Security & Access Control — Business and Technical Specifications. Part I
Note to Our User Community
This specification represents the beginning of the development process rather than its conclusion. It establishes the purposes, operating concepts, essential capabilities, responsibilities, controls, and architectural boundaries presently understood to be necessary for Synallagi. It does not contain every requirement that developers will eventually need, nor should it be interpreted as prescribing every design decision that will be made.
As custody of the specification passes from its originator to the Synallagi user community, responsibility for its continued development passes with it. Members of the community will be expected to test its assumptions against their experience, identify missing requirements, resolve ambiguities, and develop the operational detail needed to transform its concepts into a working product.
This transfer is not intended to constrain the community to the ideas presently documented. Members should feel free to propose new capabilities within the community, challenge existing assumptions, and pursue better ways of satisfying the purposes of Synallagi. They should build collaborative support for their ideas and support material proposals with detailed analysis of the business need, affected users, alternatives, benefits, costs, risks, dependencies, authorities, controls, and consequences involved.
Ideas should be welcomed while they are still forming. However, an idea should become a development requirement only after it’s been examined sufficiently to demonstrate that it addresses a genuine need, fits the wider product, and is supported by those whose work or responsibilities it will affect directly.
The community must avoid adding products, technologies, processes, controls, or complexity merely because they are available. Technical sophistication is not a benefit by itself. Every material addition should correspond to a defined business, operational, security, regulatory, or architectural requirement. The objective is to satisfy the needs of Synallagi completely and responsibly without burdening its users, developers, operators, or producers with unnecessary complexity and cost.
Under the Synallagi user community license, a qualified member may receive exclusive rights and corresponding responsibilities for a defined process domain that the member undertakes to manage on behalf of the oil & gas industry. These rights establish accountable stewardship. They are not merely permission to influence the product or control a body of functionality.
The Synallagi user community license establishes the following foundational principles of accountable stewardship and independent governance. These rights ensure that the community remains the primary driver of the product:
- Exclusive authority to modify, develop, or create derivative works from the underlying intellectual property of Synallagi is reserved solely for licensed community members.
- People, Ideas & Objects developers maintain an exclusive focus on community-led requirements, remaining unresponsive to external influences that have not been reconciled through our user community.
- Members operate as independent business participants with autonomous budgetary control, ensuring their contributions represent genuine industry needs rather than the interests of external funding sources.
The license provides for the service-provider organization that the member will own and operate to implement, operate, maintain, support, and continue developing the processes within that domain. The member must therefore consider the complete life of the process, including:
- Maintaining its business and technical specifications.
- Building informed and representative support for proposed requirements.
- Defining the information, actions, authority, events, controls, and evidence required.
- Reconciling competing user needs and documenting material decisions.
- Coordinating requirements that affect other Synallagi process domains.
- Working with architects and developers to produce compatible solutions.
- Establishing testing, acceptance, security, service, operational, and maintenance requirements.
- Providing the documentation, training, support, governance, and continuity necessary for dependable industry use.
- Managing future changes without losing the purpose, integrity, compatibility, or accumulated knowledge of the process domain.
Exclusive stewardship does not create unlimited authority to expand a process domain, introduce unnecessary complexity, or make decisions affecting other domains without consultation. Every material addition must remain traceable to a demonstrated industry requirement. Changes crossing process-domain boundaries must be collaboratively developed and reconciled within the wider Synallagi specification.
The proficiency demonstrated by Elon Musk in executing scientific endeavors of immense scale and intricacy remains unrivaled. Central to his methodology is an "algorithm"—a set of principles he asserts are fundamental to his success. Within Synallagi, this framework serves as a vital conceptual cornerstone, guiding our user community in the meticulous development and delivery of their products. As detailed in Walter Isaacson's Elon Musk, this algorithm consists of five essential components. (Isaacson, 2023, pp. 282, 284–285)
1. Question every requirement.
All requirements should be attached to the name of the person who made it. Always question the requirements, no matter who made it, and then try to improve them. p. 284
People, Ideas & Objects will require each of our user community members and developers to digitally sign their contributions. This process offers two key benefits: it ensures accountability by identifying the responsible individual, and it helps allocate service provider organizations to specific processes within Synallagi. The allocation will be determined by an AI algorithm developed by our user community, with digital signatures assisting in the guiding of appropriate assignments.
2. Delete any part or process you can.
You may have to add them back later. In fact, if you do not end up adding back at least 10% of them, then you didn’t delete enough. p. 284
Given the oil & gas industry's high rate of data distribution and duplication, this step challenges us to consider whether a single data source could eliminate redundancy. For further insight, refer to E.F. Codd’s Relational Theory in the bibliography. Where sharing the same data to different users who perceive the data differently.
