system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Verify internal bus registers and tables are not writable without authorization

Grounding:
- SPARTA EX-0012 Modify On-Board Values: The attacker alters live or persistent data that the spacecraft uses to make decisions and route work. Targets include device and control registers, parameter and limit tables, internal routing/subscriber maps, schedules and timelines, priority/QoS settings, watchdog and timer…
- SPARTA PER-0002.01 Hardware Backdoor: Hardware backdoors leverage properties of the physical design to provide durable, low-visibility reentry. Examples include enabled test/scan chains, manufacturing or boot-strap modes invoked by pins or registers, persistent debug interfaces (JTAG/SWD/UART), undocumented device…
- SPARTA IA-0009.02 Vendor: Vendors that design, integrate, or support mission systems often hold elevated, persistent routes into operations: remote administration of ground software and modems, access to identity providers and license servers, control of cloud-hosted services, and authority to deliver…
- SPARTA REC-0001 Gather Spacecraft Design Information: Threat actors seek a coherent picture of the spacecraft and its supporting ecosystem to reduce uncertainty and plan follow-on actions. Useful design information spans avionics architecture, command and data handling, comms and RF chains, power and thermal control, flight…
- SPARTA DE-0001 Disable Fault Management: The adversary suppresses or alters fault detection, isolation, and recovery (FDIR) so unauthorized actions proceed without triggering safing or alerts. Targets include watchdogs and heartbeat monitors; limit and sanity checks on sensor/command values; command interlocks and…
- SPARTA PER-0005 Credentialed Persistence: Threat actors may acquire or leverage valid credentials to maintain persistent access to a spacecraft or its supporting command and control (C2) systems. These credentials may include system service accounts, user accounts, maintenance access credentials, cryptographic keys, or…
- SPARTA IA-0012 Assembly, Test, and Launch Operation Compromise: Assembly, Test, and Launch Operation (ATLO) concentrates people, tools, and authority while components first exchange real traffic across flight interfaces. Test controllers, EGSE, simulators, flatsats, loaders, and data recorders connect to the same buses and command paths…
- SPARTA EX-0004 Compromise Boot Memory: The attacker manipulates memory and configuration used in the earliest stages of boot so that their code runs before normal protections and integrity checks take hold. Targets include boot ROM vectors, first-stage/second-stage bootloaders, boot configuration words and strap…

Steps so far:
1. Map the internal bus [REC-0001]

Give the single next step.

assistant: 2. Attempt an unauthorized register write
   - Technique: EX-0012 Modify On-Board Values [ST0004]
   - Action: Write to a sensitive register or parameter table over the bus without authorization.
   - Check: write is rejected or gated by authorization in the flight build.