Agentic Cybersecurity Officer for Unattended Critical Infrastructure: An Evidence-Governed Architecture for Cyber-Physical Security

Selected unattended and lightly staffed energy facilities combine heterogeneous operational technology (OT), remote maintenance, and physical-security signals, often with intermittent central connectivity. This position paper proposes a site-resident Agentic Cybersecurity Officer (ACSO) as a bounded cyber-physical security assistant, not an autonomous plant controller. Local inference correlates observations and supports human incident triage. The OT Security Operations Center (OT SOC) coordinates cross-site assessment while operational control centers retain plant authority. The proposed architecture distinguishes a mediated management path from a hardware-unidirectional evidence-export path, with separately governed collection and external verification. We define trust assumptions, limits on actionable authority, reconnect behavior, and precise boundaries of cryptographic evidence claims. We also specify testable comparisons against rule-based monitoring and alternative evidence anchors. The architecture has not been implemented, and its proposed benefits remain empirically unvalidated. Publication context Independent research companion to the presentation From Trust to Proof: Blockchain-Anchored File Integrity for Critical Infrastructure Operators, scheduled to be presented by Arslan Brömme at the 4th Annual Energy & Utilities Cyber Security Forum in Amsterdam, 25–26 November 2026.