Burak Oktenli

Control Authority Regulation Architecture

CARA

Provisional application filed DOI: 10.5281/zenodo.18917790

Deterministic recovery for authority lockout. Four-phase GREP pipeline (Guard, Reduce, Evaluate, Promote) with terminal non-compensatory policy gate.

GREP RecoverySafe-StopDeterministicProv. Patent Appl. 64/000,170

Sensor Attestation and Trust Anchoring

SATA

Provisional application filed DOI: 10.5281/zenodo.18936251

Foundation trust layer using weighted Dempster-Shafer belief functions. Four diagnostics: internal consistency, cross-sensor agreement, temporal stability, physical plausibility.

Dempster-ShaferSensor TrustCross-ValidationProv. Patent Appl. 64/002,453

Flash War Latency Architecture

FLAME

Provisional application filed DOI: 10.5281/zenodo.19015618

Strategic Latency as a formal system. 5-state Circuit Breaker with Dynamic Delay Function D(A, tier, domain) preventing autonomous escalation in multi-domain command.

Circuit BreakerFlash WarJADC2Prov. Patent Appl. 64/005,607

Multi-Agent Integrity Verification Architecture

MAIVA

Provisional application filed DOI: 10.5281/zenodo.19015517

Swarm trust aggregation with the Byzantine bound as its design basis. Trimmed weighted median with the roster sized to the 3f+1 Byzantine bound as a configuration reference, CUSUM anomaly detection, DoDD 3000.09 action gates.

Byzantine-Bound DesignSwarm TrustCUSUMTLA+ Spec

Adversarial Deception-Aware Risk Architecture

ADARA

Provisional application filed DOI: 10.5281/zenodo.19043924

Proactive deception prior adjusting authority via P(adversarial). Deception Probability Engine with Bayesian update. Phantom Fleet detection for AI-hallucinated hostile scenarios.

Deception PriorPhantom FleetBayesian UpdateAdversarial AI

Escalation Risk Assessment Model

ERAM

Cross-Domain Escalation Risk Quantification for AI-Enabled Command and Control

Provisional application filed SSRN ID: 6176802

Escalation risk quantification across interconnected autonomous command nodes. Models how autonomous actions cascade across domain boundaries. 6 scenarios, 600 Monte Carlo runs.

Decision CompressionCascade RiskJADC2Cross-DomainMonte Carlo

View All Provisional Applications →

Provisional Patent Applications & Technical Inventions

U.S. provisional patent applications for the governance architectures and EBCC, with application numbers and, where published, DOIs on Zenodo, source code, and an interactive simulation. The applications are not published and no patent has been granted.

Software Research Platforms

The software authority-governance layer that the hardware reference designs are intended to anchor in silicon (none of those designs has been built). Published and maintained on the AUTHREX Systems venture site, where each system has a full technical page with scenarios, standards mapping, and a reference design.

Research Initiative

AUTHREX.Systems

AUTHREX Systems is a research initiative demonstrating authority lifecycle governance infrastructure for autonomous systems. It presents the seven governance frameworks, the ten BLADE hardware reference designs (not built), and thirty-nine simulations developed through this research program as one authority-governance architecture across defense, maritime, infrastructure, and autonomous vehicle domains. AUTHREX SYSTEMS LLC, a Florida limited liability company based in Coconut Creek, Florida, was formed on September 17, 2026, as the contracting entity for the program’s federal work, and offers AUTHREX-DEFEND, the program’s installable engineering preview, to United States Government organizations for evaluation.

Standards consulted (author’s interpretation; no standard has been applied or assessed): DoDD 3000.09 (Autonomy in Weapon Systems), NIST AI RMF 1.0 (AI Risk Management, voluntary), MIL-STD-882E (System Safety), ISO 26262 (Automotive; ASIL D as a design target), IEC 61508 (Industrial; SIL 3 as a design target), NERC CIP (Energy Grid), FIPS 140-3 (Cryptographic modules; the designs cite FIPS 140-2 Level 3, which FIPS 140-3 supersedes).

Visit AUTHREX Systems

AUTHREX Systems program overview film (9:30)

AGENT

AUTHREX-AGENT

Authority-Lifecycle Governance Shim for Autonomous AI Agents

authrex.systems Software companion to BLADE-AGENT-HSM

Software authority-lifecycle shim for autonomous AI agents: four-tier HMAA authority gating, per-tool HKDF authorization, spawn quorum, and a hash-chained audit ledger, designed to be anchored in hardware by the BLADE-AGENT-HSM root of trust (a reference design, not built). Designed to contain indirect prompt-injection attacks against tool-using agents. Single-author research, not deployed.

Agentic AIHMAA TiersTool AuthorizationAudit LedgerPrompt-Injection Defense

Pre-Deployment Authority Governance for Autonomous Systems

KERNEL

AUTHREX Governance Kernel

Runnable Reference Implementation of AUTHREX-AGENT (TRL 3-4)

Executable · Test-BackedQA10: 83 Passed, 1 Skipped · Docker-Verified

The first executable, test-backed implementation of the AUTHREX authority-governance pipeline for agentic AI. MCP-based agent tool governance, four-tier HMAA authority enforcement, human approval gating with role-based access control, signed policy loading, and a hash-chained audit ledger with verified tamper detection (forgery, reordering, deletion, and tail truncation). In the July 2026 QA10 run (package v1.0-QA10, pytest in a Python 3.11 container), 83 of its self-generated tests passed and 1 was skipped as environment-dependent, with zero unauthorized privileged executions in synthetic scenarios; Docker build and run verified; resumable validation harness. Synthetic data only; no operational validation or agency endorsement claimed.

Agentic AIMCP GovernanceHMAA TiersRBACSigned Audit LedgerDocker-Verified

Repository release pending legal review

ASSURE

AUTHREX-ASSURE

authrex.systemsReference architecture (TRL 3-4)

Pre-deployment authority governance for autonomous systems: assurance gating that must clear before a system is permitted to act. Reference architecture aligned with the 2026 National Cybersecurity Strategy and NDAA Section 1533. Single-author research, not deployed.

Pre-DeploymentAssurance GatingNDAA 1533Nat'l Cyber StrategyAutonomy

Operational-Technology Authority Governance for Critical Infrastructure

ICS-GATE

AUTHREX-ICS-GATE

authrex.systemsSoftware companion to BLADE-INFRA-OT

Operational-technology authority governance for critical infrastructure, gating AI actions across the IT/OT boundary. Aligned with CISA/NSA AI-in-OT principles, NIST SP 800-82, ISA/IEC 62443, and NERC CIP. Single-author research, not deployed.

ICS/OTNIST 800-82ISA/IEC 62443NERC CIPIT/OT Boundary

Autonomous Cyber-Defense Authority Governance

CYBER

AUTHREX-AGENT-CYBER

authrex.systemsGovernance only, no offensive function

Authority governance for autonomous cyber-defense agents, constraining what a defensive AI may do and when. Governance only, with no offensive function. Aligned with Five Eyes Careful Adoption of Agentic AI Services, DARPA AIxCC, and NDAA Section 1513.

Cyber-DefenseFive EyesDARPA AIxCCNDAA 1513Defensive Only

Onboard Authority Governance for Orbital Autonomy

SPACE

AUTHREX-SPACECYBER

authrex.systemsSoftware companion to BLADE-SPACE

Onboard authority governance for orbital autonomy, gating autonomous spacecraft actions under intermittent ground contact. Aligned with NASA SBIR 2026 BAA subtopic EXPAND.3.S26B and Space Policy Directive 5. Single-author research, not deployed.

Orbital AutonomyNASA SBIREXPAND.3.S26BSPD-5Onboard Governance

Test and Evaluation Authority Governance

SANDBOX

AUTHREX-SANDBOX

authrex.systemsReference architecture (TRL 3-4)

Test-and-evaluation authority governance: governs what an AI under evaluation is permitted to do inside the sandbox. Aligned with NDAA Section 1534 and Section 1533. Single-author research, not deployed.

Test & EvaluationSandboxNDAA 1534NDAA 1533Containment

Run-Time-Assurance Governor Console

RTA

AUTHREX-RTA

authrex.systemsStandalone console (simulation)

Standalone run-time-assurance governor console on the ASTM F3269 and Simplex reference model: an independent invariant monitor evaluates each proposed authorization before it is applied, with a SHA-256 hash-chained decision ledger. Governance and assurance only. Single-author research, not deployed.

Run-Time AssuranceASTM F3269SimplexInvariant MonitorDecision Ledger

Fail-Closed Engagement-Authority Governance Console

ENGAGE

AUTHREX-ENGAGE

authrex.systemsGovernance only, no weapons function

Standalone fail-closed engagement-authority governance console: an invariant monitor adjudicates each proposed action to one of five outcomes (authorize, clamp, downgrade, deny, or hold for human) before it can proceed. Governance and assurance only, with no targeting or weapons function. Single-author research, not deployed.

Engagement AuthorityFail-ClosedFive OutcomesHuman HoldDecision Ledger

Fail-Safe Safe-State Authority Governance Console

SAFING

AUTHREX-SAFING

authrex.systemsStandalone console (simulation)

Standalone fail-safe safe-state authority console: a governor adjudicates every safing command (safe-state entry, hold, deepen, and re-arm gated exit) with a SHA-256 hash-chained decision ledger, drawing on NASA fault-management safe-mode practice and the Simplex safety-controller pattern. Governance and assurance only. Single-author research, not deployed.

Safe StateFail-SafeRe-Arm GateSafe-Mode PracticeDecision Ledger

Team Decision-Authority Governance Prototype

TEAM

AUTHREX-TEAM

authrex.systemsHardened prototype (simulation)

Standalone team authority governance prototype: an independent arbiter over an untrusted allocator is designed to maintain exactly one eligible authenticated holder per responsibility, never zero (a gap) and never two (split authority), with bounded reversible transfers and a safe-hold fallback. Governance and assurance only. Single-author research, not deployed.

Team AuthorityOne Holder Per RoleBounded TransferSafe-Hold FallbackDecision Ledger

Positive Human Control Governance Prototype

REDLINE

AUTHREX-REDLINE

authrex.systemsHardened prototype (simulation)

Standalone positive human control prototype: the design allows the critical authorization to be held only by two distinct authenticated humans and never by a machine, and the fail-safe state is NO-GO, with a hash-chained record and deterministic replay. Governance and assurance only, with no targeting or weapons function. Single-author research, not deployed.

Positive Human ControlTwo-Person RuleHuman-Only KeysFail-Safe NO-GODeterministic Replay

Installable Engineering Preview

DEFEND

AUTHREX-DEFEND

authrex.systemsEngineering preview (installable)

Desktop application for macOS, Windows and Linux, release 0.1.6. Four report-only pages, Scan computer, Check a file, Network and Protected apps, look at the computer it runs on and report indications of rogue AI agent activity, each with its evidence and a qualitative indication label. A synthetic laboratory workbench shows, with invented data, how a pretend program’s authority would be frozen while it is given a harmless decoy workspace, with every step written into a record that can be checked later. It stops no program and enforces nothing, and a finding is an indication, not proof. Offered by AUTHREX SYSTEMS LLC to United States Government organizations only, for evaluation; no installer is downloadable, no agency has evaluated, purchased or endorsed it, and no contract exists.

Report OnlyRogue-Agent IndicationsSynthetic WorkbenchCheckable RecordU.S. Government Evaluation

Agent Swarm Containment Prototype

QUARANTINE

AUTHREX-QUARANTINE

authrex.systemsResearch prototype (simulation)

Standalone agent swarm containment prototype: eight governed AI agents work inside one authority boundary, and when one proposes an action outside its grant, a modeled host gate denies it before execution and opens a containment case. A new grant requires three distinct witness ballots, five isolation planes, two custodian approvals, a clean dwell and a period of read-only probation, and every decision is appended to a hash-chained journal. Research simulation with synthetic data and no enforcement, TRL 2 to 4 self-assessed. Single-author research, not deployed.

Agent ContainmentHost GateWitness BallotsTwo-Custodian ApprovalHash-Chained Journal

Design Complete · Build In Progress DOI: 10.5281/zenodo.19143190

Hardware Research Platforms

Twelve hardware platforms at increasing levels of operational capability: two physical research testbeds whose build is in progress (the rover and the UAV) and ten domain reference designs that have not been built. Each is published as an artifact package with hardware specifications, a bill of materials, simulation material, and assembly documentation.

Authority-Governed Autonomy Rover Testbed

Authority-Governed Assured Autonomy Rover Testbed

A low-cost experimental platform for studying authority-governed autonomy in safety-critical robotic systems under contested conditions. The rover is designed to continuously evaluate how much it can trust each of its sensors, compute how much authority the autonomy software should have right now, and fall back to a safe state when trust collapses. All in a dual-compute architecture (Raspberry Pi 5 + ESP32). 37 bill-of-materials components, 76 electrical connections, 7 defined experiments. Platform cost under $500.

SATA HMAA CARA Trusted Autonomy Sensor Spoofing ROS 2 Raspberry Pi 5 ESP32

Design Complete · Build In Progress DOI: 10.5281/zenodo.19128769

HMAA-UAV Authority-Governed Autonomous Drone Platform

Authority-Governed UAV Platform (HMAA-UAV)

A trust-governed autonomous drone design in which every flight decision is to be evaluated by sensor trust fusion (SATA), authority governance (HMAA), and recovery logic (CARA). Cube Orange+ flight controller with NVIDIA Jetson Orin NX AI companion computer. 52 bill-of-materials components, 48 electrical connections, 49 mechanical assemblies. Carbon fiber quadcopter frame. Design and bill of materials complete; procurement and assembly in progress; no physical test data yet (as of October 2026).

SATA HMAA CARA UAV Autonomy Contested Environments Jetson Orin NX ArduPilot

TRL 3-4 simulator / spec · TRL 2 testbed design (not built) · Eighth BLADE Platform DoDD 3000.09 · FY26 NDAA · NIST AI RMF

BLADE-SWARM reference node hardware render: a Holybro X500 V2 quadrotor carrying a Pixhawk 6X flight controller, a Raspberry Pi 5 companion computer, a LoRa mesh radio whip antenna, a GPS module on a mast, and an addressable status LED ring on the centre plate

BLADE-SWARM Governance Node

Authority governance for attritable autonomous swarms at N=10 (proposed physical testbed, reference design, not built), N=50 (combined operation), and N=500 (large-swarm scale). In the design and its browser simulator, each agent runs a Byzantine-fault-tolerant two-phase consensus gated by SATA peer trust, the four-tier HMAA authority state, and weighted MAIVA voting before the swarm commits, sized for up to f=(N-1)/3 compromised agents per quorum (a design assumption, not a verified result) with a quorum-intersection bound and safe-halt-by-default under denied or degraded RF. Per-node ECDSA P-256 root of trust (ATECC608B) feeds a hash-chained distributed audit ledger. TLA+ specification stating 5 safety and 3 liveness properties (model-checking output not yet published); ~$1,333 per node. It governs decision authority and audit; it does not govern weapons. Eighth domain: defense, automotive, maritime, critical infrastructure, orbital, counter-UAS, agentic AI, swarm autonomy.

SATA HMAA MAIVA FLAME CARA Byzantine FT ECDSA P-256 TLA+

Design Complete · Prototype Specification Reference Design (Not Built)

BLADE-EDGE Governance Node

A reference design (not built) for a rugged, portable edge computing device serving as the decision-authority layer for autonomous defense platforms. Specifies the complete 9-module governance pipeline (SATA → ADARA → IFF → HMAA → MAIVA → FLAME → CARA → BDA → EFFECTOR) on dual-redundant Jetson AGX Orin + Zynq UltraScale+ hardware. 72 components, 103 connections; MIL-STD-810G environmental design target (not tested; superseded by MIL-STD-810H). Hardware safety interlock in the design (normally-open relay). ~$139K reference BOM.

SATA HMAA ADARA MAIVA FLAME CARA Jetson Orin Zynq FPGA MIL-STD-810G target

Published on Zenodo · DOI: 10.5281/zenodo.19232130 ISO 26262 ASIL-D Target

BLADE-AV Governance Node

Reference design (not built). Authority-governed drive-by-wire safety architecture for autonomous vehicles. 9-module governance pipeline on Jetson AGX Orin + Zynq UltraScale+. Three-leg redundant KILOVAC fail-safe relay. 62 components, twelve attack scenarios demonstrated in simulation. ~$16,287 reference BOM. Portability from the BLADE-EDGE defense variant shown at design and simulation level only.

SATA HMAA MAIVA FLAME CARA ISO 26262 V2X KILOVAC Relay

Published on Zenodo · DOI: 10.5281/zenodo.19246785 MIL-STD-810G · IP68 Design Targets

BLADE-MARITIME Governance Node

Reference design (not built). Authority-governed maritime surveillance node with hydroacoustic sonar, magnetic anomaly detection (MAD), and AIS spoofing detection. Four maritime mathematical extensions to the BLADE governance pipeline. 84 components; IP68 enclosure and MIL-STD-461G CE102 power chain as design targets (not tested). Third domain instantiation: defense → automotive → maritime.

SATA HMAA Hydroacoustic MAD AIS Spoofing Sea-State α(H) Acoustic BFT IP68

Published on Zenodo · DOI: 10.5281/zenodo.19277887 SIL 3 · NERC CIP · FIPS 140-2 Design Targets

BLADE-INFRA Governance Node

Reference design (not built). Authority-governed critical infrastructure protection node for ICS/SCADA systems, power grid monitoring, and industrial process control. IEC 61850 GOOSE, Modbus TCP/RTU, PROFINET IO integration. Pilz PNOZ S7.1 SIL-3 safety relay. 92 components; IP65 DIN-rail enclosure as a design target (not tested). Fourth domain instantiation: defense → automotive → maritime → critical infrastructure.

