01Discover every agent on the network
Inventory every agent and service account with reach into signal controllers, ramp meters, and message signs. An agent that was never registered falls back to read-only: it can observe the network but cannot change it.
02Enforce authority before a signal changes
Tier-based permissions gate each action against an operator's authorization level before it runs. Physical changes (timing plans, lane closures, sign postings) can require a named human approval, and hard limits (minimum crossing times, corridor scope) are enforced, not suggested.
03One switch to freeze automation
If an agent starts pushing changes it should not, halt every agent on the traffic system in a fraction of a second. Control reverts to human operators and the signals hold their last safe plan.
04Prove the plan of record
A tamper-evident, hash-linked log captures every proposed and applied change (what changed, on which device, under whose authorization, and why) so the agency can reconstruct the exact signal plan at any moment.