--- title: "Control Execute Module: controlled execution | Firevault" description: "Execute runs a scoped, human-approved task against your offline vault, then returns it to a disconnected state. See the workflow and full audit trail." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control/modules/execute#webpage", "url": "https://fire-vault.com/control/modules/execute", "name": "Control Execute Module: controlled execution", "description": "Execute runs a scoped, human-approved task against your offline vault, then returns it to a disconnected state. See the workflow and full audit trail.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/27d95636-cb89-494d-a105-ed44bd5b2f43/og-control-execute.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control/modules/execute#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control/modules/execute#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control", "item": "https://fire-vault.com/control" }, { "@type": "ListItem", "position": 3, "name": "Modules", "item": "https://fire-vault.com/control/modules" }, { "@type": "ListItem", "position": 4, "name": "Control Execute Module: controlled execution", "item": "https://fire-vault.com/control/modules/execute" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Control Module - FIRE # FV-Execute. Actions that happen when they should. Execute initiates control actions in response to policy, approval, schedule, incident state or supervisory override. The decision to act is recorded with the action, so there is no ambiguity about why the environment changed. Schedule a Demo[Back to Control](/solutions/control) Control at a glance ![FV-Execute module artwork: initiate control actions on policy, approval or schedule](/__l5e/assets-v1/6d7fd009-bf37-4c6f-a883-7c9bda6b7631/control-module-execute-hero.webp) Control removes the physical path. Blueprints show where each module sits. Exposure How it worksExplore moreQuestions The exposure in numbers 01 Actions follow defined conditions, not informal practice Triggered Actions follow defined conditions, not informal practice 02 Sensitive actions require the right approval pattern Approved Sensitive actions require the right approval pattern 03 Every action is paired with its reason and approver Recorded Every action is paired with its reason and approver 04 Where appropriate, actions have a defined undo path Reversible Where appropriate, actions have a defined undo path The Problem ## Critical actions decided in the moment, by whoever is closest. 01 ### Ad-hoc response When a control action is taken by the person who happens to be on shift, the rationale lives only in their memory and the outcome is harder to reason about later. 02 ### Missed conditions Actions that should follow a schedule, a state change or an upstream signal often do not, because nothing systematic connects the signal to the action. 