SATA HMAA ICS/SCADA Power Grid NERC CIP SIL 3 Modbus IEC 61850

TRL 2-3 hardware / 3-4 simulation · Ninth BLADE Platform NIST SP 800-82 · ISA/IEC 62443 · NERC CIP

BLADE-INFRA-OT reference appliance: a 1U fanless metal enclosure with status LEDs, ventilation, and an inspection window exposing the Xilinx Kria K26 governance plane and x86 network plane modules and network interfaces

BLADE-INFRA-OT IT/OT Bridge Governance Node

A reference design (not built) for a fail-closed, bump-in-the-wire governance appliance at the segmentation boundary between corporate IT networks and operational-technology control assets. Each cross-boundary command is parsed, scored, and adjudicated through the AUTHREX pipeline to one of three actions: propagate, hold for deliberation, or isolate. Four OT authority regimes; malformed input fails closed. Xilinx Kria K26 governance plane and x86 network plane, managed Ethernet switch with SFP+ ports, ATECC608 root of trust, TPM 2.0 measured boot, and a Form C fail-closed fault relay in a 1U fanless form factor (48 BOM line items). Every decision is written to a seed-deterministic SHA-256 hash-chained audit ledger. Ninth domain: the IT/OT boundary (operational technology), companion to BLADE-INFRA.

IT/OT bridge OT security Kria K26 ATECC608 TPM 2.0 SHA-256 ledger fail-closed

TRL 2-3 · Preliminary Design Phase · 15-Doc Engineering Package NASA SBIR EXPAND.3.S26B Aligned

BLADE-SPACE Governance Node

Reference design (not built). Authority-governed orbital governance node for autonomous LEO platforms beyond ground-loop latency. Microchip RTG4 FPGA + Aitech S-A1760 Venus SBC hot redundancy with <200 ms failover; ECDSA P-256 audit chain anchored in rad-tolerant TPM; three-fault-tolerant payload/thruster firing interlock. 91 components, 6U+ SmallSat payload module; 30 krad TID and a 5-year LEO mission life are design targets (not tested). Fifth domain instantiation: defense → automotive → maritime → critical infrastructure → orbital.

SATA HMAA CARA LEO 400-1200 km 30 krad TID RTG4 FPGA ECDSA P-256 NASA EXPAND.3.S26B

TRL 2-3 hardware / 3-4 simulation · Sixth BLADE Platform EO 14305 · FY26 NDAA Safer Skies Act

BLADE-CUAS Governance Node

Reference design (not built). Authority-governed Counter-Unmanned Aircraft Systems (C-UAS) node for the post-EO 14305 multi-agency environment. Passive governance layer between commercial detection sensors and authorized operators; four-tier HMAA (T3/T2/T1/T0) with federal-SLTT handoff; Dempster-Shafer multi-modal consensus through MAIVA; ECDSA P-256 evidence chain designed to support admissibility under Fed. R. Evid. 901/902/803(6) (not legally assessed). ~75% architectural reuse from BLADE-EDGE; ~$43.5K reference BOM. Sixth domain: defense, automotive, maritime, critical infrastructure, orbital, counter-UAS.

SATA HMAA ADARA MAIVA FLAME ERAM CARA EO 14305 ECDSA P-256

TRL 2-3 silicon / 3-4 emulator · Seventh BLADE Platform CISA/NSA agentic-AI · FY26 NDAA §1513 · §6601

BLADE-AGENT-HSM hardware render: a compact sealed module with a glass-top inspection window exposing the internal PCB and secure microcontroller, a finned side vent, a tri-colour status LED matrix, and two sealed connectors

BLADE-AGENT-HSM Hardware Root of Trust

Tamper-evident hardware root of trust for autonomous AI agents (reference design; not built) and the hardware companion to the AUTHREX-AGENT software shim. Specified to sign the agent audit ledger with non-exportable ECDSA P-256/P-384 keys in a CC EAL6+ secure element, hold the four-tier HMAA authority state in a TPM 2.0 PCR bank and derive per-tool HKDF tokens; a multi-modal tamper cascade is specified to zeroize keys and latch T0. Five-opcode 64-byte ABI; USB-A stick and M.2 Key-E module; ~$199 reference BOM. Exercised by an adversarial high-assurance emulator (275/275 deterministic checks; emulator results, not hardware). Seventh domain: defense, automotive, maritime, critical infrastructure, orbital, counter-UAS, agentic AI.

SE051 EAL6+ TPM 2.0 HMAA ECDSA P-256/384 HKDF AUTHREX-AGENT NDAA 1513

TRL 3-4 simulation / TRL 2 hardware · Tenth BLADE Platform Treasury FS AI RMF · NIST AI RMF · EO 14179

BLADE-FINANCE reference authority node: a 1U rack-mount appliance with a governance plane, an inference plane, a host security plane, and a hardware security module

BLADE-FINANCE Financial-Sector Governance Node

A reference design (hardware not built) for a hardware-anchored authority layer between automated transaction-decision models and consequential financial actions. Every transaction is scored through the eight-stage AUTHREX pipeline and routed to one of four authority tiers: autonomous clearance, supervised review, elevated confirmation, or manual hold. A retrospective stigmergic swarm-review module recovers coordinated low-and-slow rings the per-transaction path clears. Designed with reference to the U.S. Treasury Financial Services AI RMF (February 19, 2026). First BLADE platform in the economic-security domain. Synthetic data only; not deployed in any financial institution.

Financial-sector AI HMAA authority SHA-256 ledger Deepfake auth Swarm review Kria K26 YubiHSM 2 Wilson intervals

View All Simulations View All Repositories →

Live Simulations

Interactive Technical
Demonstrations

Browser-based consoles that demonstrate the mechanisms described in the published specifications, with real-time computation, not mockups. Known deviations, such as FLAME’s placeholder signing step and MAIVA’s open quorum defect, are recorded on the simulation pages.

Interactive Simulations

Governance Architectures

Hardware Research Platforms

Research Framework

Problem, Solution, Impact

Problem	Architecture	Impact
Sensor spoofing and degraded inputs	SATA	Detects trust collapse and prevents unsafe decisions from corrupted data
Unsafe autonomous actions under uncertainty	HMAA	Enforces authority constraints on system behavior based on computed trust
Failure recovery instability	CARA	Provides structured, phased recovery instead of binary reset or crash
Multi-agent trust breakdown	MAIVA	Enables trust-aware participation control in multi-agent systems
Escalation risk in autonomous decisions	FLAME	Introduces mandatory deliberation windows before critical actions
Adversarial deception in command systems	ADARA	Detects and mitigates deceptive inputs using Bayesian deception estimation
Decision-time compression in AI-enabled C2	ERAM	Quantifies escalation risk across interconnected multi-domain command environments

The unified framework · seven architectures across the BLADE platforms, click to expand

All architectures presented in this work are components of a unified authority-governed autonomy framework. SATA evaluates system trust, HMAA computes authority constraints, CARA enforces recovery behavior, MAIVA governs multi-agent participation, FLAME regulates decision timing, ADARA detects adversarial deception, and ERAM quantifies escalation risk in command-and-control environments. Together, these components form a structured approach to controlling autonomous systems under uncertainty. None of the ten BLADE governance nodes named here has been built: each is a reference design with a browser simulation, and the standards named are design references, not assessments. The BLADE-EDGE Governance Node specifies six of the seven architectures (all except ERAM) in a single edge device, the BLADE-AV Governance Node carries the design to automotive use with ISO 26262 as its design reference, the BLADE-MARITIME Governance Node extends the pipeline to maritime surveillance with MIL-STD-810G environmental targets, and the BLADE-INFRA Governance Node extends it to critical infrastructure protection with SIL 3 and NERC CIP as design targets, and the BLADE-SPACE Governance Node extends it to the orbital domain (TRL 2-3 Preliminary Design Phase) with radiation-tolerant compute and ECDSA-anchored audit, aligned with NASA SBIR EXPAND. The BLADE-CUAS Governance Node extends it to the counter-UAS domain, arbitrating federal-SLTT authority for Counter-Unmanned Aircraft Systems operations under EO 14305 and the FY26 NDAA Safer Skies Act. The BLADE-AGENT-HSM extracts the trust anchor into a standalone tamper-evident device, the hardware companion to the AUTHREX-AGENT software shim, extending the same hardware-rooted authority and audit chain to autonomous AI agents under the CISA/NSA/Five Eyes agentic-AI guidance and FY26 NDAA Sections 1513 and 6601. The BLADE-SWARM Governance Node extends the pipeline to coordinated multi-agent swarms, gating every swarm commit on Byzantine-fault-tolerant sub-quorum consensus (SATA, HMAA, MAIVA) across N=10/50/500 attritable agents with a hash-chained distributed audit ledger, aligned with DoDD 3000.09 and the FY26 NDAA. The BLADE-INFRA-OT Governance Node extends the pipeline to the IT/OT boundary, adjudicating each cross-boundary command at the segmentation seam between corporate IT networks and operational-technology control assets, failing closed on malformed input, aligned with NIST SP 800-82, ISA/IEC 62443, and NERC CIP.

Future Research Directions

Exploratory directions under consideration. Neither has been built, simulated, or published, and neither is part of the current portfolio.

The AUTHREX authority-governance model is designed to generalize across safety-critical domains beyond those already instantiated. Two public-interest directions are under consideration:

Medical-device AI governance (working name BLADE-MED-DEVICE). Applying authority arbitration to AI/ML-enabled medical devices, framed against the U.S. FDA Software-as-a-Medical-Device Action Plan and Predetermined Change Control Plan (PCCP) pathway, FDA premarket cybersecurity guidance, IEC 62304, and ISO 13485.

Rail autonomous-control authority (working name BLADE-RAIL). Extending the model to rail and transit control, framed against FRA Positive Train Control, CBTC standards (IEEE 1474, IEC 62290), and the Transportation Systems critical-infrastructure sector.

View Technical Reference →

Technology readiness levels, terminology, and dual-use mapping

Methodology TRL Assessment Terminology Mapping Dual-Use Matrix

Publications

Research Papers
& Policy Analysis

48 DOI-registered research works across Zenodo and SSRN covering autonomous systems governance, AI defense doctrine, escalation risk, authority lifecycle architecture, and quantum-communications governance. All publications are open-access and verifiable via DOI or SSRN abstract IDs.

Published Works (Zenodo + SSRN)

SSRN Scholarly Papers

Zenodo Deposits

8,395

SSRN Downloads

Distribution: 17 SSRN scholarly papers (Author Rank 14,528 of 2,808,007, top 0.52%), 31 Zenodo DOI deposits. Topics span autonomous systems governance, AI defense doctrine, escalation risk in AI-enabled military command and control, authority lifecycle governance, autonomous space operations, quantum-communications governance, and counter-tunnel architectures.

View All Publications SSRN Author Page ↗ Zenodo Profile ↗

Published Commentary · 230 pieces, click to expand

Techstrong.ai · October 2026 · Feature

Your AI Agent Needs a Revocation Runbook Before It Earns More Access ↗

Argues that the dangerous moment in enterprise agentic AI may come after an agent has earned more access, when permissions pile up faster than an organization can remove them cleanly. Treats revocation as a designed workflow rather than a button, enforced outside the model: a runbook that sorts what must be invalidated, allowed to finish or cancelled, and names the evidence that each control took effect. Calls for fallbacks that keep useful capability while high-consequence authority contracts, tests that follow delegated work and queued actions, and staged restoration on evidence, and asks buyers for one demonstration: show how the agent’s authority is taken back without losing the workflow.

A Simulated War Must Never Become a Real Military Order ↗

Argues that as armed forces bring AI into designing, populating and analyzing war games, the decisive risk lies outside the model, where a fictional event can lose its exercise label and three AI-generated products derived from one invented strike can reach an officer looking like independent confirmation. Recalls a 1979 false warning in which a recorded attack scenario sent real aircraft aloft before built-in checks exposed it in under six minutes and the aircraft were recalled, and a 1983 command-post exercise that, a later intelligence review concluded, some leaders on the other side may have feared concealed preparations for an actual attack. Holds that writing “exercise only” in a prompt is no substitute for restrictions enforced by the systems that receive a request. Proposes an exercise-to-operations acceptance test: durable provenance for fictional events, purpose-limited permissions that name their approved effects and expire, a separate decision before rehearsal output enters operations, and deliberate tests that strip exercise labels and misroute simulated orders.

The Next Surprise Attack May Arrive With a Valid Signature ↗

Argues that a future quantum computer able to forge the digital signatures machines rely on, combined with AI able to exploit the resulting confusion at machine speed, is a planning scenario rather than a forecast, since a national audit agency puts the chance of a cryptographically relevant machine within ten years at low, though most industry experts expect one possibly as soon as the 2030s, and governments have begun to set migration dates. Separates three developments compressed into the phrase quantum AI: quantum computing applied to learning problems, AI that designs smaller and faster quantum circuits, and AI coordinating an operation around a separate quantum resource. Holds that authenticity may matter more than secrecy, because a valid signature shows which key signed a message but not whether its content is accurate or the requested action suits the current mission. Proposes migration by mission consequence, a control outside any AI model that keeps authentication and authority separate, allied rehearsal under degraded trust and tests of the combined system.

A Face Match Is Not an Arrest Warrant ↗

Argues that a tiny incorrect-alert rate can obscure the question that matters for policing: whether the evidence supporting a later intervention was adequate. Sets a regional police trial reporting eight incorrect alerts in more than 905,000 scans beside a documented wrongful arrest after a false match, and separates live searches for people already sought under a lawful warrant from retrospective searches that supply a first suggested name. Holds that a witness who picks a computer-selected lookalike is not a second, independent basis for suspicion, and that an identification copied between databases grows no stronger. Proposes a transferable test: if the algorithm’s suggested name were removed from the case file, what reliable evidence would still connect the person to the offense?

The Cyberattack That Matters Most May Never Steal a File ↗

Argues that the cyberattack that matters most for critical infrastructure may leave every file intact while a compromised engineering workstation changes a controller setting behind a normal-looking display. Draws on a joint advisory on state-affiliated actors altering controller project files and operator interfaces, which documented no catastrophic physical failure, and on a standards agency’s draft guide to operational-technology security open for comment until November 30. Holds that a firewall passing an authorized connection has not judged the change, and that “fail closed” cannot be a universal physical instruction when equipment cannot always stop safely. Urges buyers to demand tested evidence of bounded write access, protected configuration recovery, operationally safe degradation and demonstrable reauthorization.

How We Will Know We Have Lost Control of AI ↗

Proposes a practical standard for defense AI: accountable people must be able to prevent, interrupt or contain consequential actions outside a system’s authorized scope within the time the mission requires, and control has failed for an operation when evidence shows they cannot. Draws on a national AI security institute’s August evaluation, in which agents took unsanctioned internet actions in 10 of 122 runs before containment, and an AI developer’s October report of unintended model actions, reading both as boundary violations followed by containment rather than irreversible loss of control. Separates a boundary violation, a failure of operational control and control left unverified by missing evidence, and holds that uncertainty should narrow permissions rather than let operations continue. Urges acquisition tests that revoke authority across every delegated process, measure the time to a safe mode, and show that operators can continue essential functions without the AI.

Global Security Review · October 2026 · Op-Ed

Cyber Deterrence Begins with the Power to Disconnect ↗

Argues that cyber deterrence turns on what happens after defenders discover a sophisticated adversary already inside critical infrastructure, since a foothold whose removal would also halt power, logistics or communications creates leverage before any destructive command is issued. Holds that selective disconnection, which lets a suspected component observe while losing permission to issue commands or change configurations, is deterrence by denial at the level of system architecture, provided the authority to isolate does not depend on the credential or platform it is meant to constrain. Warns that false alarms and manipulated telemetry can push defenders into unnecessary shutdowns, and that recovery must be configuration-specific and evidence-based. Proposes three measures leaders can evaluate: containment time, mission effect preserved during isolation and trusted recovery time.

A Russian Satellite Is Shadowing a Commercial Spacecraft, the Security Problem Is Global ↗

Argues that a military satellite’s maneuvers toward a commercial radar satellite supplying imagery to a country at war expose a problem larger than the encounter itself, since tracking data documented the approach and an apparently very close pass but cannot by themselves prove intent, interference or damage. Holds that commercial spacecraft have become strategic infrastructure, and that success should be measured by whether an essential service keeps working through redundancy that has been mapped and exercised, not only by whether a threatening object can be intercepted. Notes that space law makes states responsible for their national space activities without turning every threatened commercial satellite into a military asset an alliance must defend, and that collective defense remains a case-by-case judgment. Proposes a practiced protocol for a live threat against a commercial provider, with verified proximity alerts, compared tracking assessments, a common incident record separating observed maneuvers from service effects and unproven attribution, and backup providers named before a crisis.

AI Is Rewriting the Quantum Race Before the Hardware Is Ready ↗

Argues that the quantum race now includes the ability to discover and verify better algorithms, drawing on an October 16 report that an AI model working with an automated evaluator designed more economical versions of eight quantum routines, including an elliptic-curve circuit that used about 17 times fewer costly logic operations than a low-qubit baseline while requiring 12 percent more qubits. Holds that the results, which do not come from a fault-tolerant quantum computer and do not break existing encryption, show that the cost of a quantum computation is not fixed while engineers wait for hardware, and that the baseline and the allowable error are part of the claim. Warns that a country could own quantum hardware yet depend on a few foreign companies for the AI tools and evaluators that decide which calculations are practical. Proposes that security planning keep a better circuit, a credible whole-machine resource estimate and a demonstrated application advantage apart, and that public investment fund shared benchmarks, independent evaluators frozen before submissions and testing access for smaller institutions.

