By Micky Irons, founder of Mickai.
Operational authority over the grid is a sovereign act. The standards were written assuming a human holds the lever.
The line AI is quietly crossing
For a decade, machine learning on the bulk power system lived on the safe side of a bright line. It forecast load, flagged anomalies, ranked maintenance, and tuned set-points that a human operator still confirmed. The model advised. A person acted. NERC CIP, the family of Critical Infrastructure Protection standards that governs the North American grid, was built around that assumption: identifiable people and identifiable devices, each with access that can be enumerated, reviewed, and revoked.
That line is now being crossed in production. Closed-loop volt and VAR optimisation, automated topology reconfiguration, fast frequency response, and AI-assisted protection coordination are moving from recommendation to action, at timescales no operator can supervise in the moment. When a model trims a feeder or sheds a block of load in milliseconds, the human is no longer in the loop. The human is, at best, on the loop. That single shift breaks the evidentiary model the standards were built on.
Why CIP struggles with a model in the control path
CIP is, at heart, an accountability framework. CIP-004 ties access to named personnel. CIP-007 governs the systems they touch. CIP-010 demands configuration change management you can reconstruct after the fact. Every one of these controls assumes the consequential actor is a person or a static device whose state you can baseline. An autonomous model is neither. It has no badge. Its behaviour is a function of weights, inputs, and context that shift continuously, and the action it takes at 02:14 may not be reproducible from the logs you kept.
So the regulatory question quietly changes shape. It stops being "did an authorised human approve this" and becomes "can you prove, later, exactly what the model did, on what inputs, under what policy, and that nobody edited the record afterwards." Conventional logging cannot answer that. Syslog is mutable. SIEM retention is a policy, not a guarantee. A determined insider, or a compromised collector, can rewrite the very history an auditor relies on. The control action has happened. The witness to it is soft.
Accountability frameworks weigh evidence. When the consequential actor is a model, the scale tips toward a record nobody can fully trust.
The missing primitive: a sealed witness
What grid AI lacks is not more logging. It is a tamper-evident witness: a record of each consequential action that is sealed at the moment it happens, signed by something an auditor can verify independently, and impossible to alter without detection. Get that primitive right and the CIP conversation becomes tractable again. You may not be able to predict a model's every move, but you can prove its every move. Accountability shifts from the actor to the record, which is exactly where it has to live once the actor is software.
This is the gap Mickai was built around. Mickai is a Sovereign Intelligence Operating System (SIOS), not an app bolted onto an existing stack. It runs fifty specialised AI brains, twenty-five domain and twenty-five operational, on the operator's own hardware, fully offline-capable. That last property matters for the grid: an air-gapped control environment cannot phone home to a cloud audit service, and under CIP it should not want to.
The Open Audit Record
Inside the SIOS, every consequential action produces an Open Audit Record (OAR). The OAR captures what was done, by which brain, on what inputs, under what policy, and it is sealed and signed with FIPS 204 ML-DSA-65, the published NIST post-quantum signature standard. Mickai did not invent the standard. It adopts it, deliberately, because a grid record has to outlive the cryptography that protected it on day one. A control action sealed today should still be provable when a future adversary holds a quantum computer.
The effect on a CIP audit is direct. Instead of presenting logs and asking the auditor to trust that they were not edited, the operator presents signed records that verify mathematically. Any alteration breaks the signature. The question "did someone change this after the fact" stops being a matter of process assurance and becomes a matter of cryptographic fact.
Mnemosyne, the keeper of memory. Each consequential action is sealed at the moment it happens, signed, and rendered tamper-evident.
Anchoring permanence without spending anything
A signature proves a record was not altered. It does not, on its own, prove the record existed at a particular time and was not quietly produced later. For that, Mickai anchors a hash commitment of the record to Bitcoin through Pantheon, its own sovereign Layer 1 (native token PAN, fixed five billion supply). Only a compact cryptographic commitment leaves the operator's environment. The control data never does. Pantheon does not move bitcoin and is not a Bitcoin Layer 2. It commits a fingerprint of the sealed record into the most attestable timeline available, so the record gains an independent, permanent timestamp. Anchoring is not spending.
For a regulator, this closes the last loophole. The OAR proves integrity. The anchor proves existence-in-time. Together they give a grid operator something CIP has always wanted and never quite had: a control history that an adversary cannot rewrite, an insider cannot backdate, and an auditor can verify without trusting the operator's word.
What this means for the operator under CIP
None of this asks the grid to surrender autonomy to AI faster than it is comfortable. It does the opposite. By making every consequential action provable, the sealed witness lets an operator extend automation precisely because the accountability gap is closed behind it. CIP-010 change management stops being a reconstruction exercise and becomes a query against signed records. Incident response gains a forensic spine that holds up because it cannot be tampered with after the breach.
The honest framing is this. Mickai sits as the perimeter and the witness around AI in the control path; Trust Agent guards the edge of that perimeter. The standards do not yet name autonomous models as actors. They will have to. When they do, the operators who can already produce a sealed, signed, anchored record for every control action will not be scrambling to invent one. The portfolio behind this approach runs to 101 filed UK patent applications and around 2,234 claims, owned by Mickai LTD, named inventor Micky Irons. That is evidence the architecture is deliberate, not the headline. The headline is simpler. When the model takes the action, the record has to be unimpeachable.
Autonomy on the grid is fire worth taking, provided every act it performs leaves a witness no one can erase.
Written by Micky Irons. Originally published at https://mickai.co.uk/articles/nerc-cip-grid-ai-the-control-action-needs-a-sealed-witness. More from Micky Irons and Mickai at mickai.co.uk.
