A Digital Twin Needs an Authority Boundary Before Hardware Changes

A virtual result can become a proposed physical action

The UK and United States are planning to connect two powerful computing platforms dedicated to fusion research.

The UK Atomic Energy Authority and Princeton Plasma Physics Laboratory intend to combine experimental information from fusion machines in Oxfordshire and New Jersey. Their proposed SUNRISE–STELLAR-AI Federation would support shared AI development and could lead to digital twins of both facilities.

A digital twin allows researchers to explore a change virtually before applying it to expensive physical equipment.

That is valuable because fusion experiments are complex, data-intensive and difficult to reproduce across different machines. UKAEA says models trained using one facility can struggle to predict results on another. Combining information from two related facilities could therefore produce more useful models and shorten future design work.

It also creates a governance question that applies far beyond fusion: when a digital twin recommends a change, who decides whether the real system should make it?

Simulation and authority perform different jobs

Suppose an AI-enabled twin evaluates previous experiments and proposes a new configuration for the next one.

The virtual environment may estimate the likely result. Researchers may examine the proposal and compare it with previous evidence. The AI may assign the recommendation a high level of confidence.

None of those things grants authority to alter the physical facility.

A prediction is an input to that decision. It should not become the decision authority simply because it was produced by an advanced model.

• Which machine and experiment are involved?
• Precisely what change has been requested?
• Which data and model version informed it?
• Does the proposal remain within approved operating limits?
• Which laboratory or role possesses the necessary authority?
• Must another specialist review it?
• What should happen when important information is missing or contradictory?

Shared models make provenance operational

The proposed federation would combine data and computing from facilities in two countries.

That can improve research, but it also means that a future recommendation may depend on experimental data produced by one facility, simulated data used to extend the available dataset, a model trained across both laboratories, a particular software or model version, current information about the physical machine and the authority applicable in the laboratory conducting the experiment.

Provenance therefore affects whether a proposal can be trusted for its intended purpose.

A model may have been properly trained and still be unsuitable for a particular machine state. A dataset may be scientifically valuable but no longer current enough to support a live change. A proposal may fall within the authority of one research environment while requiring separate approval in another.

Those conditions need to be available when the action is evaluated—not reconstructed only after the experiment.

The governed result may be narrower than the proposal

A useful authority boundary needs more options than accepting or rejecting the complete recommendation.

A proposed change could be allowed because it falls within an approved experimental plan; denied because it affects the wrong facility or exceeds current authority; modified to remain within a permitted operating range; stepped up to an appropriately authorised specialist; or stopped at the line because the physical asset, current state or supporting evidence cannot be established reliably.

Stopping the line in this setting would apply to the proposed change. It would not necessarily switch off the AI model, the digital twin, the computing platform or unrelated research.

The model could continue analysing data. Other authorised experiments could proceed. The prohibited or unsupported effect would remain unable to cross into the physical system.

Begin by governing simulated proposals

A suitable PF Systems discovery exercise would not connect to live fusion controls.

A controlled shadow trial could use a simulator, digital twin or synthetic workflow to produce representative proposals. PF Systems could evaluate copies of those proposals without altering an experiment or issuing a command to physical equipment.

PF Memory would provide the approved context used for the evaluation. PF Kernel would return Allow, Deny, Modify, Step Up or Stop the Line. PF Core would preserve the linked evidence required to trace, check and deterministically replay the governed evaluation.

The physical executor would still need to provide trusted evidence of what became effective. An authority record alone cannot prove that the machine carried out the change or that the predicted scientific result occurred.

PF Systems does not claim to validate fusion models, guarantee safe operation or establish regulatory compliance. Production use would require separate technical, scientific, security, operational and independent-assurance work.

• Is the proposed effect identified precisely?
• Is appropriate authority available?
• Does cross-laboratory information retain usable provenance?
• Can an over-broad proposal be narrowed?
• Does a changed proposal require a new evaluation?
• Does missing evidence produce the intended intervention?
• Can reviewers reconstruct the governed evaluation afterwards?

The immediate proposition is narrower: digital twins can help organisations understand what might happen. A separate authority boundary should govern what is permitted to happen next.