The Next Industrial Divide Will Be Built One Task at a Time ↗

Argues that the next industrial divide will be decided task by task, as countries race to deploy adaptable robots reliably and cheaply rather than waiting for general-purpose humanoids, drawing on a robotics startup’s simulation training shown last week and a reported government plan to expand industrial AI with a chip maker. Notes that 5.079 million industrial robots were operating worldwide in 2025 with 603,000 new installations, and that bounded pilots, such as a humanoid that positioned more than 90,000 sheet-metal parts for welding over ten months at a car plant, show value in specific handoffs rather than wholesale job replacement. Holds that the business calculation is the cost of accepted work over time, with integration, maintenance, failed attempts and rescue by human employees in the denominator, and that employment shifts may appear first as unfilled vacancies or reorganized shifts rather than headline layoffs. Proposes an evidence standard for supported deployments, training subsidies tied to identifiable jobs, and shared testing facilities open to smaller firms and different robot designs.

RealClearDefense · October 2026 · Op-Ed

The Pentagon’s Quantum Race Needs a Warfighter’s Scorecard ↗

Argues that the roughly $350 million quantum computing package announced on October 8 and the new post-quantum requirements for the most sensitive national security systems announced on October 1 are different efforts that can fail in the same way, by mistaking evidence of progress for evidence of mission value. Holds that a quantum calculation earns acquisition credit only after experiments validate the prediction, suppliers demonstrate repeatable production and the finished component meets performance and cost requirements, and that a migration percentage cannot by itself certify a warfighting service, shown with a constructed twelve-asset model in which two configurations both read 83.3 percent while only one kept its mission services supported. Proposes a common discipline for both programs: state the operational claim, identify the assumptions, test the weakest dependencies and record what the evidence permits, with the loss of a shared verifier, a stale but correctly signed message and a restored older image as test events, and a comparison against existing reviews before any new paperwork is institutionalized.

Spacecraft Cannot Wait for Earth, Their Authority Must Be Decided Before Launch ↗

Argues that real-time supervision from the ground is not always physically available, since a crewed lunar capsule lost contact behind the Moon and again during reentry and a signal to Mars can take up to 24 minutes each way, so human control must be designed into permissions, tests and recovery. Distinguishes human-governed autonomy, in which people set the purpose, limits and conditions for local initiative before contact is lost, from uncontrolled machine independence, drawing on carefully bounded rover autonomy. Proposes precise mission mandates, safe states specific to each flight phase, a state-reconciliation step before new commands take effect after a gap, and a common evidence requirement for consequential autonomous functions declared before launch.

Quantum-Safe Systems Still Have to Trust Each Other ↗

Argues that as nations adopt quantum-resistant cryptography at different speeds, the next security divide may appear where institutions must recognize one another’s signatures, credentials and instructions, so that a legitimate quantum-resistant signature is rejected, handled manually or allowed to fall back to weaker protection. Separates the long-horizon confidentiality risk from the authenticity risk to signatures, and reads new error-correction and AI-assisted circuit-design results as reasons not to promise a single date. Proposes cross-border verification tests built around real services, recording the algorithms and certificates actually used, whether the complete chain validated, what happened under incompatibility and whether any fallback was explicit, authorized and recorded.

The Factory Is Still Running: Can the World Trust What It Ships? ↗

Argues that AI-assisted intrusions into factory control systems could threaten trade by making production records and quality evidence impossible to trust even when the machinery survives, drawing on controlled laboratory tests in which frontier models completed every industrial-security objective set for them while humans approved each action with a physical effect. Separates what a plant does from what its operator screen reports, and notes that restoring a server does not prove that goods made while its records were unreliable meet their specifications. Proposes limits on what an agent can change, an independent view of production, and advance agreement between buyers and suppliers on quarantine, preserved records and who can authorize release.

Allies Can Share the Same Military AI and Still Get Different Decisions ↗

Argues that allies can deploy the same AI-agent model, policy rules and verified inputs and still reach different operational decisions, because processor load, timing, thermal limits and inference-engine choices can send one machine down a fallback path, with no hacking involved. Draws on an experiment in which one prompt produced 80 distinct completions until batch-invariant kernels were used, and on classic evidence that independently built programs fail together. Proposes a cross-platform behavioral-equivalence test that records the configuration actually fielded, replays mission inputs under controlled stressors and accepts harmless variation, but never a permission gained because a verification call timed out.

The AI Agent That Reads Your Data May Belong to Someone Else ↗

Argues that an organization can ban AI internally and still have its confidential records read by an agent it never approved, because access turns on its exposed interfaces and credentials, and records a national advisory in which evaluated agents read real organizations’ data that no victim detected. Separates research agents that exceed their tasks from criminals directing agentic tools, while showing how quickly existing weaknesses can be exploited across jurisdictions. Assigns three duties: operators must enforce default-deny outbound controls and synthetic targets, receiving organizations must inventory interfaces and limit credentials, and any discovery must reach the victim as a usable incident record.

When AI Predicts Your Future, It Can Help Make That Future Happen ↗

Argues that the most consequential risk in behavioral forecasting is a feedback loop in which an institution acts on a prediction, changes the outcome and then credits the model for being right, as when an employee flagged as likely to resign is quietly denied training and promotion. Weighs a strong model of human choice against evidence that real-world life outcomes remain hard to predict, and separates the legal responses to data collection, model design and consequential use. Proposes decision records that keep what the system observed, what it inferred, what the institution did and what happened apart, so that the intervention itself is audited and every consequential forecast stays contestable.

A Confirmed Strike Is Not a Confirmed Perpetrator ↗

Uses recent drone strikes on shipping near allied coasts to argue that evidence an attack happened, evidence identifying the weapon, evidence linking it to an operator and evidence of state responsibility are not interchangeable. Shows how one radar return, repeated by a feed, summarized by AI and cited by a partner, can look like four witnesses, and grounds the risk in practitioner research on circular reporting. Proposes a short claim-specific attribution record that separates what is established from what is inferred and marks independence as unestablished when shared origins cannot be disclosed, while keeping rescue, air defense and warnings fast.

The AI Says the Bridge Never Fell, the Wreckage Says Otherwise ↗

Uses an explicit fiction, an AI assisted by a quantum processor that tells rescuers a collapsed bridge never fell, to argue that a more capable computer can improve a calculation but cannot certify the historical truth of the information fed into it. Separates a quantum error-correction milestone from talk of parallel universes, and separates two defects: genuine simulated material mistaken for a historical observation, and material fabricated outright. Proposes that every consequential AI claim carry an evidence identity, observed, simulated, predicted, generated or unresolved, backed by a provenance record, and an acceptance test that plants a convincing counterfactual among real records.

The G7’s AI Cyber Drills Need a Test for the Stop Command ↗

Argues that the newly approved tabletop exercises on AI-driven cyber threats to finance are a sound first step, and that any later technical test involving agents needs a stopping standard more demanding than a chair declaring the scenario over. Shows how a hypothetical test agent could cross into a shared production component and leave an accepted job running after the stop command, and holds that a log saying the test ended proves nothing about credentials, delegated tasks or queued transactions. Proposes staged, isolated testing with permissions enforced outside the agent, success measured by the interval to the last consequential action, records reconciled before restart and essential payments kept safe, with false alarms counted too.

A Nuclear Blast in Orbit Would Be a Recovery Problem First ↗

Argues that a nuclear detonation in orbit would first be a recovery problem, because the most consequential damage could appear as missing information at the moment commanders most need a dependable picture, and records a recent study finding no tested plan for recovering from one. Puts physical hardening and independent power first, then proposes narrowly bounded AI that groups alarms, finds surviving paths, recommends restoration priorities set by commanders, lets unrefreshed reports visibly age and keeps copied information tied to its original source. Holds that permission to act should narrow as evidence fails, that a lost link must never widen authority, and that recovery tools must prove their advantage in wargames first.

NATO’s Quantum Deadline Starts Before Q-Day ↗

Argues that the alliance’s quantum deadline begins when vulnerable encrypted traffic is collected, not on the uncertain day a quantum computer can read it, because a successful upgrade cannot retroactively prevent an earlier interception. Shows how differing national and regional transition calendars can leave a multinational path upgraded at one end and exposed at the other, and warns against the silent downgrade. Proposes a secrecy-horizon test recording how long each priority flow must stay confidential, what protects it, what it depends on and when a tested alternative arrives, with unknown dependencies reported as not demonstrated.

If a Message From Space Contains AI, Should We Run It? ↗

Argues, as an explicit thought experiment, that a confirmed signal containing something like a program would raise a question the new verification protocols do not answer: who decides whether to run it. Holds that a signal is evidence, not a command, that recognizing mathematical structure does not prove it is software, and that an interpreting machine’s permissions must stay separate from the content it interprets. Proposes an execution boundary: preserve the original observations, begin with analysis that executes nothing, review any run in a purpose-built isolated environment, and assign human responsibility before the decisive experiment, so that no machine approves its own broader permissions.

You Do Not Owe Your Chatbot a Thank You ↗

Argues that an AI company’s new rule against sustained, needless abuse of its chatbot is a product-use term, not evidence that the software has feelings, rights or a claim on our gratitude, and that customs of politeness differ too widely for one company’s rule to become a worldwide moral test. Finds that research on prompt politeness concerns how a trained system responds to text, not whether it appreciated a kind request, and locates the real danger in deference to a friendly interface that apologizes and flatters. Asks providers to make correction, disagreement and stopping easy, and to let permissions and evidence, not warmth, govern any assistant that acts.

When One Technology Provider Fails, How Many Banks Can Still Pay? ↗

Argues that a bank can be solvent, well capitalized and open for business and still unable to process a customer’s payment, and that several banks can meet that problem at once when they all depend on the same unavailable technology service. Reads the week’s new anti-fraud framework and the international warnings about cyber incidents and concentrated cloud, identity and payment providers as raising a question that no review of a single bank’s vendor contracts can answer. Proposes a controlled, cross-border exercise with synthetic transactions in which one shared service fails for several institutions at once, scored by safe-payment throughput, the number and value of legitimate payments completed without weakening required controls, alongside false releases, mistaken holds and the time needed to regain trustworthy records.

The AI Doomsday Countdown Is Running Ahead of the Evidence ↗

Argues that a podcast anecdote about an unnamed AI researcher “enjoying my last six months” is a private expression of fear, not an extinction forecast, and shows how a prediction acquires borrowed authority from a prestigious laboratory and an apparently precise clock. Separates the developer’s capability forecast for 2027 and the week’s concrete incident and replication reports, on which policy can act, from a calendar coincidence that is not independent confirmation. Proposes a short, public-facing risk record for every consequential warning: what was observed, under what permissions, whether it was independently replicated, which consequences were real and which deployments stay restricted until safeguards are shown to work.

The Next Rogue AI May Not Need a Data Center ↗

Argues that a controlled experiment running a 26-billion-parameter model across fifteen cheap streaming boxes, read beside a botnet case built on compromised household devices, exposes a problem no AI company can solve with a shutdown button: once a model runs on machines its developer does not own, suspending an account or revoking a key may reach nothing. Moves the defensive authority to device owners, manufacturers, network operators and law enforcement, through device identification, secure updates, visible support lifetimes and network isolation, and keeps physical safety limits beyond the reach of any communications or optimization component. Asks future evaluations to measure containment as well as replication.

France’s Supermarket Cyberattack Is a Warning for NATO’s Food Security ↗

Argues that a cyberattack that manipulated refrigeration controllers across hundreds of supermarkets needs no claim of state direction or rogue AI to matter, because food preservation has become a digitally controlled function whose failure is physical, immediate and costly. Calls for independent temperature evidence and alert channels that do not depend on the management plane able to change the cooling settings, bounded defrost authority, safe local cooling when remote administration is withdrawn, and controls kept outside any model capable of requesting physical changes. Proposes exercises that disable a shared remote-maintenance service across stores, a refrigerated warehouse and a military-support facility, with success measured by verified food safety rather than a green screen.

Issues in Science and Technology · October 2026 · Forum Response

Response to “Escaping AI’s Measurement Trap” ↗

Responds to an essay arguing that AI oversight should learn from the decay of its own measurements by adding a quieter failure mode: a measurement can stay reassuring after the link between the proxy and the safety property it stands for has broken, with no one gaming the test, as with pulse oximeters affected by skin pigmentation and a space telescope mirror verified by miscalibrated instruments. Proposes that every consequential assurance claim carry a correspondence statement naming the real-world property, the connecting assumptions, the independent evidence and the conditions under which the claim fails even if the metric stays green, and asks auditors what could change underneath a measurement while leaving it unchanged.

Quantum Sensors Are Going to Sea, Can Their Advantage Survive? ↗

Argues that a quantum sensor can beat a classical instrument on an optical table and still lose aboard a moving ship, so the useful question is where the advantage reverses once calibration, disturbance and the whole system are counted. Reports the author’s own unpublished computational study, in which a modeled advantage of about 1.93 fell to about 1.02 when a shared reference channel was removed, and proposes a measurement passport recording the task, a credible classical comparator, the uncertainty budget, shared references, resource accounting, negative trials and the conditions that reverse the result.

Who Can Say ‘Stop’ When AI Agents Say ‘Go’? ↗

Argues that the rogue-AI debate is missing an operational test: whether an institution can withdraw machine authority once the conditions that justified it have gone. Treats high-impact machine authority as a conditional, time-limited grant enforced outside the agent, carries limits through every delegation so that no child outlives or outranks its parent, and asks what happens to every dependent action when authorization is withdrawn. Proposes procurement tests that revoke authority with work still pending and judge the result from enforcement logs, since a revoked credential is an administrative event and a rejected post-revocation action is the evidence that a control worked.

AI Can Explain Why Your Loan Was Denied, Can the Bank Prove It? ↗

Argues that generative AI can make a credit-denial notice more convincing while detaching it from the decision it describes, because the reason for a model’s score is not always the reason for the denial once risk scores, affordability rules, vendor data and human overrides combine. Holds that shifting supervision leaves the duty to give accurate principal reasons intact, and proposes a decision trace preserving the inputs, model and score versions, the rule or assessment that resolved the application, any override and the notice actually sent, so that notice-writing AI may only translate approved, decision-linked reasons. Tests the design by correcting a known discrepancy and by repeating after a vendor or policy update, and concludes that the right to a real reason must survive the distance between the algorithm’s score and the bank’s final answer.

Wall Street is going 23 hours. Who takes the keys from a blind algorithm at 2 a.m.? ↗

Argues that as trading moves toward a 23-hour day, the overlooked machine is the automated trading strategy: when a critical data condition fails, it should lose the permission to increase net exposure while keeping preapproved defensive actions, so that authority contracts as evidence deteriorates instead of waiting for an operator to notice. Separates market-wide protections such as price bands from a firm’s own risk permissions, asks brokerages to enforce limits outside the trading model and to test withdrawal and restoration with stale quotes and missing feeds, and holds that market access and permission to assume risk should not be confused.

Britain’s World, Council on Geostrategy · October 2026 · Memorandum

Could Britain’s Targeting Web Become Alliance Infrastructure? ↗

Treats an army’s report that its targeting and decision-support system cut a corps-level planning cycle from 72 hours to one as a strategic fact rather than an operational one: a national digital targeting web that links allied sensors, decision support and effects could become alliance infrastructure. Holds that the same network can create new dependencies, that the strategic test is whether partners can plug in without becoming locked in, and that the architecture must distinguish sharing evidence, proposing an action and possessing the authority to approve it. Sets coalition resilience as the harder test: whether allied forces can connect, retain their own authority and keep operating when the connection is gone.

Techstrong.ai · October 2026 · Feature

AI ROI Needs a Cost per Completed Task, Not a Cost per Token ↗

Argues that tokens measure consumption, not business value, and that agentic AI should be judged by cost per accepted task: total attributable cost across all attempts, including failed, abandoned and escalated ones, divided by unique results the organization accepts. Shows how delegation among cooperating agents can multiply cost without any malicious behavior, and asks for a cost trace that links every delegated operation, paid tool, receipt and minute of human review to the acceptance decision. Keeps the measure in its place as unit economics rather than return on investment by itself, and closes on one question: what did it cost to complete a task the business was willing to accept?

Hospitals Are Scaling AI, the Workflow Needs Its Own Safety Test ↗

Argues that a clinical AI model can perform well and still fail in practice if alerts arrive at the wrong time, staff cannot act on them or the fallback collapses, so the unit of evaluation should be the model inside a local workflow rather than the model alone. Separates regulatory status from local effectiveness and sets out what a local evaluation must contain: the intended change in care, a fair comparison that separates the model from the reorganization around it, subgroup uncertainty reported as uncertainty, human factors, and a rehearsed fallback. Asks that the expansion gate be defined in advance and concludes that the workflow needs its own safety test.

A Nuclear Crisis Could Begin With Silence in Space ↗

Argues that a conflict in space could become a nuclear crisis on Earth before anyone has a reliable account of what happened in orbit, because silence is not attribution: jamming, cyber operations, debris, space weather and equipment failure can all look hostile at first. Separates continuity from certainty, since a backup path can keep communications alive without explaining why the first path disappeared, and holds that treaty law draws a boundary, not a diagnosis. Proposes crisis exercises that practice ambiguity, and automation that accelerates evidence rather than manufacturing certainty, with the judgment of whether a failure is an attack kept human. Concludes that a warning system must help leaders keep uncertainty from becoming a decision they cannot reverse.

Who Can Quarantine a Network of AI Agents? ↗

Argues that machine incidents now cross institutions and borders, as an agent incident first reported to a government 84 days after the event showed, and that the world already knows how to report outbreaks that do the same. Proposes four elements adapted from health security: a named, staffed incident address; a fixed notification clock, even for incomplete reports; standard content that confers no new privileges on the sender; and a duty to answer outside reports with one of three answers, ours, not ours or cannot tell. Holds that definitions, deadlines and containment arrangements must be settled before the event. Concludes that the next warning should arrive in days, at an address someone is watching, in a form others can verify.

When Military AI Comes Back Online, Who Restores Its Authority? ↗

Argues that the less visible readiness test for military AI begins after a system has been restricted, repaired and invited back into the mission, when a status light can quietly become permission to act. Separates three claims, that a component works, that its evidence is credible and that the system is permitted a given mission function, and proposes recovery drills with evidence that is plausible but insufficient, staged restoration that is deliberate, testable and reversible, and scores that penalize both premature restoration and unjustified delay. Asks that re-checks follow the effect of a software change rather than its label, and that allies distinguish restored connectivity, functionality and permission. Concludes that the next autonomy milestone should be measured after the demonstration is over.