03 ### No supervisory layer Without an explicit supervisory override, a runaway automation or a faulty trigger has no clean way to be paused, redirected or stopped. Control Module - FIRE > An action without a reason is a fact you will struggle to defend. Execute records both, together, every time. The Scenario ### Scenario: a scheduled lockdown that does not depend on memory A weekly maintenance pattern requires several systems to be placed into a restricted state outside business hours. Rather than relying on individuals to remember and act, Execute initiates the lockdown on schedule, with the policy that authorises it and the supervisor who can override it both recorded against the action. The same pattern applies in reverse when the window ends, and the evidential record shows what happened and why. "Execute is the discipline of treating an action as a decision, not as a habit." FV-Execute in placement ## Where Execute requires an approved action. Execute is the gate around any change that matters. Nothing destructive, privileged or boundary-altering happens without a named approver and a recorded decision. Grounded in IEC 62443-3-3 SR 1.5 Authenticator Management, NIST CSF PR.AC-4 and ISO 27001 A.5.18, A.8.18. Inputs ─┐ Telemetry ─┐ ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png) FV-Execute Control layer ┌─ Outputs ┌─ Control 01 SR 5.1 Firebreak open and close events Every change to the physical conduit state is an approved Execute event, not a console click. 02 PR.AC-4 Privileged change to OT assets Engineering changes against PLCs, RTUs and HMIs require multi-party approval before the path is opened. 03 PR.IP-9 Restore from offline vault Restoration from the offline vault is an explicit, recorded Execute decision with quorum approval. 04 A.5.18 Boundary policy changes Changes to the zone and conduit definitions themselves are governed actions, not silent edits. Relies on · prerequisites - Independent approver identities that cannot be impersonated from the system being changed - Recorded intent for every action, not just an audit log of the action - Quorum policy that survives a single compromised admin Pairs with · companion modules ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate Featured In [![TechRadar Pro logo](/press/techradar-pro-logo.svg) ](https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough "Read about Firevault on TechRadar Pro") [![Yahoo Finance logo](/assets/yahoo-finance-logo-white-aNkUpCH7.png) ](https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html "Read about Firevault on Yahoo Finance") [![Channel Insider logo](/assets/channel-insider-logo-white-CFFo4iu7.png) ](https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ "Read about Firevault on Channel Insider") [![Security Buyer logo](/assets/security-buyer-logo-white-o6oIaBWz.png) ](https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ "Read about Firevault on Security Buyer") [![SecurityBrief logo](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAT8AAAA1CAYAAAA3Sux5AAAL+0lEQVR4nO2dT4gdSRnAf++Ri5ODEcTJvoB0PIjgxdkFlejsTkBExFlhzWhEWPDkYWfXxZfoRSK73vKPJQrePHjamLhg5iAswrzNkFVyyBz04kqYJ2tmM6CQS2bxss9Dvcrr6emu+qq7ql/3e/WDZv50dVW9ftVff1Xfn+qMRiMiEY/cBpZTf78M/HpKfYlECukIhd8Z4IalzBbwIjCs2KdIO1kHfmU436mrI5FIih5wKvX3fWAb7MKvrFq4BTxb8tpI++gBDwTlogCM1IFEWVvr5vxzBSX0qsyHl8fX71SoI9IeXvVUz8hyLHlqJ1LMEmrpIn3fH6I0+6ZzGdVfm+ADOJ4Vfn1g02NnEqoJ0Ug7+Jyw3ELFdr5f8frQPMQuwCXHLdSzUzc94B4H12wBFlFLGpdr75Gc2yj5JSYt/NYJ9+GiAJxtficstx+0F9Nn0VM9q6hZ04jqLwwX3rScdxIuNZI1sonQwq+HebHaB1EAzi43BWWeDt6L2eQxShOsA2cB0gDWKdlvLfzu+euLkbhmM7t0gI2Cc+cYW9gipVgF7tTQzl4NbfimrNL2UAs/ibq+gRKWnczRRQ1uCW+59jDSKp5HjYkT40OPlyvT7NSMcIrwU2CbUWMrcPuhyMqtLnCzi+yGrqEGdt7UdYQa3BI3hkTS00jr2R0fcanDL48D138TOEq+BrhG89zXzljO76HkUnYcjgCOAL8UNCJZ0wH1ZmjjukEkEpot4CwHZ1kfB54BnkNNbZvAPnAcpRQdG/9vd2q9MfOK5fwl08