeted verification reliably distinguishes benign variation from integrity failures, then event-driven governance should require less baseline administrative overhead than continuous full-state verification at comparable levels of protection. If it cannot, or if delayed detection produces greater total costs than continuous monitoring, the event-driven architecture may not be superior for that system.

The conservation principle therefore does not prescribe one universal governance structure. It establishes a design objective: maintain sufficient state integrity while minimizing unnecessary resource expenditure on integrity management. Encapsulation, proportional verification, event-triggered auditing, and circuit breaking are mechanisms proposed to achieve that objective under appropriate conditions.

By Maurice Turner, Jr.

https://www.linkedin.com/pulse/conservation-protocol-indeimo-infrastructure-38ole

Continue the Conservation Protocol

Part 2 extends the foundational model into applications, falsifiability, boundary conditions, and research methodology.

Read Part 2 →

Canonical source: This page is the public canonical version of the Conservation Protocol. LinkedIn and other external publications may summarize or discuss this framework, but the Indeimo website is the authoritative source for the definitions and current public formulation.

References / Foundations

1. Metabolic Homeostasis in Life as We Know It: Its Origin and Thermodynamic Basis. PMC.

2. Shannon, C. E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal, 27(3), 379–423.

3. Stanford Encyclopedia of Philosophy. Information Processing and Thermodynamic Entropy.

4. Stanford Encyclopedia of Philosophy. Philosophy of Statistical Mechanics.

5. Güven, N., & Utlu, Z. (2026). Thermodynamics of Governance: Exergy Efficiency, Political Entropy, and Systemic Sustainability in Policy System. Sustainability, 18(2), 937.

6. Stanford Encyclopedia of Philosophy. Game Theory.

7. North, D. C. (1991). Institutions. Journal of Economic Perspectives, 5(1), 97–112.

8. NIST. A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments, SP 800-207A.

9. Kalman, R. E. (1960). On the General Theory of Control Systems. Proceedings of the First IFAC World Congress, IFAC Proceedings Volumes, 1(1), 491–502. https://doi.org/10.1016/S1474-6670(17)70094-8

10. INCOSE. Guide to Verification and Validation, INCOSE-TP-2021-004-01.