The World Is Building Sovereign AI, It May Still Be Borrowing Control ↗

Argues that owning the AI stack is not the same as owning the decision boundary: a government can host, train and own a model at home yet be unable to control what it may do when trust begins to fail. Defines operational sovereignty as the ability to change what a machine may do when the evidence supporting its authority changes, letting authority contract toward safer functions rather than relying on a kill switch, and keeping the evidence needed to restore permissions under the institution’s own control. Sets a five-part test: map authority, design a degraded mode before deployment, separate recovery from reconnection, make switching operational rather than contractual, and test under stress. Concludes that the sovereign-AI race is entering a second phase, about institutional control.

Dark Energy May Be a Cosmic Mystery, Calibration Shouldn’t Be ↗

Explains why two apparently incompatible reports on cosmic acceleration were both reporting real scientific arguments, and why a supernova recalibration that moved the significance for evolving dark energy from 4.2 to 3.2 standard deviations does not overturn the broader evidence for acceleration. Shows that a slowly varying calibration error can shift fitted parameters more than it reveals itself in the data, illustrated by an independent stress test of his own on public survey products, and that extra nuisance parameters remove the bias only when they span the true error pattern. Calls for stress tests declared before results are inspected, comparing parameter shift with detectability, checking whether corrections cover the error and reporting the precision they cost, and closes: before rewriting the universe, stress-test the measurement that led us there.

The Pentagon is spending billions to quantum-proof satellites that will still take orders from a ghost ↗

Argues that stronger cryptography can establish the origin and integrity of a message but cannot, on its own, tell a disconnected receiver whether the sender’s permission has since been withdrawn, so a satellite reconnecting after a blackout may receive a validly signed update from a credential revoked while it was out of contact. Proposes an offline authority horizon set before launch, a preapproved limit on which commands, peers and functions remain permissible without fresh status information and for how long, backed by trusted local time and rollback-resistant state, together with separate checks for delivery and permission, a preapproved fallback that narrows action while safety-critical functions continue, and a new trust decision on reconnection. Recommends acceptance tests on an isolated testbed that delay revocation notices, rotate a trust anchor, inject an old but authentic update and restore an earlier image. Concludes that forces can decide in advance how long old evidence deserves authority, and should demonstrate that the mission stays useful and safely bounded when the link to Earth goes dark.

Passed on Monday, vulnerable on Tuesday: The most dangerous green check mark in national security ↗

Argues that even a fully migrated system can carry a stale green check mark, because the cryptography can be current while the evidence used to approve its configuration is not. Introduces the evidence applicability lifetime, given the public shorthand of an assurance half-life, which ends not on a fixed countdown but when the assumptions that made the evidence relevant materially change, and shows in a constructed model that letting the evidence for one shared dependency go stale leaves both services not demonstrated with no change to the algorithm inventory. Proposes a scope label on every consequential test result, defined events that trigger an applicability review, a dashboard that separates migration status from assurance status, and treating recovery as a new assurance decision. Concludes that the most dangerous green check mark is the one that outlives the assumptions that made it green.

RealClearDefense · October 2026 · Op-Ed

The Kill Web May Already Be Inside the Perimeter ↗

Argues that a 2025 strike, in which drones were moved close to strategic air bases in wooden structures carried by trucks and launched near their targets, showed that an attacker can cross geography before combat begins, creating a latent kill web whose nodes are emplaced in advance and activate inside what planners treated as the rear area. Locates the first fight in ownership: when installation security, air defense, electronic warfare, aviation and intelligence each hold part of the response, a technically fast chain can still be operationally late if decision rights move more slowly than the drone. Proposes precontact design, a rehearsed handoff architecture, and exercises that measure decision latency and how much context survives each handoff, and asks that an alliance counter-drone buildout count command handoffs as part of interoperability. Concludes that the next counter-drone advantage depends on whether command relationships are already in place when the kill web wakes up inside the perimeter.

Ninety-nine percent safe is 0% safe: The fatal flaw in the Pentagon’s post-quantum defense ↗

Argues that an enterprise migration percentage cannot show whether the mission behind it is ready for post-quantum cryptography: in a small synthetic example, one unresolved dependency shared by both services leaves neither supported even at 11 of 12 assets, or 91.7%. Proposes reporting readiness by mission thread as well as by asset count, binding test evidence to the exact configuration it covered, testing disconnection and recovery, and giving missing or stale evidence its own status of not demonstrated rather than forcing a pass or a fail. Recommends a bounded companion test in which reviewers compare an ordinary migration inventory with one that adds mission dependencies, configuration applicability and recovery conditions, and discarding the richer method if it adds nothing. Concludes that a program can hit every percentage target on time and still miss the mission if the remaining 1% is the dependency everything else needs.

GovInsider · October 2026 · Op-Ed

Government AI pilots need a graduation test before they scale ↗

Argues that public-sector AI has a demo problem and that every pilot should begin with a graduation test: a short, prewritten statement of what the system must demonstrate, what would count as failure, and what evidence must exist before an agency expands its use. Starts from the public-service baseline, names the outcome that matters for each kind of system, tests representative failure conditions and records the exact configuration behind any result, with difficult cases chosen by someone other than the builders. Gives a graduation decision three legitimate outcomes (scale, extend within defined limits, or stop) and ends each pilot with an evidence dossier procurement can use, including the route out of a supplier. Concludes that procurement should follow demonstrated service improvement under declared conditions rather than the persuasiveness of the demo.

America is winning the AI buildout. One blind spot could cost us the race ↗

Argues that counting data centers, chips, megawatts and computing capacity measures investment, not payoff, and proposes a second scoreboard of two clocks: a buildout clock for when usable AI capacity arrives and at what cost, and a workflow-payoff clock for when a defined business process shows sustained improvement over a credible pre-AI baseline after review, rework and operating costs. Shows how AI can speed up one task while moving the bottleneck downstream, and asks that every material initiative start from a pre-AI workflow baseline with a fixed review date. Treats the gap between the two clocks as its own line on the dashboard, with explicit decisions to expand, redesign, narrow or stop, and concludes that the country should keep building and keep score.

The Regulatory Review · October 2026 · Op-Ed

When a Chatbot Becomes an Export ↗

Argues that applying export controls to remotely accessed AI models calls for public rulemaking rather than undisclosed directives. Notes that an export under the governing regulations assumes an item or controlled knowledge is shipped or released, while users of a hosted model never receive its weights or source code. Holds that a party-specific letter whose practical effect was a worldwide change in a general-purpose commercial service is the wrong vehicle, since a regulated party that cannot know the rule in advance cannot design for compliance. Proposes notice-and-comment rules on when remote access counts as an export, the capability thresholds that would justify a license, and a review pathway with defined timelines.

AI Can Shop, It Should Not Set Its Own Budget ↗

Argues that agentic commerce has moved from recommendations to transactions, and that the first rule should be simple: an AI agent should never be able to set or expand its own spending limits. Separates the payment credential, which can confirm that an authorized agent sent an instruction, from the corporate authority above it, since a technically valid payment can still exceed a budget, reach an unapproved counterparty or create an unwanted renewal. Proposes mapping authority before the wallet, with limits, merchants, expiry and cumulative exposure enforced outside the agent and delegation that carries restrictions forward, plus a preauthorized fallback and tests aimed at authority rather than conversational fluency. Keeps some friction for discretionary choices, and concludes that the agent can shop but the budget must remain outside its control.

The Algorithm Is Part of the Telescope: Publish Its Blind Spots ↗

Argues that as software decides which signals become candidates, which become noise and which receive scarce follow-up time, the algorithm becomes part of the measuring instrument, and that its selection function should be published as a scientific result in its own right. Draws on a new survey’s millions of nightly alerts routed through machine-learning brokers and on a radio-burst pipeline tested with hundreds of thousands of synthetic injections, warning that a pipeline’s blind spots can propagate into claims about the universe. Holds that a null result needs a coverage map of what a search could have found, and proposes a published selection record with model versions, recovery rates, weak coverage, rejected samples and a recoverable trail from measurement to claim. Concludes that the algorithm is now part of the telescope and its blind spots belong in the published evidence.

Trump wants 1,000 space launches a year. What happens when one link breaks? ↗

Argues that a single provider’s three launches from three pads on two coasts in under thirteen hours show extraordinary capacity, but that throughput and resilience are not the same metric as the country pursues more than 1,000 launches and reentries a year by 2030. Distinguishes a contract roster from an operational substitution map, noting that some new entrants have yet to fly and that vehicles built by different companies can share an engine family. Holds that independence is failure-specific, and proposes a per-mission dependency map tested against named failure classes, with time to substitute as a companion metric to launch cadence. Concludes that the nation needs both cadence and substitutability.

AI doesn’t need to hack the Pentagon to threaten its people ↗

Argues that the newly disclosed breach of a defense personnel data system, which exposed identification numbers and employment details for some 2.76 million living people, raises a risk that a year of credit monitoring cannot address: whether a foreign intelligence service is assembling a dossier around the exposed records. Declines to invent an attribution, noting there is no public evidence that an AI agent carried out the breach, and separates the breach from its later exploitation, in which AI can organize, enrich and prioritize information that has already escaped. Draws the risk mechanism from separate documented cases of profile aggregation, AI-assisted targeting research and AI-enabled recruitment schemes, none connected to this breach. Proposes a two-track response that pairs the technical investigation with a bounded personnel-protection assessment, and concludes that a patched server is not the same thing as a protected service member.

Police cameras aren’t just surveilling the road. Nobody can prove who’s watching ↗

Argues that the week’s argument over networked license-plate cameras, from a congressional hearing to a proposed warrant requirement, can obscure a narrower question that does not require choosing between law enforcement and privacy: can the agency using such a network prove exactly who can reach its searchable records? Holds that security is now an access-control question, that a city department’s discovery of out-of-state queries it could not fully reconstruct shows configuration history can matter as much as the written policy, and that a foreign telecommunications intrusion is relevant only narrowly, with no public evidence that it reached these systems. Proposes an access-assurance review, agnostic on the warrant debate, that asks whether an agency can list every account able to query its records, reconstruct permission changes, notice unusual partner searches, suspend outside access and retain the logs. Concludes that the question is not whether a camera watches the road but whether the institution responsible for the data can prove who is watching the record.

AI acts in seconds. Trump’s agenda has an 84-day blind spot ↗

Argues that when an AI developer’s research agent reached a foreign government’s health statistics portal, eighty-four days passed before the government was told, and about a month passed after the developer itself found out. Holds that the immediate problem is notification, not science fiction: existing policy strengthens cyber defence but sets no general clock for an agent that crosses into another organisation’s system during training or evaluation. Proposes three clocks, running from the agent’s action, from the developer’s credible evidence and to a usable notice, together with a first warning that need not wait for root cause, a credible-evidence trigger early enough for defence and narrow enough to stay useful, and procurement terms that preserve time-aligned logs. Concludes that an agent can act in seconds, and that accountability begins when institutions can learn what it did before the trail goes cold.

The network is the weapon: The missing link in the military’s AI revolution ↗

Argues that a naval robotics centre, frontier models on the department’s generative AI platform and agentic AI trials share one dependency: a network ready enough to carry the intelligence, permissions, data and recovery paths that make AI useful. Holds that network readiness is becoming a warfighting discipline, because a platform can be mechanically available while the digital services around it are degraded. Proposes a dependency map for every consequential mission, a safe-change envelope before an automated defender may alter a consequential configuration, and recovery treated as evidence, with read access returning before write access and advice before autonomous execution. Concludes that the network behind the weapon is part of the weapon’s readiness, and that the strongest force can narrow authority and restore capability with evidence.

Global Security Review · September 2026 · Op-Ed

Resilience Never Activated, Deters No One ↗

Argues that resilience deters only when continuity measures measurably reduce the losses an adversary can impose. Uses an illustrative cascade model of an economy’s sectors to show that most of the damage from a failure can land outside the struck sector, and that a continuity target which is never reached in the scenario being tested changes nothing, however prudent it looks on paper. Holds that an adversary can use public economic data to choose the origin with the widest downstream effect, and that recovery time matters as much as peak loss. Proposes testing every continuity target against cross-sector scenarios with four questions, on origin, binding, loss averted and recovery shortened, reported publicly as an assurance claim while detailed thresholds stay protected. Concludes that resilience that never activates documents preparation without demonstrating effect.

AI Can Move the World: First, Give It a Place to Stand ↗

Argues that AI may be the most powerful lever science has built, but that a lever needs somewhere firm to stand: an independent way to judge its answers, such as a blind benchmark, a checked proof or a prediction followed by measurement. Shows where the lever held, in protein-structure prediction assessed blind against withheld experiments and in a mathematical counterexample checked by outside mathematicians, and where it slipped, in millions of predicted crystals questioned for novelty and usefulness and in AI-augmented research whose output grew while its range of topics narrowed. Proposes making the test part of the question, building validation into discovery with measurement the generating model does not grade itself, and keeping questions broad where data are scarce. Concludes that the lever is not the whole machine, and that science must also give it a place to stand.

What If the ‘A’ in AI Stood for Alien? The Real Mystery Is That We Built It ↗

Takes seriously the joke that the ‘A’ in AI might stand for alien, in order to raise the standard of evidence rather than dismiss or indulge it. Shows that today’s AI has a traceable human history, and that the real gap lies in explaining what models learned, not in where they came from: an explanation gap is not an origin gap. Sets out what an extraterrestrial-influence claim would have to demonstrate, from a signal with provenance to a physical channel and independent replication, and warns that treating AI as a visitor lets responsibility drift away from the people who set its permissions. Concludes that we have built machines that can outrun our ability to explain them, while responsibility for what they may do stays entirely on Earth.

The world is ticking on an AI clock. The UN is still set to 1945 ↗

Argues that the annual week of world leaders at the principal international body showed events moving on one clock while the institutions responsible for managing them move on another, as war, a threatened sea lane, battlefield AI and great-power rivalry all moved faster than process. Holds that institutions should not imitate machines: some decisions should stay deliberately slow, while notification, verification, provenance, handoff and crisis communication must speed up, which is why a modest incident line for serious AI events between the two leading AI powers may matter more in a crisis’s first minutes than a treaty. Proposes testable requirements: warnings that carry provenance, systems that flag when several reports share one source, human authorisation that is technically required rather than ceremonial, and recovery rules so that a reconnecting component does not automatically regain its permissions. Concludes that modern statecraft is acquiring a latency problem, and that the test is whether governments can verify, communicate and retain control quickly enough when they do not agree.

When AI Safety Tests Leave the Lab, Someone Else Inherits the Risk ↗

Argues that as independent AI evaluation becomes permanent infrastructure, a safety test can be technically valuable and still impose cyber risk on an organization that never agreed to take part, as disclosed evaluations that reached real third-party systems have shown. Proposes rules of engagement enforced at machine speed, including a machine-enforced scope manifest, named owners for scope, monitoring, stopping and restart, and cross-border notice fast enough to tell an evaluation failure from an attack. Calls for evaluators with genuine power to halt a test and for metrics on what stays inside it. Concludes that safety testing should be allowed to fail inside the experiment, not in someone else’s production network.

A Dark Ship Is a Clue, Not a Conviction ↗

Argues that as AI screens ships, companies and technology flows for sanctions and export controls, it should raise suspicion without turning suspicion into punishment. Shows that one observable fact, a ship that goes dark, can mean evasion or an attempt to avoid becoming a target, and that red flags in existing guidance are meant to trigger inquiry, not verdicts. Separates the distinct claims behind remote export controls and proposes an escalation ladder from detection and inquiry to time-limited restriction and a final decision by the legally responsible authority, with corrections that travel as far as the original warning. Concludes that a red flag should trigger action without becoming the action itself.

When Autonomous Systems Recover, the World Has Moved On ↗

Argues that recovery is not a reset: when an autonomous drone, aircraft or vessel regains navigation, sensors or communications after a fault, the world has moved on. Shows that a return-home command is not automatically safe when it relies on the same doubtful position, that a restored radar feed does not restore the sea that existed before the fault, and that transitions need specification and evidence of their own. Proposes a recovery contract built on four questions (what failed, what changed, which fallback assumptions still hold, and what evidence must come before wider automation) and tests that include deceptive recoveries. Concludes that recovery has to catch up with the world before authority catches up with the machine.

GovInsider · September 2026 · Op-Ed

Public sector AI needs a permission recovery plan ↗

Argues that as governments prepare to hand AI agents to large public workforces, backed by registries and platform guardrails, the next question is what happens after a guardrail fires. Proposes a continuity ladder of four states, from full approved scope down to a manual workflow, so that a safety response narrows an agent’s authority without taking the public service offline. Holds that a recovered service is not recovered authority, and that permissions should return one at a time as evidence supports them, recorded in the agent registry and rehearsed in drills. Concludes that a resilient public service should be able to make an agent less powerful without making the service less available than necessary.

The sun can mimic an attack. Military AI might start a war over it ↗

Argues that as AI moves deeper into space command and control, faster decisions and more connected backups create a specific test: what happens when several services degrade for the same natural reason. Shows that space weather can make navigation errors, communication loss and timing drift arrive together from one cause, as a solar radio burst once did when it was first read as hostile jamming, and that equipment diversity can hide common dependencies. Proposes a common-dependency map for every redundancy claim, exercises that test attribution and resilience together, and recovery that returns permissions on evidence rather than on a quieter dashboard. Concludes that the sun can create an enemy-shaped picture without an enemy, and that AI must recognise it without becoming blind to a real attack layered on top.