kjwJf99YVrzLbwy9Nu50W7yX5235971u/jXSYacZoBk2WBW9iF4Mr4mtDs03zr/Gct539jOpnn5FyF+57rW8fNN6rnse2LOW18lHPoczYVPI12Yyg6XFwKbPclfU8WLGV3OCjkzlD82Ueoe6S549CPvPMSzlvaWBHeE+l31RPUJV2H+0hQ5nlBmWeE7c0DNluFUXh3gT/764s3a5EeWC6WnFVUiFVV3yj9wJ93vO4GcsGVWM67tm3ihdTvn7KUTYCnxr9LPOXT/TxVWEqhHZRDLtr/RFhOEgEgrc+3dnTdcv5/HtpIUC+KPmq81+FL2Bu3tUJD1v67wC8E5aRv5t1xnScMh4nXHNoy8Rjl+OiKNDTGhA6xaSsuhoqmWv+GnuqZhlPvPyzn/57526SVpp+BpdT/d1CRXJdR4/0xSnPvWOqT3o8eh2cCD8ZtbXJ45rMiqLPMbMF4X1ymvdIPP2KytpF3mK674NAfG8uocCMJWtvzSXaq1xZc7oPP78snPjVnE0V+jVX4keX8wKEuvf5+Gbsv71+YaP1FPGc5v4R65h5gnwmk2eTwMkpIloEF1zU/rdX4fiNKhZQri4K6V6iu7RUhyXTSZgbT7kABEu8EWyiXhKse6kjTwV+InOYKsuf1rxXbuYUSsFX6r9d0a0ELP9t0NIsWglpVrsIt/H/haRYxhwdtBmwb2j0FnmW+ZzkviUYaOLRnUzR62I0iZZ416Trofco/h7fx66ozoob0Z/oL2aWcF/4p8i1/UnrIb9qQw9Ela8Jri9qoSzDt1NTOvPN26nfXF3oW2zTR1bjXR72Es8dtJlNFEyGm2Glsa41FPCSMe5vEOl6J9NvoHHZLkwmtsro86NJp4QngZM7/b6KEoKTfWUHnEmd8lcOCtwOcFl6f0O5EnpdQ4+M0Ki09yEMas+yTfy8l9+eS4doOB9PlSxxzXxP3+jBlEjWs5hzL2DWuDWRuMFUoY7XuI9cWhygD2QZyQ1kZo6WUD49k/nEW+DfV1vQSlKDx9YVJHgppvxMmlkBpMocuxRriANW/O9gXeF+ifXtZHOXwQzGgPZ/jOubp7QXyvR0SQd11RT2Yxl9ZrjLp/2XKW8clKfBOUHyv+pY6llHGyJvjej7InLdph3nXPDX+3yhvHeIcfrSUVdSXVvThJALW5e0q0UT0+p708+XFBebxFUGZnwvbbAodmu/hb+NsyeuuWc77NnQUYQzPcmTIREPuo5a5dEx+3qzKhkRrPor5JXFlXMaENkZqFywXV5e8a564cpkWYV3W1EwUSXfJW2PbsS1bf5Pxz5cEdfke4CGNOr5p8xTdlbzlD9s6dF3+f+dR2k3VfH5blBNwJmxuTmvIXp772DXPIOMxO+3NotfUQBZ3WEQfFYfnOg0OZZD4uqCM6wDvYhbooResI/lsYB63P6D5uQb1LKqsEPCdjUXivypNhgLwQ8xeF0GWjGzCL40WXAnlrJerTObv02QB+GKAekP4P06Dl+1FWsVVzMKvz8ElkxVLfVWiWoqulVpLywjAEN/nC/Yi7AAfE9ZnmxV9lSkLP80Q9QUsAK/j9sDfGF+blGjXF8do1xS0brLhU21n4Fj+m5bztvXAIi4BPzWcXwL+hH1sXrTUk+W3DmWlSGZOicf2vuSxridUyeqyz8Q44mr2/0SFdqsSBZ+Z96bdgQAMHcraQuPKzlxsO9xto/Lo2TRL19C9EEarYwHqNJGEqFSb0U2HZLF1G7k6vkB5h0of7OEv8D3SDj5vOe+Sjiw0kvW5NsaMNw6J5udi5JB41f+M6bpQPALen2L7EqTaadwQSoZtvElju6VO7aGxJfEMzaMpt++FMmt+JiSOn19DlkYLwrlc/B77IvMSblbANzE71A7x725Q1657s8AadiFnW78e+OmKlSHmqd4n6+lGIW9jVoqu49ew+a7Hup7gW/hJ+O8U2swi2QbwHm7C1xYonzjUJWHFc32zju1h7NEcV6WkxrbK8BbmRMMrlHcwr40uMtO9z+nVO+OfEi1I4gidRidDNR0g1+h8ptpy9da3rUOFzkYzb9hSXIWOrXXhP1Nu3zbDW8R91rZQcCSunZPSBb4hKCedXkkCkXX2mKGgbB+5hrOAW3JNSRabRew+jXqfBxtvpH4fCsqbpmjzmibrxYrXm15ATdl4S/LdvmMvEhxbMhGXrCwXUdmk844dAhmkusiNDyOUJrSOeuB13v8llEV4hPsAkkwlNsftJgXnk/F5yZ6m6QVraVaShEmMsn6b6f0IdHpuCem3pcRJFCba6kMOpv6eVxY5vN+Ey/4Tb5Rsd1jyOgkJ6gWvnyEJTRgDkmmtpJ/r2N13gq75SffbXUTN9V02FkqTnWIXbYSe166PnHiDzN9PI9dq+5SP4MhawV3DqaJv4oS8l5x0ilU2E4uP6AIdolaVJkXgDLFPS0eo5/7HKBe3Y6jNrNYF14JyTQuSQUcLv2ep522S58PUpYbEheQ/INvIvsAqrNHcTZ/nEVusbx5lEv2GoknpxD6D7NldprxnwvGS11lJ+/mF9mEq8gEcYU9rE6pt8O9+kqXIylgmGeas4yOLkI0mGS5caVq2nRHVM2abCCoX0sJvQLgP0sWs/ewTbuCbkilqOoRZ1zENVq11hqq/jUw76UUedQhkCSGFTBV2CTMOTxM4GCIb4aE/yNBT/UPkCUF1+ixfG5/r1PPSKedJ/Gm/J5ENiJOUv9ezJvg0PsdAES7a/rQFsk442vSlkw5+lgc2xnUNPNRlpCi8TfrwmiibIfY41dTd15lkq3VlQLUkrlrgDh2uOYnqsxTXTNuuvorZtN+++JdD2eOEdSoeei7nmz0mY6nsXim6Hp/l/2k5r8dmmbRfG6jn3mVZYliinSd0RiORnaOH2gLvO+QbB/ZQ2UCu4f9N2Qe+zWFr9B7wISpO94/AH/A/WBPgW6gU9HkW1yHwN1S4j4+F6DPAKxz8rPreXiD/bWhzQM9alk3lq1jWOsAXHPohZR34Lvnf/11UqGSZuiUD31UB6GDf+NvEB7gbHk1tlqnPlDTBdWysoJ6fdP7MR+Of76H2Cn63RL2aSp9dKvwikVkjhPCLtIgq+fwikbYiiUSqkrE50gKi5heZNxJkDvOnqS+LS2QKRM0vMk/0kUcKDQL2I9IAppHSKhIJTQ+Vtux9VO7GT+OW/j2043ukAUThF5lFXkVNbxPck20MidsczAVx2huJHCRqfXNCFH6RyISmhpBFAhCnvZGIQu9kGJkTouYXmXeuI48/j8wQUfhFZpG7gjI6drbxG+1EwhCdnCPzQDpetenZUSI18X+Dj/KN9NJspQAAAABJRU5ErkJggg==) ](https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks "Read about Firevault on SecurityBrief") Capabilities ## What you get with every deployment 01 ### Condition-led initiation Actions begin because a defined condition was met, not because somebody remembered. 