Physical AI turns software decisions into actions in the real world. Yet many systems still depend on reachable brokers, reusable bearer tokens and detection after something has already gone wrong.
A valid credential may establish who is making a request. It does not necessarily prove that an authorized human approved the action, that the requester may control that specific machine or that the resulting action can be independently verified.
This white paper explores a different approach from Digital2Win and Atsign: make trust part of the architecture from the beginning instead of assembling it from disconnected security controls.
Why Physical AI requires a different trust model
Agents act at machine speed—and physical actions cannot always be undone
AI agents can issue commands continuously, chain decisions across systems and operate without a human reviewing every action. They also make it easier for attackers to discover configuration errors, exposed services and weaknesses in complex software environments.
In this setting, authentication answers only one question: “Who are you?” A trustworthy Physical AI control plane must also determine whether the system can be reached, whether an authorized human approved the action, whether that principal may act on the specific machine and whether the outcome can be independently verified.
Once an autonomous system moves, opens, stops or changes something in the physical world, detecting the problem afterward may be too late.
What this white paper explores
Four architectural properties for verifiable authority
Unreachable by default
Remove the exposed inbound control-plane ports that give attackers somewhere to scan, reach and present stolen credentials. Atsign NoPorts enables protected connections initiated without exposing a public control endpoint.Hardware proof of human presence
For consequential actions, establish authority with a physical security key rather than relying solely on a reusable software token. This binds approval to an authorized person and a specific moment.
Independent verification of physical behavior
Do not treat a device’s report about its own behavior as the sole source of truth. Corroborate what happened through independent observation and connect that evidence to the corresponding action record.Object-level authorization and signed provenance
Determine whether a principal may act on a particular robot, device or physical object—not merely whether the principal has authenticated. Record the decision and resulting action in a signed history that can be independently checked.
Build trust into the architecture—not around it
The joint Digital2Win and Atsign architecture connects human authority, protected connectivity, object-level authorization and signed provenance across the full cyber-physical loop.
The paper also examines how this model can support sovereign, on-premises and air-gapped environments without making cloud connectivity the root of trust.