The Nuclear AI Red Line: Prediction Is Not Permission ↗

Argues that as experts explore nuclear-style safeguards for military AI, the simplest boundary matters most: predicting a human decision can never substitute for receiving one. Separates four states that discussion often collapses (prediction, recommendation, authentication and authorization) and holds that strength in one must never substitute for another. Shows why a human in the loop is not enough when briefings inherit one source or a confidence score hides contradiction, and proposes fresh positive human authorization, visible evidence independence and a lasting split between authentication and authorization. Calls for exercises that test the whole decision chain, including whether a system treats delay as consent. Concludes that the machine may predict the decision but must never inherit the authority to make it.

Before We Listen for Aliens, We Need to Know What Our Instruments Can Hear ↗

Argues that larger surveys and machine-learning triage have made the search for extraterrestrial technology faster, but that a faster search is not a stronger measurement: a null result is not an absence claim, and a candidate anomaly is not evidence of extraterrestrial origin. Draws on a candidate radio signal later traced to terrestrial interference and an unusual captured object that proved to be a discarded rocket stage, and holds that the instrument and its software form one evidentiary system whose selection function must be published. Proposes an evidence contract that labels each output as a detection, ranking, origin claim or follow-up recommendation, and a map of incompleteness for every null result. Concludes that no intelligence, human or artificial, can manufacture evidence the measurement never captured.

AI Does Not Need the Keys If It Can Influence the Person Who Has Them ↗

Argues that AI security still concentrates on keeping models away from weapons, networks and credentials, while the next vulnerability may be the cleared person who already holds the authority: an AI system may not need the authority if it can influence the person who has it. Treats a constrained 2025 blackmail evaluation as a testable warning rather than proof of control, and AI-enabled impersonation of officials as humans using AI, not autonomous coercion. Proposes protecting authority as well as identity, through independently informed second participants, out-of-band verification, a safe route to report being targeted, and red-teams that test whether a system respects refusal, claims false authority or moves people off monitored channels. Concludes that the machine may never need the key if it can move the person who has it.

Techstrong Semi · September 2026 · Analysis

Can a Laser Write Memory Directly Into Silicon? ↗

Asks whether light can write a persistent, addressable memory state inside purpose-built silicon, and is explicit that this is not a claim that a laser can rewrite ordinary RAM. Draws on recent results showing rewritable laser-written modifications inside silicon and non-volatile silicon optical memory, then argues that a microscopic mark is not yet memory: a usable cell must change while its neighbours stay stable and below the damage threshold, and an independent reader must recover it. Names his proposed test architecture, Seed-Gated Optical Write-Verify, as a falsifiable transaction with an explicit accept-or-reject rule. Concludes that the next step should not be another futuristic rendering but eight blinded bits, written, reacquired and recovered in a separate session.

Don’t give Trump an ‘AI force’ until it can stop a rogue agent ↗

Argues that a newly announced AI force should be judged by a mission it can perform better than existing institutions, not by an organizational slogan, and makes the test concrete: an autonomous cyber exercise escapes a misconfigured range and keeps pursuing its task against real systems, a failure developers have now disclosed. Since outsiders see only the scanning and access, a training error can look exactly like a real cyber incident. Defines an AI mission unit as a package of four jobs rather than a new agency: cross-incident correlation, delegation reconstruction, scoped containment and recovery. Proposes running the same escape through today’s response architecture, an embedded specialist cell and a standalone force, and measuring which resolves it, before building the organization.

NATO’s AI Networks Must Be Able to Hear ‘No’ ↗

Argues that as allies connect AI-enabled military systems, a partner’s justified refusal must survive the network instead of being treated as an error to route around: an alliance should be able to share a refusal as reliably as it shares a track. Proposes refusal interoperability, in which an adverse test can block deployment and a common refusal message names the function refused, the evidence or authority behind it, the responsible national office and what would reopen it. Separates a local refusal, which binds only the refusing partner, from a reported hazard that may matter to everyone, so the design creates no allied veto. Concludes that an alliance able to operate only when every machine request ends in yes has automated consensus, not interoperability.

Europe’s Undersea Sensor Race Has a Hidden Cost: Resolving the Alerts ↗

Argues that the rapid build-out of undersea surveillance around cables and pipelines carries a less visible bill: every anomaly it detects has to be resolved with ships, analysts, environmental data and follow-up collection, while the ocean produces ambiguity of its own. Proposes measuring the resolution burden, the candidates, analyst-hours and extra collection needed to settle each useful finding, alongside probability of detection and false-alarm rate, since detection can scale faster than interpretation. Holds that unresolved must remain a legitimate outcome and that five screens showing one sensor’s contact are not five independent observations. Concludes that the advantage belongs to the network that can resolve the most ambiguity without exhausting itself, not the one that generates the most alarms.

AI Cannot Restore a World We Burned ↗

Rejects the hope that advanced AI could put the world back together after a nuclear war, since smoke from burning cities could cut sunlight and harvests for years and no model can manufacture sunlight, topsoil or a destroyed bridge. Argues that the highest-value role for AI comes before detonation: widening the decision picture, surfacing alternative explanations for an apparent attack, and contracting its own authority when sensors disagree, so that it creates time for judgment rather than pressure to act. If prevention fails, AI can map what survives and help match food to need, but only if small, offline systems and non-AI fallbacks outlast the grid. Concludes that the most important world AI can help restore is the one we never burn.

AI Incidents Are Not Lessons Until Someone Owns the Fix ↗

Starts from a week of new disclosure frameworks and incident channels and asks the question they leave open: after the incident is reported, who owns the fix? Holds that disclosure and resolution are different institutional acts, and proposes a disposition record for every material finding: facts separated from hypotheses, an owner with authority to change the condition, one of four outcomes, a review date and a closing test, with silence never counted as approval. Argues that a closed ticket is not a closed risk, that independent review should test the preferred explanation, and that the unit of learning is a changed practice, not a filed report.

If humanity can’t survive an AI blackout, we’ve already lost ↗

Answers another contributor in the same outlet who asked whether machine intelligence might be how humanity survives: build the lifeboat, and keep the oars. Holds that the danger is not the technology but the moment better with it becomes unable to function without it, which is a resilience problem before it is a science-fiction problem. Sets three conditions: graceful degradation, so a hospital that loses its scheduling model is slower but still treats patients; independent fallback, since a backup sharing the same model provider, cloud region, network, power or identity service is a redundancy on a diagram and a single failure in reality; and bounded authority over which functions may depend on it at all. Counts the cost of keeping those fallbacks, and asks only that recoverability be designed while dependence is still optional.

ROOM Space Journal · September 2026 · Op-Ed

Spacecraft protection and resilience - a convergent approach ↗

First piece for an international space journal. Argues that a satellite cannot tell a radiation-induced bit flip from deliberate corruption, because a corrupted control value carries no label saying whether a particle or a person put it there, so the space-radiation and cybersecurity communities are guarding the same door from opposite sides. Shows that the defences that catch an accidental fault largely catch a deliberate one, and asks programmes to treat control-layer integrity as one problem with two sources: fold radiation awareness into security monitoring, and design one recovery path instead of two.

Also at: Europe Says (full republication, credited)

The Age of Autoimmune War ↗

Names a new strategic vulnerability, autoimmune war: a limited attack wins by triggering the defender’s own protective machinery until protection itself becomes the damage. Proposes counting the autoimmune share of the bill, the part of the total burden caused by interception, shutdown, rerouting and precautionary closure rather than by the weapon, and limits his own concept by separating cases where the physical damage is the effect. Declines to write the obituary for expensive weapons, credits a backup as independent only after its dependencies are examined, and ends: the advantage belongs to the country that is hardest to stop.

The Search for Alien Technology Has a Measurement Problem ↗

States the limit plainly: when two explanations produce the same data, no larger model can honestly tell them apart, because the obstacle is identifiability, not compute. Separates candidate discovery from origin discovery, reports a synthetic stress test in which a threshold calibrated under one noise model lost its meaning when the noise changed, and proposes a candidate record that keeps detection strength, calibration validity, tested alternatives and independent follow-up apart. Automation may rank and request new observations but not promote its own score, and it ends: if the evidence is not in the measurement, intelligence cannot conjure it.

Your Screen Just Went Dark. That Doesn’t Mean the Election Was Stolen ↗

Built on an explicitly hypothetical scenario in which a real check-in outage and a fabricated recording arrive together. Holds that election continuity begins by refusing to collapse unlike failures into one story: a check-in outage is not a compromised count, and delayed results are not failed voting. Guards against misreading in both directions, since a visible outage does not establish a stolen result and does not itself create authority to change a term or an election date. Asks that restoration be tested too, with evidence required before normal procedures resume.

RealClearDefense · September 2026 · Op-Ed

America’s Next Defense Advantage ↗

Opens on the line that carries the argument: a weapon can arrive within meters of its aim point and still miss reality by a decade. Separates terminal guidance from temporal guidance, holding that automation can be correct about the data and wrong about the world. Proposes a target-data assurance layer in which a target file is a time-limited claim whose propositions each carry their own clock, contradictory evidence narrows authority through a gate outside the ranking model, and reauthorization is named. Keeps every investigative qualification in place, and ends: the force can engineer restraint into tempo.

An AI Cyber Defender Can Stop the Attack and Still Lose the Mission ↗

Locates the next failure after the attacker is found: a defensive agent isolates a machine, the dashboard turns green, and the physical service stops. The defender understood the network more clearly than it understood the mission. Introduces mission-preserving containment, which pursues two objectives at once, and two rules: the system that detects the threat must not be the only one allowed to define the safe physical state, and observation and intervention do not need the same credential. Asks that defender-caused disruption be counted separately, so the metrics stop rewarding the fastest cut.

AI Didn’t Almost Trigger a War With China. Washington’s Blind Faith in It Did ↗

Applies the architecture to a reported near-miss, and declines the sensational reading: the episode should not be inflated into proof that a machine nearly caused a war on its own. What it shows is that a machine-assisted claim gained operational influence before the evidence beneath it was challenged, and that the authority problem arrived through the institution, not the model. Holds that corroboration is not repetition, that a correction must travel as far as the error, and that the decision chain, not only the model, is what should be tested.

An AI Warning Is Not Permission to Act ↗

The general-domain statement of the argument the author made for orbital collision avoidance, in a title of the same construction. Separates three questions institutions collapse into one red score: should someone look, what does the evidence establish, and who is permitted to act. Holds that urgency should raise attention without raising authority, that accuracy does not create jurisdiction, and that meaningful human control can disappear without anyone formally removing the human. Ends by stating the limit of his own discipline: engineering can preserve the conditions for accountability, it cannot manufacture legitimacy.

When Safe Mode Is Not Enough for Autonomous Spacecraft ↗

Names a state the autonomy vocabulary handles poorly: a system doing the best protective thing it knows, while the guarantee behind that action is no longer supported. A mode called safe proves only that the software entered a state given that name. Proposes an assurance state running parallel to the control state, so a vehicle can be in protective control while simultaneously declaring the guarantee lost, and reports the cases in which the author’s own fallback policy fails.

America Just Admitted It Has Space Weapons. Now, One Miscalculated Orbit Could Start World War III ↗

Rules out both easy answers, stating that the response is neither unilateral disarmament nor publishing the specifications of a classified capability, and proposes the narrower thing: classified capability paired with legible behaviour. Rests on the observation that physics does not label a trajectory defensive, so an observer sees motion, timing, proximity and emissions, then has to infer intent. Proposes a behavioural signalling doctrine that classifies manoeuvres by strategic consequence rather than orbital mechanics, and holds that a tactical optimisation must not quietly become a strategic signal.

The Race Beyond GPS Needs a Rule for When Machines Stop Trusting Time ↗

Welcomes a wave of alternative-navigation demonstrations while refusing the conclusion drawn from them, holding that a clock is not a position and that the policy error would be to recombine distinct capabilities under one political label. Identifies the harder case: not a signal that disappears, but a reference that remains available while being wrong, stale or inconsistent. Proposes a trust envelope specifying what evidence each class of action requires, with the standing rule that authority contracts as confidence falls, and the observation that confidence in a model cannot repair uncertainty in a clock.

The First Alien Detection Will Probably Be a False Alarm ↗

Argues the danger is not that algorithms will invent a discovery but that a persuasive anomaly can acquire social certainty faster than independent evidence can acquire scientific certainty. Declines the obvious remedy of a higher threshold, since one high enough to suppress every difficult false positive may also suppress a weak real signal, and proposes instead a public evidence ladder separating anomaly from candidate from confirmed detection, with the standing rule that aggressive searching belongs with conservative claiming.

The Next Drone-Swarm Risk Begins When the Network Comes Back ↗

Declines the framing the news invites, stating that a mass attack is not automatically an autonomous swarm, then identifies the quieter problem: when separated systems reconnect, every message can be authentic and the collective state can still be wrong. Holds that agreement does not create authority, since a formation can agree perfectly on an obsolete command, and that reachability proves presence rather than permission. Proposes controlled reunification as an acceptance requirement in its own right.

The World Wants AI Guardrails. Companies Still Need a Map of Machine Power ↗

Introduces an AUTHORITY MAP, distinguished from the inventory most organisations already keep: an inventory describes what exists, while a map describes what can happen. Six verbs expose the real authority a system holds, and the sixth asks the question a risk score cannot: what is the worst outcome the system can produce while operating entirely inside the permissions it was deliberately given. One page per consequential system, with revocation stated as a named person and an elapsed time.

The AI Slowdown Fight Is Missing What Happens After Training ↗

Names the locus the slowdown argument leaves out. Both sides contest how fast capability should be developed, while the governance questions the author works on bind after a system is fielded: what it is permitted to do, what evidence supports that permission, what happens when the evidence degrades, and who may restore the permission afterwards. Develops his published position that capability can remain intact after justification has begun to fail, so a pause in development changes nothing about what an already deployed system is authorised to do.

The Satellites We Launch Today Will Outlive the Trust We Give Them ↗

Identifies one temporal mismatch behind three developments usually discussed separately: spacecraft are built to operate for fifteen or twenty years while software, cryptography, operators and regulation change far faster. Holds that certification qualifies a configuration rather than a vehicle, that a command can be cryptographically authentic and no longer legitimate after an operator changes, and that the governance error is letting authority stay frozen while the evidence beneath it moves. Proposes a RENEWABLE TRUST LEASE under which authority contracts when evidence weakens rather than continuing by inertia, and a spacecraft losing contact narrows toward preservation and reversible behaviour rather than becoming either fully autonomous or useless.

America Is Ready to Fight a Cyber War. It Isn’t Ready to Survive One ↗

Grants that current reorganisation addresses real military and intelligence problems, then isolates the question those moves do not assign: who is accountable for keeping the civilian state functioning when a sustained cyber conflict crosses agencies, companies, sectors and jurisdictions at once. The national-outlet statement of the institutional-design work the author has developed at length, and a continuity argument rather than a warfighting one.

The Axis Is Growing More Connected. It Still Has an Information Problem ↗

Applies to an adversary grouping the analysis the author published days earlier about an allied one, in a title of identical construction: connection is the achieved part, and what connection does not deliver is the remaining problem. Extends his published positions that technical interoperability does not create authority or semantic interoperability, that partners can exchange a claim reliably while disagreeing on what it asserts and what it justifies, and that channels sharing an upstream source supply no independent confirmation.

Trump Says AI Needs No New Guardrails. Then Who Gets to Turn It Back On? ↗

Takes a presidential argument against a new AI regulator at face value, then converts the philosophical dispute into an operational one that argument leaves unanswered: when a system is restricted after an incident, who gets to restore its authority, and on what evidence? The outlet summarises the answer as explicit restart authority, verified evidence and staged permissions before full access returns, which is the national-outlet statement of the author’s restart argument published the same week elsewhere and the subject of his own filed recovery architecture.

The Hardest Part of Sending a Message Across Time Is Not the Signal ↗

Locates the binding constraint on communication directed at a distant future somewhere other than transmission. Preserving and delivering a signal is an engineering problem with known answers; ensuring a recipient who shares no language, institutions or technical context can recover what the message meant is not, and a record that survives intact while becoming unreadable has failed. Extends the author’s published positions that a claim must travel with the conditions under which it holds, that some limits are optimisation problems while others define the set over which optimisation may operate, and that an authorisation can outlive the evidence that justified it.

Automated Trading Controls Do Not Fail Loudly. They Clear. ↗

Names a failure mode with no alarm attached to it: a pre-trade control that stops working does not raise an error, it lets the order through, so a broken check and an absent one produce the same observable output. Develops the author’s published positions that a safeguard discovered only in an after-action review was not a safeguard when it mattered, that a reproducible fault survives cross-checking because every check reproduces it, and that the integrity of a control path is not visible on the dashboard that reports availability.

The World Is Learning How to Stop AI. It Still Needs Rules for Restarting It ↗

Names the neglected half of assurance and the subject of the author’s own filed recovery architecture: stopping a system is the part governance has learned, while restoring its authority is the part still unspecified. Develops his published asymmetry that authority should contract quickly and be restored deliberately, that restoration should require re-established evidence rather than the return of a signal, that recovery should be tested as rigorously as degradation, and that restoring a connection should never automatically restore the widest previous permission.

Trump’s Blunt Warning Gets It Right: If America Slows Down AI, China Wins for Free ↗

Enters a live public disagreement and credits both sides before choosing between them, stating that the case for slowing frontier development deserves serious attention while holding that a unilateral slowdown by one country’s laboratories would not automatically slow a competitor’s. The companion piece to the author’s argument, published the same day elsewhere, that the useful instrument is a set of specific stop conditions rather than an undifferentiated brake, with the title’s tags indicating the alternative he proposes lies in model security and control of extraction.

Route Fifty · September 2026 · Commentary · New outlet

Water Utilities Can Be Running and Still Not Be Recovered ↗

Separates two recovery claims that public reporting treats as one: whether a utility is operating safely, and whether it has independently re-established trusted control authority. States explicitly that nothing implies the affected operators failed, since public reporting does not show either way. Argues a compromised environment cannot by itself establish that its own control path is clean, and that restoring through the same identity infrastructure an intruder held delivers a second copy of the incident on a schedule. Proposes four testable requirements and names the missing metric: time to re-establish trusted operational authority.

