3,000 permits were derived from plant-floor flows and no integrator will state intent - how do you find owners before you bless an intruder's path?

## Why the naive campaign fails The engineer running this is not short of data - they have 3,000 derived permits. They are short of *people who will make a statement*. The default approach, mailing each team a list and asking "is this still needed?", fails for a structural reason: the recipient bears all the downside of a wrong "no" (a stopped production line, a shouting production manager) and none of the downside of a wrong "yes" (an unexplained permit, which harms nobody visibly). Everyone rationally answers yes to everything. On an industrial estate it is worse still: the integrator who commissioned the line has moved on, the contract never required an interface specification, and the support agreement obliges nobody to explain a flow. ## Ask a question only an owner can answer Replace the yes/no with questions that cannot be bluffed: - Which application or function produces this? - Which side initiates, and how often? - What stops working if it stops - and how would you notice? - What change or commissioning activity introduced it? A real owner answers in a sentence. A non-owner cannot answer at all, and that silence is itself the data you needed: it tells you the flow is unattributable and should be routed to the residue process rather than left in limbo. ## Attribute assets first, flows second A flow has two ends and no owner. An asset can have exactly one. Build ownership at the endpoint level from whatever the plant actually has - asset register, maintenance contract, purchase order, the switch port and the cabinet it lands in, the person whose name is on the panel. Once each endpoint has a candidate owner, every flow has two candidate owners and the campaign has an addressee instead of a mailing list. It also gives you an escalation path that works: the production owner, not the security engineer, is the one who can weigh outage risk against permit risk. ## Collapse before you canvass Do not attribute 3,000 lines. Cluster them by role and shape and you typically find a few dozen repeated patterns: historian polling controllers on a fieldbus-over-TCP port, MES querying the historian, engineering workstations reaching controllers, backup and file transfer, name and time services, remote-access paths in from outside the zone. Attribute the *pattern* once with the person who owns the function, and the member lines inherit that intent. What remains after clustering is the interesting part: the flows that fit no pattern, which is exactly the set worth an hour each. ## Rank by boundary, not by count Attribution is expensive human time and it is finite. Spend it where a learned intruder path would be: - flows entering the control zone from anywhere else, - flows on remote-access and vendor-support paths, - flows leaving the plant zone toward general IT or outward, - flows between hosts that have no functional reason to share a pattern. Intra-zone chatter between two controllers on the same line is the cheapest thing in the building to leave broad. The permit that matters is the one that crosses the line you drew. ## Handle the residue honestly - three buckets, not two 1. **Attributed and intended.** Keep, with the owner recorded against it. This is the only category that has actually been checked. 2. **Attributed and unintended.** An owner said "that should not exist". Remove it with their sign-off - and note that this is the only place a derived list ever shrinks. 3. **Unattributable.** Nobody will state intent. Do not delete it blind (you will stop production and lose the mandate for the whole programme) and do not keep it silently (that is how the intruder's line became permanent). Narrow it instead: one host pair rather than a subnet, one port rather than a range, one direction rather than both, and where the flow is genuinely periodic, restricted to the maintenance window it actually runs in. Then record it on a register whose entry reads honestly - *this permit exists because it was observed and nobody can say why* - with a named accountable person who is the asset owner, not you. That register is the deliverable that makes the project defensible. It converts a silent assumption into a listed, owned risk, and it is what a later reviewer needs in order to act. ## What you tell the sponsor about cost Say it in advance: this is weeks of engineer and plant-team time, and it will not reach 100%. A campaign that attributes the boundary-crossing flows and honestly registers the rest is a success. A campaign that promises full attribution will stall, and the derived list will be enforced unread - which is the outcome the whole exercise existed to prevent.