====== TWIN-010c — Require Authorization for Resource State Changes ======

[[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-03-twin-node-requirements:twin-010-control-twin-interaction:start|Go to TWIN-010 — Control Twin Interaction]]

===== Statement =====

The [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]] SHALL require authorization for each permitted interaction that changes the state of a [[dido:99_annexes:annex-b-terms-and-definitions:r:resource|Resource]].

===== Source =====

  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-001|[DTE1] U.S. Patent Application US20220237111A1]], modification of virtual and physical Twin Nodes, comparison of results, and validation
  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-002|[DTE2] Non-Traditional BAA Submission]], Digital Twin concepts, scenario testing, integration, monitoring, and Twin Nodes Selection
  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-009|[DTE9] Distributed Immutable Data Object Reference Architecture (DIDO-RA)]], Digital Twin and governance concepts

===== Rationale =====

A permitted interaction may change the state of a [[dido:99_annexes:annex-b-terms-and-definitions:r:resource|Resource]] participating in or affected by a [[dido:99_annexes:annex-b-terms-and-definitions:t:twin_relationship|Twin Relationship]].

Permission to perform an interaction does not establish authority to change Resource state.

Requiring authorization establishes a separate control decision for state-changing interactions and prevents technical capability, connectivity, interface availability, DDS discovery, Topic matching, or other implementation mechanisms from being interpreted as authority to modify a Resource.

This requirement establishes the authorization requirement. TWIN-010d separately prevents execution when the required authorization is absent or denied.

===== Applies To =====

  * [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:twin_relationship|Twin Relationship]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:r:resource|Resource]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration|Configuration]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_execution|Test Execution]]

===== Verification =====

Verification confirms that:

  - Each permitted interaction that changes Resource state requires authorization.
  - Interaction permission does not substitute for authorization.
  - Interaction direction does not substitute for authorization.
  - Technical connectivity or interface access does not establish authorization.
  - The authorization requirement is associated with the Resource whose state may change.
  - The authorization requirement is traceable to the governing Configuration.

Verification includes at least one permitted interaction that changes Resource state and confirms that authorization is required independently of interaction permission.

===== Traceability =====

{{backlinks>.}}

===== ConOps Relationship =====

This requirement establishes the authorization prerequisite for a permitted interaction that changes Resource state.

TWIN-010d governs enforcement of that prerequisite by preventing execution when the required authorization is absent or denied.

===== Delivery Phase =====

TBD

===== Requirement Status =====

Draft

===== Statement Reference =====

<code dokuwiki>
{{section>dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-03-twin-node-requirements:twin-010-control-twin-interaction:twin-010c-require-authorization-for-resource-state-changes#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>