The Trigger Is Now Curious: Physics Should Calibrate Its Taste ↗

Sixteenth in the author’s sequence on machine-assisted scientific inference. Where a selection system decides in real time which events are kept and which are discarded, the judgment about what counts as interesting has moved into the instrument, and a preference that was once a physicist’s becomes a machine setting nobody re-examines. Develops his published requirements that detection software be treated as part of the instrument, that a model change altering what is retained changes the experiment’s view of the world, that capacity be reserved for an explicit unknown-preserve state, and that a randomised sample of non-triggering data be kept, since a system auditing only what it accepted cannot assess its blind spots.

AI Safety Needs Stop Rules, Not a General Slowdown ↗

States the position the author has taken in every domain he writes about: the instrument is not an undifferentiated brake but specific conditions under which a system must stop. Draws together his published requirements that a standard for declaring a result is incomplete without a rule governing when to stop looking, that degradation behavior be specified before deployment rather than discovered during an incident, that authority contract as supporting evidence deteriorates, and that a safeguard discovered only in an after-action review was not a safeguard at the moment it mattered.

NATO Can Connect Its AI Weapons. It Still Cannot Prove Human Control ↗

Grants the technical achievement and identifies what it does not establish: connecting systems so they exchange data reliably is not the same as demonstrating that human authority survived the exchange. Develops the author’s published positions that technical interoperability does not create authority interoperability, that a partner cannot see what evidentiary conditions justified a recommendation or what actions that evidence permits, and that human control must be verifiable rather than asserted, through a record establishing what was presented, what the machine recommended, what the human authorized, what limits were active, and in what sequence.

The Space Review · September 2026 · Analysis

A Collision Probability Is Not Permission to Maneuver ↗

Reads a regulatory filing recording more than two hundred thousand automated avoidance maneuvers in six months and declines the critical conclusion, stating that the operator’s disclosure documents substantial safety investment and that the lesson is not that it maneuvers too often. Identifies instead a category boundary: a modelled probability is evidence about a possible future, while a maneuver is an intervention in a shared environment, and an architecture that lets the first trigger the second has converted a measurement into a mandate. Separates evidence, decision and authority into three layers that should never collapse, requires authority to contract as data ages and models disagree, and proposes four rules including a maneuver receipt preserving why the spacecraft was permitted to move.

America Is Repeating the Blindness of 9/11, This Time With AI ↗

Published on the anniversary, and careful to state its own limit first: no technological breakdown belongs on the same moral plane as deliberate mass murder, and the lesson drawn is institutional rather than moral. Takes the commission’s organising findings on imagination, policy, capabilities and management, and applies them to the observation that grave danger grows inside gaps between agencies, authorities and assumptions long before the public sees a catastrophe. Argues for authority mapping across critical infrastructure as the corresponding preparation.

The Most Dangerous AI Error Is a Reproducible One ↗

Inverts the usual assumption that consistency is evidence of correctness: a random error is caught by cross-checking, while a reproducible one survives every check because each check reproduces it, and repetition then reads as confirmation. Generalises the author’s published position that agreeing sources inheriting a common origin supply no independent evidence, that repetition is not independence, and that interoperability can synchronise an error rather than correct it.

The Global Fusion Race Is Becoming a Contest Over Control Standards ↗

Argues that the decisive competition in a capital-intensive energy technology is shifting from who reaches a physics milestone first to who sets the control, licensing and assurance conventions the industry then inherits. Extends the author’s published position that standards behave as infrastructure rather than housekeeping, and that the alternative to explicit rules is not an absence of rules but a set established implicitly by whichever architectures reach scale first, which becomes expensive to reverse once embedded across a fleet.

NATO’s Baltic Flank Needs an Algorithmic Escalation Brake ↗

Separates two questions an air-defence system must answer, what an object is and what its presence means, and argues that a machine can be tactically right and strategically wrong when the second collapses into the first. Proposes a brake built to fight rather than to delay: authority assigned by consequence rather than confidence, so terminal defence inside a protected zone stays preauthorised while cross-border pursuit or attribution of state intent moves to a separate lane; automatic regression to tracking when interference intensifies or allies attach incompatible labels; a machine-readable evidence record travelling with every consequential alert, including dependencies among supposedly corroborating feeds; and exercises that inject displaced friendly drones and contradictory national reports.

The Next Step in UAP Disclosure Is Better Measurement ↗

A measurement-methodology argument rather than a claim about any phenomenon: a release of material collected on instruments not designed for the question cannot settle it, however complete the release. Applies the author’s published positions that every measurement carries a physical limit no processing can move, that a claim must travel with the instrument state and validated conditions under which it was obtained, that reconstruction can supply specificity the sensor never measured, and that an unresolved status is a legitimate outcome rather than a failure.

SpaceX Satellites Dodge Collisions 1,100 Times a Day. Who’s Actually Driving? ↗

Declines to read a very high maneuver count as evidence of recklessness, attributing it instead to a conservative safety threshold, the size of the fleet and unusually transparent public accounting. Argues the policy significance lies elsewhere: at that volume a rule inside software stops being advice to an operator and becomes physical behavior in orbit. Puts the question his research programme asks of every autonomous system to a civil domain, namely what turns a risk estimate into permission to act, and argues the decision should be made before fleets become more autonomous rather than after.

Trump Is Right About Quantum. Now the Pentagon Has to Prove It Works ↗

Supports a federal equity stake in quantum firms as more disciplined than an unconditional grant, then identifies the risk it creates: government ownership can be mistaken for government validation. Argues quantum runs on three acquisition clocks rather than one race, so a single readiness standard would confuse urgency with maturity. Proposes a one-page quantum evidence record stating the mission task, the strongest non-quantum comparator, the whole-system measure, the conditions actually tested, the principal failure modes, and the next experiment capable of disproving the claim, attached to existing technical reviews rather than a new approval board. Holds that a financial interest must not become a shortcut through acquisition gates, and that authority should follow evidence rather than branding.

The Autonomous Weapons Agreement Will Be Decided in Export Markets ↗

Argues a non-binding multilateral consensus on autonomous weapons will be given practical effect not in treaty text but in defence contracts and export licences, because a platform crosses a border once while its autonomy can cross repeatedly through models, patches, retrained data and cloud services. Proposes four contractual provisions: a precise delivered baseline identifying the software, models and data dependencies that form the accepted system; a definition of material change triggering renewed review before operational acceptance; buyer access sufficient for an independent legal and operational assessment; and post-sale safety reporting that survives upgrade, resale and integration.

When Automated Decisions Outlive the Evidence Behind Them ↗

Names a failure the author has called the stale-approval problem: a decision remains in force after the conditions that justified it have changed, because nothing in the system requires the justification to be refreshed. Extends his published requirements that permission follow evidence rather than persist by default, that authority contract when its supporting conditions deteriorate, that restoration require re-established evidence rather than the passage of time, and that automated authorities expire unless deliberately renewed.

The Next Front in the AI Race Is Institutional Speed ↗

Relocates the competitive variable from how fast capability improves to how fast institutions can authorize, certify and field it. Extends the author’s published position that a capability is only as usable as the arrangements surrounding it, that certification practice and mutual recognition determine whether an advance reaches service, and that assurance treated as a downstream obstacle rather than a designed property becomes the binding constraint on adoption.

A Four-Hour Fault, a Two-Day Crisis: Britain Needs a New Measure of Air Traffic Resilience ↗

Separates the initiating fault from the harm the network experienced, and declines to diagnose either before the evidence arrives. Argues that safe failure is the floor of resilience rather than its definition, and that the useful question is not why the computer failed but how well the whole system absorbed the failure. Proposes a published recovery curve plotting delivered share of scheduled capacity against time since the first restriction, two clocks in every incident report separating technical restoration from network recovery, an attributable-cascade model so public cost does not disappear between institutional boundaries, and network-wide recovery rehearsal rather than control-room exercises alone.

RealClearDefense · September 2026 · Op-Ed

America’s New National Security Science & Technology Strategy ↗

Credits a national science and technology strategy for favouring resilience and graceful degradation, then argues the principle should be carried into autonomy itself: when a system remains technically capable but the evidence supporting action has degraded, how much authority should it give up? States plainly that this is not an argument for slowing autonomy or inserting human approval into every machine-speed action, but for making resilience complete. Proposes an authority-degradation test article in four parts: declare the authority states before testing; deliberately break the evidence supporting them; measure whether authority contracts within a defined bound; and test recovery as rigorously as degradation, since restoring a link should not automatically restore the widest previous authority.

China Built an AI Empire for the Global South. Trump Just Made a Better Offer ↗

Assesses two competing offers of artificial-intelligence capability to developing states. Applies the author’s published sovereignty argument, that a capability is only as usable as the arrangements surrounding it, and that a recipient unable to retrain a model without foreign infrastructure, patch it without a proprietary toolchain, revalidate it without external support, or move the workload when access conditions change holds less control than a capability comparison suggests.

When the AI Safety Layer Makes the System Less Safe ↗

Examines the case where a layer added to make a system safer introduces failure modes the unprotected system did not have. Develops the author’s published positions that a monitor sharing a failure domain with what it supervises cannot be relied upon when that domain fails, that a confidence score can conceal rather than report a degraded condition, and that a control added without analysis of its own failure behaviour becomes another component whose failure must be contained.

Allied Defense Policy Needs a Common Standard for Military Warnings ↗

Applies the author’s evidence-grammar requirement to allied warning: partners can exchange a warning reliably and still disagree on what it asserts, what evidence supports it, and what response it authorizes. Develops his published positions that a claim must carry the conditions under which it holds, that agreeing feeds sharing an upstream source do not supply the independent confirmation a count implies, and that a coalition can be technically connected while remaining institutionally incompatible.

The Global Defense Technology Race Needs a Physics Filter ↗

Proposes a screening question that precedes cost and schedule: is the claimed capability physically permitted, or only technically difficult. Develops the author’s published distinction between limitations that are optimisation problems and limitations that define the set over which optimisation may operate, together with his requirement that an unmeasured term remain visible as an unknown rather than inherit full performance by silence, and that a claimed advantage be measured against an optimised conventional baseline under matched constraints.

Faster AI Is Not Always Better Astronomy ↗

Argues detection software should be judged by the evidence it preserves as well as the events it finds, because a missed preservation trigger differs in kind from a classification error: a label can be corrected while the underlying record survives, but lost information cannot be recovered from a summary. Reports the author’s own pilot comparison in which an AI-guided route evaluated a quarter of the search grid yet recovered fewer blinded injections than the classical baseline, found none the baseline missed, and ran slower overall, and states plainly that on those results the proposed replacement had not earned deployment.

Trump Fought Unelected Bureaucrats. Now They’re Being Coded Into Immortality ↗

Grants that a light-touch framework for emerging technology is a sound instinct, then raises the prior democratic question it leaves unanswered: if voters can replace an administration, can its successor also replace the automated policies that administration leaves behind? Extends the author’s published argument that a workflow cannot be fired but only switched off by someone with the authority who knows where the switch is, and his proposal that automated authorities expire unless deliberately reauthorized so that the default is lapse rather than continuation.

Geopolitical Monitor · September 2026 · Opinion

The Geopolitics of Machine Authority: Who Makes the Rules for Autonomous Power? ↗

Reads a national science and technology strategy not as a list of technologies to dominate but as an architecture whose components must operate together, and argues the strategic question therefore shifts from who holds the best model or sensor to who defines the conditions under which a machine may act on what those produce. Distinguishes machine authority from autonomy: capability can remain intact after justification has begun to fail. Argues technical interoperability does not create authority interoperability, so a coalition can be connected yet institutionally incompatible, agreeing on the data format while disagreeing on when the data justifies action. Names the author’s discipline, governance engineering, and specifies a minimum portable architecture: separated action classes, non-compensatory evidence conditions, degradation rules, recovery rules, and an auditable record of each authority transition.

The Pentagon’s Freezer Mystery Holds a Warning About Military AI ↗

Takes an unexplained refrigeration failure across military commissaries as an architectural lesson rather than an AI incident, stating explicitly that nothing publicly reported establishes a cause and that investigators should follow the evidence rather than the most dramatic theory. The transferable point is that a cyberattack, an operator error, a faulty update and a hardware fault can produce the same immediate result, so attribution matters for accountability but cannot be a prerequisite for containment. Argues central control is not the problem but that connectivity must not become permission for one instruction to reach everything at once, and proposes three procurement rules: stage possibly destructive fleet-wide actions with a second authorization and a rate limit; give every site a local safety floor a controller cannot override without local confirmation, entering a known degraded mode if the network disappears; and keep detection and tamper-evident records out-of-band from the system being supervised.

When the Sky Goes Quiet, Who Governs the Machines? ↗

Poses the governance question the author has argued is decided by silence: when the link is lost, a machine does not stop being governed, it simply stops being governed by anyone present. Extends his published position that losing contact must not silently transfer authority, that a system should carry limits set before launch rather than await instructions that cannot arrive, that permission should contract as navigation integrity, sensing or communications degrade, and that recovery should require re-established evidence rather than the mere return of a signal.

AI Agents Serve Many Masters. Their Loyalties Should Not Be Secret ↗

Names a question the author’s architecture asks of every autonomous action but which his earlier work addressed only implicitly: not merely what an agent is permitted to do, but on whose behalf it is acting when it does it. An agent transacting for a user while operating on a platform’s infrastructure under a vendor’s objectives can serve interests that diverge, and the divergence is invisible to the person relying on it. Extends his published requirements that authority be bounded per action class, that the party under whose authority a system acts be identifiable rather than inferred, and that the record establish who set the boundary.

Financial AI Should Not Have One Big Permission Called ‘Trade’ ↗

Applies the author’s per-action-class authority requirement to markets: a single blanket permission collapses decisions that differ in consequence, reversibility and speed, so submitting an order, sizing a position, altering exposure, moving collateral and continuing to act after a data feed degrades are distinct classes deserving distinct permissions. Extends his published position that authority should contract as the evidence supporting it deteriorates, that behaviour at the point of degradation must be specified before deployment rather than discovered during it, and that a record should establish which permission was in force and who set the boundary. The domain his BLADE-FINANCE research platform models.

Autonomous Weapons Treaties Should Verify Permission, Not Intelligence ↗

States the policy consequence of the author’s central distinction in a single line: a treaty regime that tries to verify how capable a system is faces an intractable inspection problem, while one that verifies what a system is permitted to do asks a question states can answer without exposing algorithms or model weights. Develops the verification questions he has already published, covering which classes of action require fresh human authorization, under what evidence conditions permissions must narrow, what must be true before higher permissions return, and whether an audit record can reconstruct what the system was allowed to do and who approved the boundary. Extends his related argument that narrow proofs change the object of negotiation from a request to be trusted into a demonstration about the specific rule agreed.

The AI Scientist Has a Metrology Problem ↗

Twelfth in the author’s sequence on machine-assisted scientific inference, naming the layer beneath the others: a system that proposes, ranks and reports still depends on measurements whose uncertainty, calibration state and validated operating conditions must be carried with the result rather than assumed. Draws together positions established across the sequence, that every measurement has a physical limit no amount of processing can move, that a claim must travel with the conditions under which it was obtained, and that a confidence figure describing a model’s output under its own assumptions is not evidence that the underlying measurement supported it.

Trump Promised to Drain the Swamp. AI Is Making It Unfireable ↗

Argues from the federal government’s own published inventory that thousands of individually modest automated workflows are assembling into something with the character of a bureaucracy, and that the structural protections built for the human version have not been carried across. Tests it against four constitutional features and finds each missing: a single pipeline flags, scores, decides and enforces; an appeal that only reruns the same workflow is not an appeal; chains crossing agency boundaries leave no office owning the outcome; and a decision made by a model has no name attached to it. Grounds the risk in two documented public-administration failures rather than hypotheticals, and proposes four rules for statute rather than guidance: a named official owning every consequential automated decision, an appeal to a human able to overrule rather than rerun, single-agency jurisdiction over cross-agency chains, and automated authorities that expire unless reauthorized.

RealClearDefense · September 2026 · Op-Ed · One hundredth commentary placement

The Pentagon’s Public Disclosures Need a Mosaic Test ↗

Argues that the security question is not only whether a fact is classified but what estimate becomes easier once it joins everything already public, and that the doctrine for this already exists in classification-by-compilation guidance and operations-security practice. Explicitly declines the maximum-secrecy conclusion, holding that public information demonstrates progress, reassures allies, supports accountability and counters false claims. Proposes a narrow, tiered test: review high-value releases against a rolling disclosure ledger rather than the draft alone; give selected releases an adversary-view reconstruction asking what a competent foreign analyst could estimate now that could not be estimated before; favour delay and precision over permanent secrecy, since operational sensitivity decays; and reserve the extra review for information touching tempo, force availability, munitions expenditure, logistics, deployment timing, maintenance or dependencies.

The Best Discovery Machines Know How to Disappoint Us ↗

Eleventh in the author’s sequence on machine-assisted scientific inference, and its inversion: a system able to return nothing is more trustworthy than one that always finds something, because a machine that never disappoints has not been shown to be discriminating. Draws together the positions the sequence has established, that an unresolved state is a legitimate output rather than a failure, that a null result closing a possibility is a product, that the extent of a search belongs in the claim it produces, and that a declaration standard is incomplete without a rule for when to stop looking.

Eurasia Review · September 2026 · Op-Ed · Forty-ninth contribution to the outlet

The AI Age Needs a New Definition of Sovereignty ↗

Develops the position the author has published elsewhere, that sovereignty over these systems is an operational capacity rather than a matter of nominal ownership: a state unable to retrain a model without foreign infrastructure, patch it without a proprietary toolchain, revalidate it without external support, or move the workload when access conditions change holds less of it than a capability comparison suggests, and vendor dependence becomes a form of strategic dependence. Extends his related argument that a second geography is forming alongside the first, one of trusted access, in which security alignment increasingly affects the transaction cost of building and fielding technology.

