Critical Infrastructure Secure Context Profile

What this is. A critical-infrastructure readiness layer for the Secure Context Layer thesis. It turns current NIST, OWASP, CISA, and MCP guidance into generated evidence and a runtime evaluator before agents retrieve context or act near high-stakes systems.

Rechecked source anchors against the public MCP specification 2026-07-28 on August 21, 2026.

SecurityRecipes is positioned as The Secure Context Layer for Agentic AI. That position is more credible if the project can answer the hardest enterprise question: “Can this help us pilot agents in critical infrastructure without weakening safety, availability, privacy, oversight, or incident response?”

The Critical Infrastructure Secure Context Profile is the answer. It does not claim compliance with a future NIST profile. It creates an enterprise-ready scaffold now: sector profiles, hazard flags, required evidence, rollout lanes, reviewer views, and deterministic allow, hold, deny, or kill decisions.

Generated artifact

  • Source model: data/assurance/critical-infrastructure-secure-context-profile.json
  • Generator: scripts/generate_critical_infrastructure_secure_context_pack.py
  • Evidence pack: data/evidence/critical-infrastructure-secure-context-pack.json
  • Runtime evaluator: scripts/evaluate_critical_infrastructure_context_decision.py
  • MCP tools: recipes_critical_infrastructure_secure_context_pack,

Regenerate and validate the pack:

python3 scripts/generate_critical_infrastructure_secure_context_pack.py
python3 scripts/generate_critical_infrastructure_secure_context_pack.py --check

Evaluate a read-only pilot decision:

python3 scripts/evaluate_critical_infrastructure_context_decision.py \
  --sector-id energy-ot-ics \
  --workflow-id vulnerable-dependency-remediation \
  --action-class read_only_context \
  --agent-id sr-agent::vulnerable-dependency-remediation::codex \
  --run-id ci-readonly \
  --identity-id sr-agent::vulnerable-dependency-remediation::codex \
  --tenant-id ci-tenant \
  --context-package-hash sha256:context \
  --authorization-decision allow_authorized_mcp_request \
  --egress-decision allow_internal_context \
  --expect-decision allow_ci_read_only_context

Evaluate a held high-impact action:

python3 scripts/evaluate_critical_infrastructure_context_decision.py \
  --sector-id energy-ot-ics \
  --workflow-id base-image-remediation \
  --action-class critical_infrastructure_control \
  --agent-id sr-agent::base-image-remediation::codex \
  --run-id ci-hold \
  --identity-id sr-agent::base-image-remediation::codex \
  --tenant-id ci-tenant \
  --context-package-hash sha256:context \
  --authorization-decision allow_authorized_mcp_request \
  --egress-decision allow_internal_context \
  --flag affects_ot_or_ics=true \
  --expect-decision hold_for_ci_safety_case

Workflow at a glance

Critical Infrastructure Secure Context Profile workflow

Apply sector-specific context, identity, action, evidence, and high-impact controls to critical-infrastructure agent workflows.

secure-context

  1. Signal

    Select the sector profile

    Identify sector, operator, asset class, environment, safety function, workflow, jurisdiction, and business/mission impact.

  2. Scope

    Classify context and authority

    Map operational data, regulated information, remote access, tools, identities, vendors, actions, and cyber-physical effects.

  3. Decision

    Bind enhanced controls

    Require approved sources, isolation, least privilege, two-key review, deterministic gates, telemetry, receipts, incident, and recovery.

  4. Action

    Decide the operating mode

    Allow read-only analysis, guarded pilot, approved action, hold, deny, or kill unsafe high-impact requests.

  5. Proof

    Issue sector evidence

    Record profile, assumptions, controls, decision, owners, tests, exceptions, expiry, and regulator/reviewer view.

Decision gate

Are safety, mission, sector, data, authority, and recovery controls sufficient for the requested action and environment?

Proceed

Permit only the bounded sector profile with enhanced monitoring and approvals.

Hold or stop

Hold, deny, or kill actions that could affect safety, operations, protected data, or irreversible systems without complete evidence.

Evidence to retain

  • sector/asset/action classification
  • enhanced control and test evidence
  • operating-mode decision

Expected outputs

  • critical-infrastructure context profile
  • guarded pilot packet
  • high-impact hold/denial

Why this matters now

NIST’s April 2026 concept note says critical infrastructure will increasingly rely on AI across IT, OT, and ICS, and that the profile will help operators communicate trustworthiness requirements across AI and CI lifecycles and supply chains. That is exactly where SecurityRecipes can be useful: not by claiming agents are safe, but by forcing context, authorization, operator approval, telemetry, and incident evidence to exist before agents act.

This profile also reflects current MCP security guidance:

  • protected MCP calls need authorization, resource metadata, and scope minimization;
  • token passthrough, shadow MCP servers, unsafe local launches, and raw secret access are kill signals;
  • read-only context pilots are the default starting lane;
  • high-impact action classes require operator approval, a safety-case id, risk acceptance, receipt evidence, and severe-risk clearance.

Sector profiles

Sector Default decision Why it is high stakes
Energy, OT, and ICS hold_for_ci_safety_case Process control, grid reliability, safety interlocks, vendor remote access, and maintenance windows.
Healthcare and public health hold_for_ci_safety_case Regulated health data, care operations, clinical workflow availability, and emergency coordination.
Financial services hold_for_ci_safety_case Funds movement, market impact, model-route risk, fraud monitoring, and regulated-data leakage.
Water and wastewater hold_for_ci_safety_case Treatment operations, remote access, field response, and public-service continuity.
Transportation systems hold_for_ci_safety_case Passenger safety, logistics availability, signaling support, maintenance, and continuity.
Communications, cloud, and DNS hold_for_ci_safety_case Cross-sector dependencies, routing, identity, DNS, metadata services, and tenant isolation.

Runtime decisions

Decision Meaning
allow_ci_read_only_context Read-only or evidence-only context has identity, authorization, egress, and context hash evidence.
allow_ci_supervised_action A supervised action has sector safety-case evidence, operator approval, risk acceptance, receipt, authorization, egress, and severe-risk clearance.
hold_for_ci_safety_case Sector, run, approval, safety-case, risk, receipt, or policy evidence is missing.
deny_untrusted_ci_context Context is untrusted or lacks a context package hash.
kill_session_on_ci_hazard_signal Token passthrough, shadow MCP, unsafe local launch, raw secret access, or another runtime hazard appeared.

Product strategy

This is a stronger enterprise story than another static checklist.

Layer Value
Open foundation Public profile, generator, evidence pack, evaluator, docs, and MCP tools.
Production MCP server Hosted sector profiles, authorization checks, safety-case lookup, receipts, and policy evaluation.
Design-partner wedge Regulated teams can start with read-only context and prove whether agent evidence lowers review friction.
trust review fit Frontier labs, cloud providers, and security platforms need a credible way to sell agents into high-stakes sectors.

MCP examples

Get the summary:

{}

Get the energy profile:

{
  "sector_id": "energy-ot-ics"
}

Evaluate a critical-infrastructure read-only context request:

{
  "sector_id": "energy-ot-ics",
  "workflow_id": "vulnerable-dependency-remediation",
  "action_class": "read_only_context",
  "agent_id": "sr-agent::vulnerable-dependency-remediation::codex",
  "run_id": "ci-readonly",
  "identity_id": "sr-agent::vulnerable-dependency-remediation::codex",
  "tenant_id": "ci-tenant",
  "context_package_hash": "sha256:context",
  "authorization_decision": "allow_authorized_mcp_request",
  "egress_decision": "allow_internal_context"
}

Source anchors

See also