Risk ownership without agency: The structural paradox of hardware trustworthiness in critical infrastructures

Critical infrastructures increasingly depend on digital hardware whose failure or compromise may have consequences for safety, security, and reliability. Yet organizations procuring finished hardware may remain operationally responsible for its use under conditions of constrained access to the information, expertise, infrastructure, reference points, or authority required to empirically examine physical hardware integrity at the integrated-circuit level. This integrative conceptual review develops the structural paradox of risk ownership without agency as an analytical framework for examining this separation between operational responsibility and verification capacity. Hardware Trojans serve as an illustrative case for showing how opportunities for unauthorized modification and the conditions required for empirical examination vary across the hardware lifecycle. Through theory synthesis, the analysis brings technical knowledge of hardware security assurance and the integrated-circuit lifecycle into relation with organizational and institutional sources and sociological perspectives drawn from Giddens, Luhmann, and Rittel and Webber. Within this synthesis, the analysis distinguishes physical hardware integrity from judgments of hardware trustworthiness. It examines two distinct bases for such judgments and for decisions concerning continued reliance: findings generated through technical examination of physical hardware integrity, and procedural confidence supported through organizational and institutional arrangements. The paradox describes a contingent condition shaped by lifecycle position and access rather than a universal incapacity among downstream actors. The paper identifies its scope conditions, illustrates its practical implications, and outlines how the framework can support empirical research and the evaluation of technical and institutional arrangements that may reduce or reorganize the separation between operational responsibility and verification capacity.