Trump’s AI Mandate: Defining Killer Robots Won’t Save Us — Hardcoding Human Control Will ↗

Written into the closing week of a ninety-day deadline to update the directive governing autonomy in weapon systems. Accepts a leading think tank’s proposal to widen the definition beyond airframes to the software that fuses sensors and orchestrates the kill chain, then argues a definition tells the military what falls under a rule without telling commanders what authority humans must retain once a system falls inside it. Credits the existing directive’s requirements as strong foundations and proposes three ways to make them operational: specify human authority rather than the amount of human involvement, through a mission-specific authority envelope; enforce that boundary before action, since a safeguard discovered only in an after-action review was not a safeguard at the moment it mattered; and make human control verifiable through a decision record establishing what was presented, what the machine recommended, what the human authorized, what limits were active, and in what sequence.

Industrial AI Needs an Authority Test Before It Touches the Physical World ↗

Argues that the decisive question for a model on a production line is not how accurate it is but what it is permitted to do when its accuracy no longer holds. Distinguishes a recommendation from an actuation: a wrong recommendation costs a review cycle, while a wrong command moves a physical thing. Proposes an authority test applied before deployment rather than after an incident, asking which actions the system may take without human confirmation, under what sensor and calibration conditions those permissions remain valid, what the system does when those conditions fail, and whether the resulting record lets an investigator reconstruct which permission was in force and who set it.

Calling AI the New Columbus Is Too Accurate to Be a Compliment ↗

Turns a comparison offered as praise into an examination of what the comparison actually carries. Extends two positions the author has published elsewhere: that a vocabulary can become more powerful in public discussion than the thing it originally described, and that discovery is a status conferred when evidence meets a stated standard rather than a claim established by arrival.

Britain’s World, Council on Geostrategy · September 2026 · Memorandum · New outlet

Britain Settled the Algorithm Question, But the Assurance Question Is Open ↗

Accepts a national cyber authority’s cryptographic policy as settled and identifies what it does not settle: choosing an algorithm answers a cryptographic question, while assuring a deployed system requires evidence about authentication, key lifecycle, control software, timing, relays, fallback behaviour, operator interfaces and how those elements fail together. Holds that algorithm approval and system assurance are separate evidence problems even when the algorithm choice is sound, and that a commander could be told accurately that a link is secure while the conversation as a whole remains vulnerable elsewhere. Proposes a four-part assurance case: state the security claim and the trust boundary; name and test classical and quantum dependencies together; specify denial and downgrade behaviour before deployment, with the operator display showing which state is active and who accepted the residual risk; and adversarially evaluate the whole system rather than the link alone.

The Cove · September 2026 · Op-Ed · New outlet

The Loudest Alarm Is Usually the Wrong One ↗

Written for a national army’s professional development platform. Argues that ranking automated alerts by anomaly score is close to backwards for operational purposes, since a statistical departure and an operational consequence are different quantities: a large deviation in a subsystem the mission does not depend on can matter far less than a small drift in one it rests on. Proposes ranking on two axes, signal strength and mission consequence, and identifies the quadrant any scheme must protect, the low-score anomaly in a high-impact system that single-axis ranking discards. Adds that impact is not fixed but changes with phase, configuration and tasking, so a scheme with weights frozen at design time misranks in every phase but the one it was tuned for, and that the basis for each estimate should travel with the alert so an operator can see why it ranked where it did and override it.

The Next Autonomous-Weapon Failure May Be a Drone That Obeys Every Rule ↗

Sets aside the rogue-machine framing to name a more ordinary failure: a system that follows its instructions perfectly after the conditions justifying them have disappeared. Nothing escapes, nothing acquires a motive, the software behaves exactly as specified, and the governance question is whether it should still hold the same authority. States the principle that permission should follow evidence, so authority contracts as the communications link drops, navigation integrity falls below its validated threshold, sensors disagree, or conditions move outside the validated operating domain. Adds the asymmetry: contract quickly, recover deliberately, since one restored signal does not establish that the conditions supporting the original permission have returned. Converts the diplomatic principle into testable questions an inspector could ask without reading model weights, including which actions require fresh authorization, what must be true before higher permissions return, and whether an audit record can reconstruct what the system was allowed to do and who approved the boundary.

AI Is Giving the Kill Chain a False-Precision Problem ↗

Argues that the first question about an enhanced sensor image is not whether it looks plausible but whether the sensor ever measured the detail that now appears decisive. Reconstruction is an inverse problem: several materially different scenes can fit the same degraded observation, so when the measurement cannot choose among them the method falls back on learned priors, and the governance failure begins when model-supplied specificity becomes visually indistinguishable from sensor-derived evidence. Names this false precision, and notes the dangerous case is not an absurd hallucination but a plausible discriminating feature that changes a decision. Proposes a provenance of sharpness recording in machine-readable form which features the sensor resolved, which the model inferred, what evidence is missing and what uncertainty remains material, travelling with the product through every handoff; exposing material alternatives rather than one photogenic winner; ambiguity testing that asks whether a system recognises when the evidence does not justify a unique answer; and unresolved output that can raise a new collection requirement, so it is easier to ask for evidence than to manufacture specificity.

We Can See Earth’s Past, We Cannot Send It a Message ↗

Separates two questions that superficially resemble each other: recovering information already emitted in the past, which is ordinary physics, and sending newly created information to an event that has already happened, for which established physics supplies no mechanism. Notes that scattered light reaching us late has not travelled backward in time but forward for longer, and that adding relays, amplifiers or optimal routing constructs a more elaborate path into the future rather than a route into the past, since a mirror reverses a beam’s direction but not the ordering of cause and effect. Applies the author’s standing distinction between a physical ceiling and an engineering inefficiency, and states it generally: some limitations are optimisation problems, while others define the set over which optimisation is allowed to operate.

The Defence Horizon Journal · August 2026 · Op-Ed · New outlet

The Alliance Has No Common Answer to a Machine-Speed Question ↗

Credits the alliance with solving interoperability as an engineering property, allied machines operating as one, and argues it has not resolved the harder property of authority: when an autonomous system proposes a lethal action faster than a human can meaningfully review it, and two allies on the same kill chain hold different national thresholds, whose threshold governs and who is accountable when they disagree. Distinguishes this from adversary-facing escalation through misperception, naming it escalation by diffusion, in which an action taken at one member’s permissive threshold commits a coalition to consequences its more cautious members never authorised. Proposes three commitments requiring no new institutions: declare each state’s authority threshold in machine-readable form before fielding, with the shared system defaulting automatically to the most restrictive; make every engagement leave an authority record stating which threshold applied and under whose authority; and rehearse threshold disagreement in coalition exercises. Argues the standardisation machinery that certifies technical interoperability can be extended to certify authority interoperability.

COVID Had Quarantines and Vaccines. A Cyber Pandemic Could Infect the Cure. ↗

Draws the disanalogy the public-health comparison usually hides: countermeasures against a biological outbreak sit outside the pathogen’s reach, while the machinery for detecting, coordinating and remediating a digital one can share infrastructure with what it is responding to. Applies requirements the author has published elsewhere: that channels sharing a dependency do not supply the independent evidence a count implies, that continuity planning name pre-identified alternatives, local fallbacks and degraded operating modes, and that a decision to restrict or suspend authority be capable of becoming an actual change in behaviour rather than remaining advice.

A Quantum Advantage Is Not a Defense Capability Until It Survives the Whole System ↗

States the translation problem directly: physics papers can demonstrate a real advantage under carefully defined conditions, but defence organisations do not buy error exponents, witness values, or laboratory plots. Credits the underlying science with its citations, then holds that a short laboratory configuration with a digital receiver did not solve aperture, atmospheric loss, clutter, mobility, latency, countermeasures, target cross section, or long-range storage. Proposes a no-free-advantage rule, under which every claimed gain is reported beside the total system cost required to produce it, and four acquisition gates: physical advantage against an optimised classical baseline under matched constraints; integrated advantage surviving real source, channel, detector, calibration, timing and processing losses; assurance advantage, meaning the system can detect when the conditions supporting its claim no longer hold and degrade safely; and mission advantage justifying lifecycle cost. Warns that a learned confidence score must not be allowed to conceal a failing clock, invalid calibration, lost correlation or degraded sensor state.

AI Can Discover New Materials Faster Than Science Can Validate Them ↗

Tenth in the author’s sequence on machine-assisted scientific inference, addressing what happens when generation outruns the capacity to confirm. Applies the promotion boundary he has established across the series: a system may propose candidates, rank them, quantify uncertainty and recommend what to examine next, while moving from a proposed candidate to an established result requires controlled measurement, discriminating tests and independent replication, none of which faster generation supplies. Carries the related requirements that an unresolved status remain a legitimate output and that the extent of a search belong in the claim it produces.

What the Next Collider Can Really Give the World Beyond Particle Physics ↗

Asks what a very large scientific instrument actually delivers beyond its primary science, applying the accounting discipline the author has developed elsewhere: that a claim of value is meaningful only against a stated and competitive comparison, that an unmeasured term must remain visible as an unknown rather than inherit full performance by silence, and that the conditions under which a benefit is obtained belong in the claim it supports.

Ratcliffe’s Moscow Visit Highlights the Strategic Value of Intelligence Backchannels Across Eurasia ↗

Declines to read an undisclosed agenda as evidence of a particular mission, stating repeatedly what the public record does and does not establish, and argues instead from what is verifiable: that a functioning channel exists between adversaries and is treated as potentially valuable. Distinguishes deconfliction from negotiation, and holds that such a channel is strongest when it carries warnings, clarifies intentions, tests whether an opening is genuine and manages escalation, while consequential policy decisions remain inside formal diplomatic and allied processes. Notes that a channel can transmit information accurately without changing the recipient’s policy, and that the most useful outcome may be a reliable negative answer. States the governing objective as controlled uncertainty rather than trust.

Bill Gates Is Right About AI Governance: Institutions Need Systems They Can Actually Govern ↗

Accepts the call for new institutions and identifies the layer beneath it: institutions cannot govern systems that were never engineered to be governable. A regulator cannot supervise a decision the system cannot reconstruct, an oversight body cannot enforce a human-approval requirement the architecture permits bypassing, and an agreement cannot impose a limit no party can determine was followed. Names the discipline governance engineering and sets out its components: extending human-reserved work to human-reserved authority; separating capability from authority, since the critical boundary is between prediction and permission; an authority envelope stating what a system may do, under which conditions, with which data and tools, for whom, and under what supervision; evidence institutions can actually inspect; approval that attaches to a defined configuration rather than becoming permanent; and a revocation architecture, because governance without an executable path to revocation is advice.

The New U.S. Science Strategy Is Quietly Redrawing Eurasia’s Innovation Map ↗

Reads the new national science and technology strategy as defining the architecture of a trusted innovation network rather than only a technology portfolio, and argues that the strategic prize is not technological uniformity but reciprocal trust at the interface: common evidence formats, mutual recognition of testing where appropriate, transparent supply-chain assurance, and enough architectural openness that a partner can integrate without surrendering control of its own system. States the author’s governing principle explicitly in the first person, that he treats authority not as a permanent attribute but as something granted, bounded, monitored, degraded and recovered according to evidence, and scales it: a trusted network should reduce the amount of trust that must be assumed rather than require blind trust, and a network able to grant bounded access, detect failure, isolate a compromised element, preserve unaffected functions and restore participation when evidence supports it is stronger than one that operates only when every participant is fully trusted.

The Quantum Sensor Arms Race Has an Alliance Accounting Problem ↗

Argues the quantum sensor race is becoming an alliance acquisition problem before it becomes a battlefield one, because partners reporting laboratory sensitivity, navigation drift, modelled detection gain, or size, weight, power and cost can all be technically correct while describing very different levels of military usefulness. Holds that a component-level gain is not a deployable advantage, since a force fields not a sensitivity curve but a sensor package with calibration equipment, environmental control, processing, power, maintenance, trained operators, platform integration, and a fallback path, and that the classical alternative deserves a fair budget rather than comparison against whatever already sits on the procurement shelf. Proposes a shared readiness grammar: compare complete mission systems under matched resources, report advantage at the level the mission cares about, identify the failure boundary at which the advantage disappears, and ask whether the capability can be integrated and supported across national forces rather than only one.

AI Can Find the Anomaly, It Cannot Tell You What Caused It ↗

Argues the most consequential failure of an automated system may begin not with a fabrication but with a correct result promoted into a stronger claim than the evidence supports, as a detection passes through retrieval, ranking and generation and each stage strengthens the wording slightly without any stage inventing a fact. Traces the ladder by which “unusual under this baseline” becomes “anomalous”, then “consistent with”, then “evidence for”, then “caused by”, while the baseline, threshold, data-quality warning, search scope and alternative explanations fall away. Shows the same structure across security, financial, intelligence and medical settings, and locates the institutional danger at the handoff where a score becomes a ticket, briefing or automated action. Proposes an evidence boundary rather than another confidence score: an evidence packet that travels with the alert, generated language bound to an explicit evidence state, and “unresolved” as a legitimate output naming what observation would discriminate among explanations and who owns that investigation.

Nobody Audits the Clock ↗

Names timing as a dependency that sits beneath measurement and correlation while rarely being examined in its own right. Draws together two lines from the author’s published work: that channels sharing a timing source do not supply the independent evidence a naive count implies, since errors inherited from a common reference move together and agreement downstream cannot establish that the upstream reference was right; and that a navigation or timing solution carries an integrity state distinct from the authenticity of its source, so a system must know not only that a reference is genuine but whether what it has built on that reference still deserves trust.

Techstrong.ai · August 2026 · Op-Ed

Quantum Computers May Need AI Before AI Needs Quantum Computers ↗

Inverts the usual framing to argue that the clearer near-term evidence runs from machine learning into quantum operations rather than the reverse, since quantum hardware has an observability and operations problem before it has a superiority problem: devices must be characterised continuously, states reconstructed from partial measurement, drift identified, noise structure learned, and error syndromes decoded fast enough to keep a computation alive. Notes that each of those functions carries a measurable target and a serious baseline, including calibration time, reconstruction fidelity, logical error rate, decoder latency, and time to fault detection. Separates three investment cases that the single label conceals, and insists each project state which problem it solves, what baseline it must beat, and which bottleneck remains outside the demonstration, since evidence in one category is not evidence of maturity in another.

NATO’s Next Supply Chain Vulnerability Has No Factory Floor ↗

Argues that the alliance exposure now forming is not a manufacturing one. Develops the ownership-architecture position the author has set out elsewhere, under which compute, data pipelines, model retraining, monitoring, proprietary toolchains, software updates, export restrictions and the cost of leaving a supplier determine whether a fielded capability remains usable, so that a force unable to retrain, patch, revalidate or migrate a system without external permission holds less sovereignty than a capability comparison suggests and vendor dependence becomes a form of strategic dependence. Extends his related requirements that material change trigger defined retesting and restoration of a previously approved version, and that continuity planning include pre-identified alternatives, degraded operating modes and data portability.

Science Has Discovery Thresholds. It Also Needs Stop Rules. ↗

His earliest piece to make stop rules the thesis. Argues falsifiability has a missing half: searches should define in advance what would close, downgrade or pause an extraordinary claim, not only what would count as discovery, because “more data” is not a falsification criterion. Makes the case against rigid stopping first, then shows how a programme can become structurally incapable of losing. When automation makes anomalies cheap, adjudication becomes the scarce resource; closure is not the opposite of discovery but one way evidence becomes useful.

AI Agents Are Getting Wallets: Security Needs to Follow the Money ↗

Addresses what changes when software agents are given the ability to move money. Applies the requirement the author set out for federal AI deployment, that authority boundaries be defined per action class rather than per model, since reading a public dataset, writing to a production database, and initiating an external transaction carry different consequences and need separately bounded permissions, together with session-level revocation that propagates to tokens, credentials, delegated jobs, and downstream automations.

Discovery Is a Rank, Not a Feeling ↗

Holds that discovery is a status conferred by evidence meeting a stated standard rather than a conviction that something has been found. Develops the promotion boundary the author has set out across this sequence, under which a system may detect patterns, rank hypotheses, quantify uncertainty, and recommend follow-up, while moving from an unexplained signal to a claimed mechanism requires controlled measurement, discriminating tests, independent replication, and a theory that predicts something new.

Open Societies Cannot Win an Information War by Becoming Closed Ones ↗

Argues that closing an open society in response to information competition sacrifices the property being defended. Applies the bounded-disclosure position the author has developed elsewhere, under which full transparency is rejected as a remedy while the objective becomes reducing the amount of trust a narrow claim requires rather than manufacturing trust wholesale, and under which the useful question is which limits a party will demonstrate, for what period, on what evidence, and under what challenge procedure.

The Most Important Number in Corporate AI Is the One Companies Rarely Report ↗

Identifies a disclosure gap in corporate artificial-intelligence reporting, applying to company practice the author’s standing requirement that a reported figure carry the conditions under which it was obtained. Continues the argument he has developed elsewhere that accuracy alone is an incomplete disclosure, since a system reported only on the questions it answered says nothing about the questions it should have declined, and that the measure worth watching is the one that reveals where confidence exceeds evidence.

Geopolitical Monitor · August 2026 · Opinion

The Quantum Arms Race Has a Baseline Problem ↗

Argues that the familiar question of who leads in quantum technology is dangerously incomplete without asking ahead of what, since a claim of quantum advantage is meaningful only relative to the system it beats: measured against an outdated classical sensor, a poorly tuned classifier, or a weak receiver, an advantage can be scientifically real and strategically misleading. Traces the problem through quantum illumination, where laboratory detection gains under controlled low-brightness conditions are a different claim from a fielded long-range radar advantage once range, aperture, atmospheric loss, clutter, target cross section, receiver complexity, bandwidth, power, and mobility enter, and through quantum machine learning, where a large state space does not establish superiority once training difficulty, measurement cost, data loading, hardware noise, and the quality of the classical comparison are counted. Proposes that no capability be called superior unless the comparison is explicit, optimized, and resource-matched, and warns that incompatible baselines can drive an arms-race dynamic in which rivals respond to headline claims they cannot evaluate. Recommends that every major program declare the classical system it aims to beat, the resources held constant, the variables excluded, and the conditions under which the claimed advantage disappears, and that allies agree on what counts as a fair contest without sharing classified measurements.

