FV-Relay. A path that exists only for the work.
Relay turns access from a permanent state into a temporary, purposeful event. A connection exists for the work that needs it, under the conditions that suit it, for the window it requires, and then it does not.
Control removes the physical path. Blueprints show where each module sits.
- Every connection has a defined start and end
- Time-boundEvery connection has a defined start and end
- Each path is opened for a specific, recorded reason
- PurposefulEach path is opened for a specific, recorded reason
- Opening depends on identity, approval and state
- ConditionalOpening depends on identity, approval and state
- Windows end automatically, no manual cleanup
- Self-closingWindows end automatically, no manual cleanup
Standing access is the cost of yesterday's convenience.
Persistent jump paths
Paths opened for a one-off task tend to stay open. They become part of the environment, available to anyone who later finds them, attacker or otherwise.
Implicit privilege
Always-on connectivity quietly becomes always-on privilege. The original purpose is forgotten long before the route is closed.
Manual cleanup fails
Cleanup that depends on someone remembering to close a path is cleanup that does not happen reliably.
Control Module - FIRE
The safest connection is the one that did not need to exist five minutes ago and will not exist five minutes from now.
The Scenario
Scenario: vendor maintenance, on the clock
A maintenance partner needs access to an operations system for a scheduled patching window. Rather than enabling a persistent VPN, the responsible owner approves a Relay session bound to that partner, to that system, for that window. The path opens at the agreed time, the work is performed, the path closes automatically when the window expires. No artefacts are left behind for someone else to find later.
"Relay made vendor access a calendar entry rather than a standing arrangement."
Where Relay creates a time-bound path.
Relay is the controlled opening of a normally severed conduit. It exists for the time the work needs, no longer, and closes on its own.
Grounded in IEC 62443-3-3 SR 1.13 Access via Untrusted Networks, NIST CSF PR.AC-3 and ISO 27001 A.5.15.
FV-Relay
Control layer
Vendor maintenance window
Opens a vendor path with a fixed start time, fixed duration and fixed scope. Closes automatically.
Operator emergency access
Provides time-bound break-glass access for incident response, with multi-party approval and full audit.
Backup and replication windows
Brings the recovery vault online for the replication window only. The conduit is severed before the window expires.
Audit and assessment sessions
External auditors get a scoped, time-bound path into the evidence set, never to live production.
Relies on · prerequisites
- A trustworthy time source the relay cannot be tricked about
- Hard automatic close, not a reminder
- Independent record of who opened it, why and for how long
Pairs with · companion modules
Firebreak
Lock
Execute
ValidateFeatured In
Capabilities
What you get with every deployment
Defined windows
Every Relay session has an explicit start time and end time, with the end enforced automatically.
Purpose-bound
Sessions are tied to a named purpose, owner and scope rather than to a generic always-on tunnel.
Approval-gated
Opening a path requires the right approval pattern for that path, not just the requester's intent.
Scoped reach
Sessions reach only the systems the work requires, not the wider zone they happen to traverse.
Self-closing
When the window ends, the path closes. There is no manual cleanup to remember and nothing left for someone to discover later.
Evidential record
Each session is recorded through Archive, including who requested it, who approved it and what occurred.
Demo to Live
Adoption Guide
Identify standing paths
Inventory the connections that are currently always-on and categorise them by who they serve and why.
Design the sessions
Define the purposes, owners, approval patterns and acceptable windows for each category.
Pilot with one workflow
Move a single standing path to a Relay session pattern, including the calendar, approval and evidential pieces.
Decommission the rest
Migrate remaining standing access onto Relay sessions and close the persistent paths.
Identify standing paths
Inventory the connections that are currently always-on and categorise them by who they serve and why.
Design the sessions
Define the purposes, owners, approval patterns and acceptable windows for each category.
Pilot with one workflow
Move a single standing path to a Relay session pattern, including the calendar, approval and evidential pieces.
Decommission the rest
Migrate remaining standing access onto Relay sessions and close the persistent paths.
Playbooks
Which playbook covers this module
Each playbook shows where this module sits in a real deployment, who authorises it and how a pilot scales into rollout.
Control for Water: Deployment Playbook
Covers third-party support and engineering access as purposeful, time-bound connections rather than standing links.
Read the playbook: Control for Water: Deployment PlaybookA Control Blueprint for Aerospace & Aviation
Documents supplier and maintenance access windows across a distributed aviation supply chain.
Read the playbook: A Control Blueprint for Aerospace & AviationQuestions