A key lesson from software development is that while adding features is simple, it often leads to feature bloat; true innovation lies in simplifying the interface by removing unnecessary elements—even if that removal faces resistance.
3. Simplify and optimize.
This should come after step two. A common mistake is to simplify and optimize a part or a process that should not exist. p. 284
Although straightforward, this step underscores the time constraints often imposed by quarterly requirements, which frequently force organizations to bypass this global perspective. In many ERP implementations, budgets dictate the elimination of the user committee is the first element skipped, making our prioritization of our user community a distinct competitive advantage, resulting in improved software quality.
4. Accelerate cycle time.
Every process can be speeded up. But only do this after you have followed the first three steps. In the Tesla factory, I mistakenly spent a lot of time accelerating processes that I later realized should have been deleted. p. 284
5. Automate.
That comes last. The big mistake in Nevada and at Fremont was that I began by trying to automate every step. We should have waited until all the requirements had been questioned, parts and processes deleted, and the bugs were shaken out. p. 285
“If conventional thinking makes your mission impossible,” Musk told him, “then unconventional thinking is necessary.” p. 282
Synallagi divides automation into two distinct areas. The first area encompasses the automation integrated with Oracle Cloud ERP, included upon discovery. The second area involves automating the processes within Synallagi itself, which has been deferred to the third phase of development. For further details, please refer to our 2/10/2025 paper. Innovative Organization Excellence: How Elon Musk and Visionary Leaders Build High-Performance Enterprises.
Licensed members must preserve reasonable opportunities for affected users and producers, Joint Operating Committees and markets to contribute knowledge, question assumptions, propose alternatives, and participate in validation. Exclusive rights establish responsibility and accountability; they must not prevent the collaboration from which the quality and legitimacy of Synallagi will be derived.
The original specification provides the foundation. Our user community will transform that foundation into complete and testable requirements. Licensed process-domain stewards will establish and operate the service-provider organizations through which those requirements can be implemented, maintained, supported, and improved over time.
The quality of Synallagi ERP software will ultimately depend upon the quality of our user community and their stewardship.
Introduction
Joint Operating Committees are the key organizational construct of a dynamic, innovative, accountable and profitable oil & gas company. It is the interactions of many producers, service providers and suppliers who are involved in the day to day commercial and strategic concerns of that Joint Operating Committee that we need to concern ourselves with. The Security & Access Control module's focus is to ensure the right people have the right access to the right information with the right authority. This is at the right time at the right place and through the right device.
Throughout Synallagi we discuss two of the most pressing operational issues in the oil & gas industry. Those being the demand for earth science & engineering effort is increasing with each barrel produced. This is best represented by the steep escalation of oil & gas exploration and production costs. At the same time, critical earth science & engineering resources are fixed and difficult to expand. And with the anticipated retirement of this brain trust in the next twenty years, the problem becomes critical. The second issue regards the manner in which the administrative and accounting resources are organized within the industry. With Synallagi the need for each producer to develop their own administrative and accounting capabilities internally is replaced by an overall industry capability. Then each producer can access those resources on a variable cost basis with direct charges to the Joint Operating Committee. This provides operational flexibility in how a producer approaches its strategic and tactical needs to their distinct competitive advantages.
Business Specifications
Two Types of Data
When we talk about the various people within the producer firms affiliated with a Joint Operating Committee. And the number of Joint Operating Committees that a firm may have an interest in. And the number of people a firm employs. Access control becomes challenging. It becomes a challenge when we consider that people certainly should have the access required, but the level of trust they may have with respect to other partner organizations is probably not as strong. That is to say, does using the Joint Operating Committee as the key organizational construct of a dynamic, innovative, accountable and profitable oil & gas producer, open the producer firm to data loss? This is how People, Ideas & Objects deal with the access and trust issue in the Security & Access Control module.
3.10 Data entitlement
A data entitlement identifies the resources and records to which a privilege applies. Relevant scopes may include organization, business unit, ledger, Joint Operating Committee, property, well, agreement, partner, marketplace, wallet, blockchain address, work order, Authorization for Expenditure, voucher, settlement, or transaction.
Oracle AI Database 26ai or a later approved release is the intended principal data platform. Synallagi should therefore be treated in significant part as database-centred development, while access remains governed consistently through the application, policy, integration, and database layers.
When we concern ourselves with the data and information of the producer firm. We concern ourselves with the information cleared by the various Joint Operating Committees that the oil & gas producer’s interest is in. We can all agree that this information is proprietary and subject to each producer firm's internal policies. (Information such as reserves data, accounting information, internal reports and correspondence, strategy documents.) What we're concerned about is the information and data held in the Accounting Voucher module and the associated data common to the joint account. (well file, agreements, production data, capital and operating costs, revenue and royalties.)
