Security & Access Control - Architecture Brief
Architecture Brief
Date: 2026-06-27
This brief establishes the target direction for the Security & Access Control module and defines the architectural structure through which its business vision is to be implemented. The module is a central specification for trust, authority, accountability, cybersecurity, markets, transactions, artificial intelligence and cross-organizational participation in Synallagi.
Governing thesis
Security and Access Control in Synallagi is not only the administration of users, roles, passwords, or screens throughout North American oil & gas. It is the operating policy system that determines:
- who or what is acting;
- whom they represent;
- which organization, Joint Operating Committee, market, transaction, asset, or assignment is in scope;
- what duty they are performing;
- which information and functions they may use;
- what business authority they possess;
- what accountability attaches to the action;
- what evidence must be retained; and
- when access must be denied, escalated, reviewed, suspended, or revoked.
The intended outcome is to enable the right person, with the right access, to the right information, at the right time, in the right place, on the right device, with the right authority, and through the right method of engagement.
Design posture
Synallagi should pursue quality of architecture over quantity of prose. The module should be built in layers:
1. Conceptual model.
2. Target architecture brief.
3. Technical companion specification.
4. Section-by-section expansion.
5. Traceability back to the original specification and related modules.
The immediate objective is not to finalize every rule. It is to establish a strong enough structure that later sections can be developed without repeatedly reopening the foundation.
There are few short-term solutions to the shortfall in geologists and engineers over the next twenty years. It takes the better part of that time to train them to operate in the industry. What we do know are several "things" being applied in the People, Ideas & Objects Synallagi. Many of these concepts are based on what we call Industrial Command and Control. Which is a method developed in the Security & Access Control module of imposing command and control over any and all Joint Operating Committees, working groups, producer firms, service providers or internal or external organizations the producer may need to add structure to. The concepts are the further hyper specialization and division of labor, and a reduction in the redundant building of capabilities within each oil & gas producer, or as we describe it, a pooling of resources in the Joint Operating Committee.
The first concept of specialization and division of labor is well known as a principle of economics that brings about greater economic productivity from the same volume of resources. Given that the volume of earth science & engineering resources is known for the foreseeable future. Specialization and the division of labor will provide industry with a tangible means to deal with oil & gas industry productivity. In today’s marketplace, approaching a heightened level of specialization and division of labor without software to define and support it would be unproductive.
The pooling concept is the solution to the current desire that each producer firm acquires the earth science & engineering capabilities necessary to deal with all the needs of their “operated” properties. This creates unneeded “just-in-time” capabilities for scarce scientific resources. When each producer within the industry pursues this same strategy substantial redundancies are built into the industry's capabilities. Redundancies that are left unused and unusable. What is proposed through the People, Ideas & Objects software application modules is that the producer's operational strategy avoids the “operator” concept. Instead, it pools their specialized technical resources through the Joint Operating Committee partnership. That way the redundancies that would have been present in the industry can be made available to the producers and used by the producers through hyper-specialization and division of labor.
These same principles are present in the second issue noted above. The administrative and accounting capabilities acquired through industry-wide capabilities provide the producer with the flexibility to address operational concerns. Issues such as today’s low natural gas prices can be addressed through this revised structure. By having administrative and accounting service providers charge their service fees directly to the Joint Operating Committee. The producer gains the ability to shut-in unprofitable production with only positive effects on their financial performance. Administrative, accounting, and production costs are eliminated during shut-in production. Providing the most profitable means of oil & gas operations when unprofitable properties no longer dilute profitable properties. Producers can save their reserves for the time when they can be produced profitably. Reserves costs don't have to carry additional losses if unprofitable production continues. Reserves can be seen as a low-cost solution to production and storage. Commodity prices will have less volatility due to producers removing marginal production from the marketplace. And petroleum reserves values are maximized when prices determine reserves value and the volume of commercial reserves available.
Domain position
Synallagi is ecosystem-informed, user community-led, service provider-enabled, and technologically supported. Producers are essential participants, but they are not the exclusive source of operating knowledge.
The Security and Access Control module must therefore support a larger operating community:
- producers;
- Joint Operating Committees;
- working-interest participants;
- service providers;
- suppliers;
- engineers;
- geologists;
- accountants;
- administrators;
- auditors;
- financial participants;
- market participants;
- technology providers;
- artificial intelligence specialists;
- cybersecurity specialists; and
- People, Ideas & Objects.
The module must preserve independence, information rights, authority limits, and accountability while allowing these parties to collaborate through common transactions, markets, infrastructure, and evidence.