02 ### Approval where it matters Sensitive actions require the right approval before execution rather than after the fact. 03 ### Incident-aware Execute responds to incident state so containment, isolation and lockdown actions can be carried out at machine speed within agreed bounds. 04 ### Supervisory override An explicit supervisory layer can pause, redirect or stop an action when human judgement needs to take over. 05 ### Scoped authority Each action is constrained to the systems and operations the policy permits. 06 ### Decision and execution paired The reason for the action and the action itself are recorded together through Archive. Demo to Live ## Adoption Guide Step 1 #### Catalogue the actions List the control actions that matter, including their owners, scopes and current triggers. Step 2 #### Define conditions and approvals For each action, agree the policy, schedule, incident state and approval pattern that should govern it. Step 3 #### Pilot with one workflow Move one action onto Execute end-to-end, including the supervisory override and the evidential record. Step 4 #### Operate and review Run Execute as the initiation layer for control actions and review patterns through Archive on a regular cadence. Step 1 #### Catalogue the actions List the control actions that matter, including their owners, scopes and current triggers. Step 2 #### Define conditions and approvals For each action, agree the policy, schedule, incident state and approval pattern that should govern it. Step 3 #### Pilot with one workflow Move one action onto Execute end-to-end, including the supervisory override and the evidential record. Step 4 #### Operate and review Run Execute as the initiation layer for control actions and review patterns through Archive on a regular cadence. [Organise a Demo](/contact) Playbooks ## Which playbook covers this module Each playbook shows where this module sits in a real deployment, who authorises it and how a pilot scales into rollout. [ A Control Blueprint for AI ### A Control Blueprint for AI: 2026 Playbook The kill switch doctrine chapter explains who may initiate a control action against an agent or cluster, and on what authority. Read the playbook: A Control Blueprint for AI: 2026 Playbook ](/playbook/ai-control-blueprints)[ Control for Water Playbook ### Control for Water: Deployment Playbook Sets the approval pattern, escalation route and pre-approved conditions for control actions during a supply incident. Read the playbook: Control for Water: Deployment Playbook ](/playbook/firebreak-water) ## Explore More [ ### FV-Validate Checks whether a request should proceed before Execute acts. Learn more about FV-Validate ](/control/modules/validate)[ ### FV-Firebreak Severance action initiated by Execute. Learn more about FV-Firebreak ](/control/modules/firebreak)[ ### FV-Relay Time-bound, purposeful access initiated by Execute. Learn more about FV-Relay ](/control/modules/relay) Questions ## Frequently Asked Is Execute an automation engine? What happens if a trigger misbehaves? Does Execute act without approval? Can Execute be paused entirely?