Close analysis of these two types of data and information held within the firm and the Joint Operating Committee falls within the proprietary and partnership domains. In Canada at least, most data and information regarding well operations can be freely obtained through various regulatory agencies. Nonetheless, the majority of the data is shared through the partnership who have an interest in the data and information. Which is not the case with the producer firm's data. Most of the information is kept close at hand and reported through filtered reserve report summaries and annual reports. Therefore keeping a handle on proprietary data, while operating the Joint Operating Committee as the key organizational construct of the innovative oil & gas producer, as proposed by People, Ideas & Objects, does not present any data leakage.
Access control can therefore be limited by restricting any company personnel from viewing other companies' files. Which is a given. While in People, Ideas & Objects access control is restricted to the firm's Joint Operating Committees and the firm's files only. To extend this further, we would limit access to the appropriate roles within the firm. Then it is up to our user community to define a standard set of generic roles in which access is required to certain data types. This would apply to the types of operations handled by that role, for example, read, insert, update, delete. These generic roles could then be assigned to each individual within the organization based on their needs. Assigning multiple roles for more complex access. Access to proprietary data would be restricted to company personnel only.
Industrial Command & Control (ICC)
Throughout Synallagi we've discussed our solution to one of the premier issues the oil & gas industry faces. That is the demand for earth science & engineering effort per barrel of oil increases with each barrel produced. This is best represented by the steep escalation of oil & gas exploration and production costs over time. At the same time, critical earth science & engineering resources are fixed and difficult to expand in the short or medium term. Add to that the anticipated retirement over the next twenty years of the current brain trust of the industry and the problem becomes a critical concern.
What is proposed through the People, Ideas & Objects software application modules ICC is that the producer's operational strategy avoids the “operator” concept. Instead, it pools these technical resources through each of their partnerships represented in their Joint Operating Committees. That way the inefficiencies that would have been present in the industry can be made available and used through industry wide, producer focused, advanced and advancing specialization and division of labor. Where many of the lower end processes are offloaded to service providers who specialize in that basic skill on behalf of many producers. This is done in a geographical area or other specialization. And each individual producer focuses on a specialized element of science as it develops and innovates upon that.
People, Ideas & Objects believe producers will soon be unable to commercially support the full scale of engineering & earth science disciplines tasks and responsibilities as they have in house. This will be due to the shortages of resources, the cost escalation of these resources in the market due to their shortages, the expansion of demand from higher production volumes to achieve energy independence, the demands for more science in each incremental barrel of oil produced, the anticipated, substantial expansion of the sciences and the need to innovate upon that expanding science. For producers to maintain a broadened division of labor to deal with these issues and “operatorship” capabilities, it will extend them beyond any producer's commercial capacity.
What these concepts demand is what the Security & Access Control module is designed to provide through the ICC. The People, Ideas & Objects system must provide access to the right person at the right time and at the right place. This is with the right authority and the right information. With the ICC there will be a manner in which the technical and all the resources pooled from the producers, interact with the appropriate governance, compliance and industry standard chain of command.
Before the hierarch, a commercial development of the 20th century, only the military structure existed to organize large populations of individuals. The main difference between the two is subtle but significant. Military structures are broader and flatter than hierarchy. That is one of the ideals we are seeking, but the more significant feature is the ability for the chain of command to span multiple internal and external organizational structures and to move resources from different areas of the military through standardization.
The nature of people working through the industry-standard chain of command layered over the Joint Operating Committee will include all oil & gas disciplines. The contributions of staff, financial and technical resources will include all those employed by the industry today. I could foresee many office buildings being refurbished to accommodate the staff of a single Joint Operating Committee of a large property. There, staff from the different producers may be seconded to provide support for the Joint Operating Committee. They may work for a single Joint Operating Committee, not for any particular producer firm.
As background we should recall that each individual would have different access levels and authorizations to access to People, Ideas & Objects Synallagi. Assuming different roles and responsibilities, they would impose different access levels to data, information, processes and functionality. People, Ideas & Objects application modules rely on the Security & Access Control module to implement Industrial Command & Control. This structure, particularly in a Joint Operating Committee, would weave multiple producer firms under one industry standard chain of command. The interface ensures that all processes are monitored for compliance, governance, and overall completeness.
A principle of Synallagi is that North American oil & gas producers will earn the investment community’s support through competitive performance in capital markets—and through exceptional accountability, compliance, and governance.
Based on People, Ideas & Objects’ long-term observation and analysis of producer performance, the industry’s accountability, compliance and governance appear to operate at approximately one-quarter of the standard expected of a genuinely competitive industry. This is an informed analytical assessment rather than the result of a formal quantitative study.
For decades, the sector consumed capital while failing to deliver the fiduciary discipline investors should expect. It took the extraordinary endowment of shale—and destroyed it rather than creating any value.