Being able to provide service providers with access to and security during these day-to-day operations will be a unique situation for the oil & gas producer. Service providers will aggregate data industry wide. Although the data they access will be voluminous, unattributable to its owner and of a specialized nature. And there will be many service providers involved in providing administrative and accounting services to the producer firm and Joint Operating Committees. Consideration of the security, access control and proprietary nature of the information will be priorities for Synallagi.
A quick note on mobility. People are provided with new devices that enable them to work anywhere. These phones and tablets, in addition to laptop computers, open up security and access control concerns for the innovative and profitable oil & gas producer. Some producers enable their staff with policies that allow them to bring their own devices to work. The fact is these devices provide enhanced productivity and are appropriate for an innovative and profitable oil & gas producer. People, Ideas & Objects Synallagi includes an understanding that these devices will be part of the day to day used in the oil & gas industry.
What these concepts require is what the Security & Access Control module is designed to provide. The system must provide access to the right person at the right time and at the right place, on the right device with the right authority to the right information and through the right method of engagement. With the Industrial Command & Control there will be a manner in which the technical, and all the resources, that have been pooled from the producers, interact with an appropriate governance and chain of command.
Organizational constructs
The module shall align with the nine organizational constructs currently identified for Synallagi:
1. Joint Operating Committee.
2. Endogenous Technical Change and sharing of infrastructure.
3. Hyper-specialization and division of labor.
4. Markets.
5. Innovation.
6. Intellectual Property.
7. Information Technology.
8. Trust.
9. Transactions.
These constructs are not merely labels. They define, support, and constrain what Synallagi recognize as legitimate organization, work, information, authority, access, and accountability.
Architectural principles
Explicit representation
Every consequential action must identify the party, organization, Joint Operating Committee, market, transaction, or other construct on whose behalf the action is performed.
No authority by implication
Access to a function does not by itself grant authority to commit a party, approve an expenditure, publish information, disclose market data, direct work, or bind a Joint Operating Committee.
Contextual least privilege
Access must be limited by duty, transaction, information classification, organizational construct, Joint Operating Committee, property, agreement, market, working interest, authority, time, device, session assurance, and accountability.
Accountability as a product strength
Accountability, auditability, and evidence are competitive strengths of Synallagi. The module should help restore confidence in oil & gas administration, financial reporting, investor communication, and operating integrity. As is noted earlier in the Industrial Command & Control section of this specification.
Cybersecurity is integral
Cybersecurity is not a separate afterthought. Identity compromise, unauthorized access, malicious administration, data leakage, ransomware, integration abuse, artificial intelligence misuse, and market manipulation all belong within the scope of this module.
Markets and asset participation
Markets are first-class security contexts. Marketplace access, disclosure, offer authority, bid authority, settlement, investment participation, and asset securitization require explicit authorization and evidence.
Blockchain, stablecoins, and crypto-based participation
Where Synallagi supports blockchain records, stablecoin settlement, digital wallets, or crypto-based participation in oil & gas assets, the module must govern identity, wallet control, beneficial ownership, transaction authority, investor reporting, financial statement publication, disclosure, custody, settlement, revocation, and incident response.
Artificial Intelligence under policy
Artificial intelligence systems may advise, prepare, reconcile, classify, monitor, or recommend. They may not infer representation, disclosure rights, or business authority. Any autonomous action requires explicit policy, accountable ownership, audit evidence, and enforceable guardrails.
Required conceptual separations
The module must keep the following concepts separate, even when an implementation platform combines parts of them:
- identity;
- authentication;
- organization;
- organizational relationship;
- represented party;
- Joint Operating Committee membership;
- market participation;
- wallet or payment instrument control;
- business role;
- duty;
- privilege;
- data entitlement;
- authority;
- responsibility;
- accountability;
- delegation;
- transaction state;
- information classification;
- cybersecurity risk;
- audit event; and
- policy decision.
This separation is necessary because a person may be authenticated but not authorized, employed but not assigned, assigned but not empowered, empowered but conflicted, or technically able to act without business authority.
Open design decisions
The following items should not be forced prematurely:- the detailed role and duty catalogue;
- the detailed market participation model;
- wallet identity and beneficial ownership rules;
- stablecoin settlement and custody requirements;
- blockchain record authority;
- crypto-based asset securitization workflow;
- investor reporting from the Joint Operating Committee level;
- cybersecurity incident classifications;
- artificial intelligence execution boundaries;
- Targeting Framework access rules;
- revocation timing by event type;
- audit participation by accounting firms; and
- exact Oracle implementation mapping.
Only to Start the Ball Rolling for Our User Community
These decisions should be developed through focused pages and later folded into the module.
