Governance

Who would act at I-TOMCAT, and the trust shape that would gate it. Modelling exercise.

Governance at I-TOMCAT follows the same model as the 2-BM pilot: people and autonomous agents are facility principals at the PSI Site, and on the beamline they surface through the actions they take. Their commands are gated by a trust shape (a Zone grouping the beamline's resources, a Conduit binding the surfaces that may issue commands, and Policies that say who may do what).

I-TOMCAT is a modelling exercise, so this shape is not yet instantiated. The PSI operator and safety-review structure is not public and is carried pending on the PSI site page; CORA does not invent a PSI operator pool or review chain ahead of confirmation.

What is already settled is the boundary: clearances (the safety forms that must be active to start) are issued at the PSI Site, not on the beamline, and the beamline links up to them rather than restating them. The PSI personnel-safety-system form and interlock names are an open question (PSS-1 on Open questions).

The concrete Zone, Conduit, and Policy instances, and the operator pool, would land if the deployment firms toward a real connection, following the 2-BM governance shape.