After eleven years of raising these issues, their investors have seen little to no evidence of meaningful remediation. Investor trust must be earned through performance, accountability, and governance—not presumed. This begins with the Security & Access Control module.
Access, Roles and Responsibilities
This topic discusses the way authorizations, roles and responsibilities are handled in the Security & Access Control module of Synallagi. We should discuss the topic of delegating authority and responsibility during absences, which can come up from time to time.
As background we should recall that each individual would have different access levels and authorizations in terms of access to the People, Ideas & Objects systems. Assuming various roles and responsibilities, they would impose different access levels to data, information, processes and functionality. In addition, Security & Access Control is the key module for implementing Industrial Command & Control across People, Ideas & Objects. This structure, particularly in a Joint Operating Committee, would weave multiple producer firms under one chain of command. To ensure compliance, governance, and overall process completeness, it will need to provide an interface to ensure all processes are monitored.
Throughout Synallagi there is the perception of a heightened role for technology in enabling authorization to conduct operations. Thus, the ability to do things and get things done depends on collaborating with partners and authorizing actions through processes managed by the systems. This participation dictates that the designation of the roles in the Security & Access Control module “means” more than just data access; it imposes authority and responsibility to undertake actions on behalf of Joint Operating Committees and / or producer firms.
It is necessary to assign this authority within the Security & Access Control module during any absence. If someone with authority and responsibility is away for whatever reason, they should be able to assign their authority to another person. This will enable them to fill that role while away. This will ensure that the process isn’t held up during their absence. Delegations of authority have been used for years in large firms and with a system that imposes authorizations and responsibilities on specific roles, the ability to temporarily move them down, across or up the chain of command is a necessity to keep the organization functioning.
Lastly we should talk about the interface that helps to identify missing elements in a process. It would simply show the command structure of the people assigned to a Joint Operating Committee or a process. It would show their related role, authorizations and responsibilities. If someone is away, it would indicate who took over their role. It would help to identify how they could impose a chain of command to fill any vacancies. This would be particularly helpful if the role or process needed to be documented for compliance purposes.
Business Specification Conclusion
It is important to remember that here in the Security & Access Control module of Synallagi. That the role and identity-based Industrial Command & Control (ICC) as conceived here has not been implemented, developed or conceived anywhere else before. We are taking role and identity-based management to the next level with the ICC. This is done through the usage of the Joint Operating Committee, through pooling and taking advantage of specialization and the division of labor in the oil & gas industry.
Why are we bothering with the ICC and the Joint Operating Committee pooling of resources? The issue we are resolving is the finite number of earth science & engineering resources available to the industry. With the anticipated retirement levels in the next 20 years. With the time requirements to bring on increased levels of resources. And most importantly with the demands for more energy, and the demands for more earth science & engineering in each barrel of oil equivalent produced. We face long-term shortages of critical resources. The need to organize the industry, exploit specialization and division of labor, and Professor Paul Romer's theory of non-rival costs is necessary to increase the output from the same number of resources. Doing this without pooling the resources in the Joint Operating Committee will cause the producer firm to broaden the scale of their earth science & engineering capabilities beyond what would be a commercially viable concern. Synallagi notes that we have contributions from earth scientists and engineers from multiple producers working together to meet the objectives of the Joint Operating Committee. Therefore we need a means to organize themselves and that is the Industrial Command & Control of the Security & Access Control module.
How the ICC will be implemented will be determined by our user community. However, I can speculate that the Joint Operating Committee will have standard roles and identities used throughout the industry. Standardization provides many benefits and will be necessary in this instance to make technology work. One of the key benefits of standardization is enhanced innovation. The need to have the various areas "covered" regarding compliance and other requirements will require a standard template used by everyone. Everyone will know that that position is responsible for that role and responsibility. When Joint Operating Committees are small and have only a few people assigned, multiple roles can be assigned to one individual.
There are security and access control issues associated with the service industry and particularly service providers accessing People, Ideas & Objects systems and data. Removing administrative and accounting resources from the producer firms and organizing them in their own service providers provides significant operational flexibility to the innovative and profitable oil & gas producer. The Security & Access Control module ties these disparate organizations into highly organized replacements for the current bureaucracy. Contributing substantially to People, Ideas & Objects' overall tangible portion of our value proposition.
With the natural division in the types of information held within a producer and Joint Operating Committee. Producers will know that Synallagi can deliver the right information to the right people at the right time. Leakage of proprietary information can be mitigated by isolating company data. This is due to its unique nature and Oracle Label Securities' ability to restrict access to database fields.
Oracle’s products provide a strong layer of mission critical capabilities in the Security & Access Control module. Oracle provides comprehensive coverage of security, access control, audit, back up, recovery and roll management to name just a few of the highlights provided. Although this comes with additional costs, I am certain that no one will argue with the quality and peace of mind that these products bring.
