Smart water networks run on what-if decisions made in seconds and audited over years. When a Smart Water Management digital twin recommends a DMA pressure reduction during a scarcity window, the operational and regulatory question is not what the twin proposed — it is who held authority to act on it, under which conditions, and whether that record has been altered since. VAC is the trust layer on top of the twin: it proves acceptance, authority, and provenance with a sealed, independently-verifiable receipt.
Fixed-network smart metering across District 14 (Northside DMA) detects an elevated minimum night-flow during the 02:00–04:00 low-demand window: 4.2 L/s above the 7-day baseline, a signal consistent with real-loss infrastructure leakage. The Smart Water Management digital twin runs a what-if — if inlet pressure is reduced by 12% and held for 30 minutes, what is the projected impact on water-loss reduction versus supply continuity? The twin's recommended action emerges from that scenario run: Stage 1 DMA pressure reduction.
A Network Operations Centre engineer receives the digital twin's recommendation, reviews the SCADA telemetry confirming the metering signal, and accepts Stage 1. VAC is the mechanism that seals which scenario was accepted, by whom, under what authority, and at exactly what time — producing a regulator-grade audit receipt that anyone with the JTI can verify against the production backend, without needing to trust VAC's word for it.
Walk through the authorisation, step by step
"The part of the system that checks the work is never the part that did the work." The AI that flagged the anomaly does not authorise the response. The engineer who authorises does not operate the seal. The regulator who audits holds a receipt that neither party can alter after the fact.
The digital twin's what-if and recommendation are automated outputs — no authority is exercised here. Authority begins the moment a human reviews the scenario and decides to act on it. That is the step VAC seals.
The on-call Network Operations Centre engineer reviews the digital twin's what-if — checks the scenario inputs, the projected water-loss reduction, the fixed-network smart metering telemetry confirming the overnight signal — and accepts Stage 1 of the recommended DMA pressure reduction.
At this point a decision has been made — but no authority has been verified and no record has been sealed. If the decision were logged only in the NOC system, the audit trail would rest on that system's integrity. VAC replaces that assumption with a cryptographic proof: not just who clicked accept, but who held authority to accept this class of scenario, under what conditions, at what time.
VAC checks that the engineer is:
The policy conditions — DMA scope, pressure-reduction bounds, permissible action types — travel with the authority chain. Not stored separately in a policy server that must be trusted; not asserted by the engineer. The part of the system that checks the work is never the part that did the work.
VAC mints a signed token (Ed25519 + JWT) that binds together:
The token is signed by the VAC production backend. No party — not the engineer, not the NOC system, not VAC — can alter this record after the fact without the signature failing verification. The twin proposes; VAC proves who accepted.
The sealed receipt is queryable by anyone who holds the JTI — the regulator, an auditor, a water authority compliance team — against the live VAC backend. No trust in VAC required: the Ed25519 signature either verifies or it does not.
What a regulator-grade audit looks like with this receipt: the auditor queries the JTI — months or years after the scarcity event. The backend returns the signed token. The auditor verifies the signature against VAC's public key. The token's claims show the verified engineer identity, which digital twin scenario was accepted, the DMA and pressure-reduction parameters, the policy conditions that authorised it, and the immutable timestamp. No internal NOC system access required. No trust chain back to the SCADA log. The twin proposed; the record proves who accepted, and under what authority.