Valid defender grant
Maintenance ended at 14:00. The gateway reported session B active at 14:02. Gateway isolation was withheld. A valid scoped grant permitted session revocation. Fresh gateway readback at 14:02:15 confirms session B closed and the operator connection active.
Expired defender grant
With the same maintenance evidence and an expired defender grant, both proposals are withheld. Review required. Fresh readback reports session B active and the operator connection active. The agent causes no plant-state change. Inaction is not a general safety conclusion.
Method and assumptions
This is a deterministic explanatory sequence. Its records, decisions, and outcomes are defined by the state machine; they are not live utility data.
The approved maintenance window ends at 14:00. A gateway receipt at 14:02 reports remote session B still active. The configured maintenance policy permits revoking this session after that maintenance window, subject to the defender’s separate action grant.
There are two windows. The maintenance window governs the engineer’s work. The defender’s authorization window governs the defender’s power to act. In the default branch, the defender’s grant remains valid throughout this sequence. In the alternative branch, it expired before the investigation. The maintenance evidence is identical in both branches.
The grant covers session B, this approved maintenance record, and the valid defender window. It never permits gateway isolation. All proposed actions pass through an independent Action policy boundary; the defender cannot authorize its own request.
Only the valid branch dispatches session revocation, at explanation time 12 seconds. Session B closes at 14 seconds. A fresh gateway receipt at 15 seconds, labeled 14:02:15, verifies the specific connection states. The expired branch reads fresh state without applying either intervention. The shown time is part of the defined example.
The operator connection remains active, and the controller continues its existing local program in both branches. Motor rotation represents that stipulated behavior, not a physical simulation or measured speed. Playback and motor motion freeze when paused, offscreen, hidden, or complete. Reduced motion offers still stages.
The checks establish specific postconditions. They do not establish that the installation is safe or secure, or that inaction is universally safe.