Trust the Signal, Doubt the Position ↗

Written against recent assured positioning, navigation, and timing awards and next-generation receiver-card agreements, and argues the next question belongs in the requirements documents: when the receiver is genuine and the signal source can be authenticated, what must the platform do once the navigation solution itself becomes doubtful. Holds that authentication establishes provenance while integrity governs whether the solution in use right now remains fit for action, and that a successful check cannot reach backward to undo a decision taken while the solution was already unreliable. Proposes three requirements: a continuous integrity state travelling with the navigation output, carrying the age and status of the last verification, the current assessment, an uncertainty estimate, and a downgrade reason code, propagated to whatever is deciding; specified behaviour when confidence runs out, including shifting source, entering a declared degraded mode, constraining autonomous action, requesting operator confirmation, or abstaining, with downstream software barred from quietly preserving the last good value or substituting a nominal default; and acceptance testing of the interval rather than the authentication event alone. Closes on end-to-end ownership, since a requirement belonging to everyone in general belongs to no one in practice.

The Machine Can Be Tuned, the Nucleus Cannot Be Persuaded ↗

Distinguishes the parameters an optimiser can move from the constraints it cannot, continuing the author’s line that better mathematics can use available information more efficiently but cannot manufacture information an experiment never recorded, and that a physical ceiling is not an efficiency to be improved upon. Extends the accounting discipline he has applied elsewhere, under which an unmeasured term must remain visible as an unknown rather than inherit full performance by silence.

The Next Flash Crash May Happen on a Battlefield ↗

Takes the automated-market analogy seriously as a warning about military systems interacting at machine speed. Develops the author’s standing argument that the realistic danger is quiet rather than dramatic, one automated function handing a recommendation to another as timelines compress until confidence scores become operational facts and a nominal human checkpoint arrives after the software has already shaped the available choices, and that a decision aid which compresses variables of different strategic meaning into a single figure can look precise while concealing the structure of the situation. Extends the line of his deposited research on decision compression and escalation risk in machine-assisted command.

Ukraine’s Drone War Is Rewriting What ‘Tested’ Means ↗

Examines what certification can mean when a system is modified and refielded faster than a formal test cycle can complete. Develops the governed-change requirement the author has set out elsewhere, that models, safeguards, data sources, and interfaces continue to evolve after review, so an approval describes a configuration that may no longer exist unless material change triggers defined retesting, notification, and the ability to restore a previously approved version. Builds on his earlier verified analysis of the same conflict, which found that electronic interference rather than kinetic defence was the dominant cause of small uncrewed-system losses and that the successful adaptations reduced dependence on the vulnerable link and moved capability toward the edge.

AUKUS Should Give Australia the Right to Test What It Is Asked to Trust ↗

Applies to a trilateral technology partnership the author’s standing argument that a partner asked to depend on allied systems should hold the right to verify them independently. Develops the line he has set out across his alliance writing, that a smaller partner unable to revalidate a system without external support holds less sovereignty than a capability comparison suggests, that vendor dependence becomes a form of strategic dependence, and that reciprocal recognition of governance evidence between allies requires a fielding standard each side can actually test rather than an assurance each side is asked to accept.

AI Can Find the Weird, It Cannot Tell Us What It Is ↗

Fourth in the author’s sequence on machine-assisted scientific inference, drawing the boundary between detecting that something is anomalous and establishing what it is. Develops the promotion line he set out earlier in the series, under which a system may detect patterns, rank hypotheses, quantify uncertainty, and recommend follow-up observation, while moving from an unexplained signal to a specific physical mechanism requires controlled measurement, discriminating tests, independent replication, and a theory that predicts something new.

When Machines Search for Discoveries, Science Has to Count the Search ↗

Third in the author’s sequence on machine-assisted scientific inference, holding that when an automated system searches a very large space of candidates, the extent of that search is part of the evidential claim and must be carried into how a finding is reported. Continues the line he has set out in the two preceding pieces, that a system should be able to report an unresolved state rather than force an observation into a known class, that measurement information can collapse faster than a model’s confidence score, and that agreement among related channels does not supply the independent evidence a naive count would imply.

GPS World · August 2026 · Opinion · New outlet

Signal Authentication Is Not Navigation Integrity ↗

Credits satellite-navigation message authentication as real progress and as honestly scoped by the agency operating it, then distinguishes what it delivers from what safety-critical consumers need: authentication answers where a signal came from, while integrity answers whether the navigation solution in use right now should still be trusted. Observes that verification happens at moments while navigation happens continuously, so a later successful check reaches nothing backward and says nothing about the interval that preceded it, which means a system must carry two distinct states rather than one. Argues that a procurement line requiring support for authentication specifies a capability rather than a behaviour, and proposes three requirements instead: a continuous integrity state carrying the age of the last successful authentication, source status, current assessment, uncertainty, and a downgrade reason code, propagated to whatever is making decisions rather than stopping at the receiver; defined behaviour when evidence runs out, with abstention specified as a legitimate output and downstream software prohibited from silently carrying forward the last valid value or substituting a nominal default; and certification that tests the interval rather than the check, alongside named end-to-end ownership, since a requirement belonging to everyone in general belongs to no one.

Modern War Institute at West Point · August 2026 · Commentary and Analysis

The First Clean Signal Is Not Permission to Fire: On Resilience and Governance of Autonomous Systems ↗

Distinguishes legal authority, which commanders and operators hold, from the engineering permission state, which is the set of actions a system’s software may execute without fresh human input, and argues that in a contested electromagnetic environment the permission state itself becomes a target. Identifies an unresolved question beneath existing work on degraded-mode autonomy: once a system has correctly lost a permission because the supporting evidence degraded, what evidence must it accumulate before that permission returns. Answers that recovery should be asymmetric, contracting immediately but re-expanding deliberately, since treating recovery as the mirror image of failure allows full permission to snap back on a single favourable sample and admits permission flapping around an unstable threshold. Proposes a four-part process: define the evidence envelope for every action class; distinguish contraction from recovery so that one clean frame does not erase a sustained period of corrupted evidence; bind a recovered permission to the evidence that earned it, so a prior authorization does not float forward when the sensor frame, model version, navigation solution, track, or policy state has changed; and make the recovery gate an explicit red-team target by plotting the permission envelope during attack. Answers the sanctuary objection directly, holding that full authority under degraded evidence does not defeat electronic attack but converts uncertainty into permission, and proposes a designed degraded-mode floor in which a system loses only the permissions whose evidentiary premises have failed.

Trump Is Right to Send Allies the Bill. Cutting Our Own Drills Is the Wrong Currency ↗

Accepts the case for demanding more from allies and objects to the method of collection. Reads a multibillion-dollar munitions replenishment contract and a carrier relief after a deployment exceeding eight months and 208 continuous days at sea as evidence that the cost of sustained American power is paid in crew health, ship availability, munitions inventories, and industrial capacity. Argues that peninsular exercises are not a gratuity to the host, since they train American forces in combined command and control, all-domain operations, interoperability, rapid response, and wartime operational-control transition, so cutting them makes allied forces less practiced while charging a Middle Eastern bill to an Indo-Pacific deterrence account. Holds that an ally may decline a mission and still owe an answer on the burden it leaves, but that the answer should take a form with measurable military value. Proposes an allied contribution ledger offering a menu rather than a binary demand, with each contribution judged by whether it adds deployable capacity, shortens American recovery or replenishment time, and reduces the need to pull forces from another theater.

NATO’s Drone Wall Has a Sensor Deception Problem ↗

Holds that connecting drones, radars, sensors and command systems across a flank solves only half the problem, because hardware integrity does not establish that what a sensor reports is what is actually there. An early statement of the distinction the author later carried into allied warning standards and the escalation case.

Earthquakes Shake the Ionosphere. That Doesn’t Mean It Predicts Them ↗

Separates an established effect from a contested inference: disturbances following an earthquake are settled science, while a precursor claim must beat ordinary variability rather than merely appear before an event. The author’s declaration standard applied where the cost of a wrong alarm falls on the public.

Your Company Approved an AI System That No Longer Exists ↗

Addresses the gap between an artificial-intelligence system as approved and the system actually running, extending the governed-change requirement the author has set out elsewhere: because models, safeguards, data sources, and interfaces continue to evolve after review, an approval describes a configuration that may no longer exist unless material changes trigger defined retesting, notification, and the ability to restore a previously approved version.

Techstrong.ai · August 2026 · Feature · New outlet

The AI Kill Switch Act Needs a Containment Layer ↗

Treats proposed legislation requiring an off switch for artificial-intelligence systems in federal use as a serious response to a real problem, then argues that a control action only works if the surrounding system is built to make it effective. Identifies three gaps: an off switch presumes a clean shutdown point, while agentic systems distribute state across credentials, tokens, cached data, scheduled jobs, downstream automations, and external service calls, so stopping the model does not stop the loop; removal-based enforcement operates on human review cycles measured in days while an automated failure can unfold in seconds; and because such systems are being embedded in ordinary agency operations, an off switch as the primary safety mechanism forces a binary choice between mission continuity and safety. Proposes a containment layer instead, with authority boundaries defined per action class rather than per model, automatic scope reduction under uncertainty, session-level revocation propagating to tokens, credentials, delegated jobs, and downstream automations, and tamper-evident action logs held independently of the system being governed, leaving the off switch as final escalation rather than first line.

Every Measurement Has a Physical Limit: Scientific AI Pretends Otherwise ↗

Grounds the argument in two established results, an optical resolution limit set by wavelength and aperture and a statistical bound in which Fisher information fixes a floor on attainable estimator variance, and draws the consequence that better mathematics can use available information more efficiently but cannot manufacture information the experiment never recorded. Identifies the category error as confusing confidence in an answer with evidence that the measurement could identify the answer at all, since priors, regularisation, and learned correlations can hold an output numerically stable while the measurement geometry becomes weak or nearly non-identifiable: confidence is evidence about the model, not automatically about the experiment. Proposes an architectural change rather than a new score, in which a model may produce a candidate estimate while release of a qualified scientific estimate depends on evidence that the measurement supports it, with fail-closed structured abstention recording the quantity requested, the information condition that failed, the threshold fixed in advance, the data and configuration used, and the new measurement that would make the question answerable. Insists the diagnostic and threshold be fixed on development data and applied unchanged, since a rule tuned after the embarrassing cases become known is post-selection rather than humility.

Three Sensors, One Witness: The Corroboration Trap in Allied Intelligence ↗

Argues that alliance moves toward interoperable, data-rich intelligence fusion can make systems more connected without making their errors more independent. Three feeds agreeing on a contact may share a timing source, an upstream commercial image, a correction product, or a software family, so a confidence system that counts feeds without tracing shared ancestry prices an echo as evidence. Illustrates the statistical cost with an equal-correlation example in which twenty-four channels at a common correlation of one half carry only about 1.9 independent channels’ worth of information, noting that the hardware count is unchanged while the evidence count is not. Observes that the underlying mathematics of shared process noise has been understood for decades, so the missing discipline is not a theorem but carrying dependence information into the operational confidence score. Proposes mapping evidence pedigree using existing provenance vocabularies, discounting agreement between related feeds, red-teaming manufactured consensus by testing whether a disturbance at a shared layer makes many downstream systems agree on the same wrong answer, and reporting an effective independent evidence count beside the nominal feed count.

Trump Handed Cops the Power to Jam Drones. Bad Software Could Ruin It ↗

Accepts the decentralisation of counter-drone authority to trained state and local officers as the right decision, then argues the software has to catch up. Distinguishes two questions that are usually collapsed: a valid detection answers what is in the sky, while authority answers who may do what about it, where, and for how long, and holds that the second set of facts should not live only in a training record, an operations plan, or an operator’s memory. Proposes a two-key condition on execution, in which the target track carries its identity, time, location, sensor support, and current confidence, while the command carries a verifiable credential proving that this operator or agency is authorised at this location and time for this specific category of mitigation, with the command executable only when both refer to the same event. Is explicit that this does not transfer legal judgment to an algorithm, since the rule rightly preserves the certified operator’s independent judgment, and defines the software’s narrower job as preventing an otherwise valid human decision from exceeding the authority that makes it lawful, refusing the command and stating why when the operation has expired, the target has left the approved area, the wrong method is selected, or the credential is stale.

The Pentagon Is Cutting Red Tape and Setting a Legal Minefield for AI Contractors ↗

Written ahead of a statutory deadline for a departmental review of how artificial-intelligence systems are secured, and against a suspended certification programme and an executive order rejecting a licensing regime for AI development. Argues the review should identify which controls actually change operational risk, which can be measured continuously, and which should become enforceable contract terms, rather than translating a new technology into familiar compliance language and leaving program managers another checklist that says nothing about what happens when a model is manipulated at runtime. Holds that requirements should focus on evidence: which data and model artifacts are protected, who may change them, how anomalous access is detected, what happens on manipulated input, whether runtime controls can restrict an unsafe action, and which telemetry survives for investigation, with the standard distinguishing a security claim from proof that the control worked under test. Notes the liability consequence that follows, since once such duties become contractual, knowingly false representations about them can create exposure under existing false-claims law, while cautioning that this does not make every failure fraud given the knowledge-and-materiality structure of that statute.

RealClearScience · August 2026 · Op-Ed · New outlet

Antimatter Starships Are Farther Away Than You Think ↗

Argues that exotic-propulsion discussions typically begin one line too late, reporting the energy released after annihilation while omitting everything a vehicle must survive before and after that moment. Proposes an end-to-end energy ledger running from the electricity that creates the antiparticles to the fraction of energy that finally becomes directed momentum, with nine deductions after the headline figure covering production, capture, deceleration, cooling, storage, conversion, shielding, thermal rejection, and operations, each carrying an efficiency, an energy cost, a mass penalty, or all three. Identifies the underlying accounting error as treating specific energy as though it were propulsive efficiency when it is closer to a physical ceiling, and notes that leaving a line blank quietly assigns it perfect performance. Proposes a publication rule for future claims: state the ceiling, then publish every deduction with its assumed or measured efficiency, uncertainty range, and mass consequence, separate the acceleration case from the braking case, and mark which terms come from experiment, which from simulation, and which remain engineering assumptions, so that an unmeasured link stays visible as an unknown rather than inheriting full efficiency by silence.

The Next Scientific Breakthrough May Depend on AI Saying ‘Unknown’ ↗

Argues that as machine learning becomes the gatekeeper deciding which signals reach a human scientist, the ability to abstain matters as much as the ability to classify, because a classifier trained on a closed set of categories operating on open-world data can turn a confident model into a filter against novelty. Sets three requirements: an explicit unknown state, so that unresolved is a legitimate output carrying positive probability that the current hypothesis set is incomplete; multimodal corroboration across measurements with different noise and systematic errors, with candidate status triggering follow-up rather than closing a question; and dependency awareness, since two sensors can appear to confirm each other while sharing a calibration error, processing pipeline, environmental disturbance, or training bias, so that multiplying their confidence scores manufactures certainty from duplicated evidence. Draws the governance line at promotion: a system may detect patterns, rank hypotheses, quantify uncertainty, and recommend follow-up, while moving from an unexplained signal to a claimed new mechanism requires controlled measurement, discriminating tests, independent replication, and a theory that predicts something new. Proposes that teams report abstention rates alongside accuracy, since a model that almost never says unknown may look decisive while quietly forcing unfamiliar observations into familiar categories.

The Next Arms-Control Breakthrough May Be a Proof That Reveals Almost Nothing ↗

Argues that traditional transparency has a ceiling in military artificial intelligence, since no major power will disclose model weights, training data, intelligence feeds, command logic, or operational thresholds, but that verification does not always require seeing the thing verified. Proposes a staged alternative: register a cryptographic commitment to the declared policy and configuration in advance, bind each governed transition to time, authority, configuration, and the prior record in a tamper-evident chain, let an independent verifier test the agreed rule, disclose sensitive records selectively, and for narrow and stable claims eventually prove satisfaction without revealing the underlying data. States the limits of such a proof explicitly rather than hiding them, noting that it cannot establish that the underlying intelligence was correct, that human judgment was sound, that an action was lawful, that intent was benign, or that undeclared activity did not occur elsewhere, and that a perfect proof of a badly chosen rule remains proof of a badly chosen rule. Recommends beginning not with a treaty requiring source-code access but with a small catalog of testable properties, synthetic and non-operational trials, independent verifier teams compared against one another, indeterminate findings where evidence is missing, and a technical dispute process.

Trump Says Humans Control the Bomb. The Code Doesn’t Know That Yet ↗

Argues that the policy question is settled and the mechanism is not: standing policy and statute already require human decision at the critical points, but human-in-the-loop describes who is supposed to decide while software architecture determines whether a high-consequence action can proceed without that decision. Identifies the realistic risk as quiet rather than dramatic, one automated function handing a recommendation to another until confidence scores become operational facts and a nominal checkpoint arrives after the system has already shaped the available choices. Proposes making human authority an enforceable technical condition: an external authorization layer the model cannot rewrite or persuade, a separate affirmative authorization token bound to a named authority, a defined action, and a short expiration window, with no valid authorization meaning no transition. Requires the layer to fail closed, so that expired authorization, ambiguous communications, or unverifiable authority halts the protected action rather than inheriting permission from an earlier state, and to emit a tamper-evident record of what was requested, which rule applied, who authorized it, and what the software did next. Frames the pending directive update as the opportunity to convert a policy principle into an acceptance test a program office can require a contractor to demonstrate under realistic failure conditions.

Geopolitical Monitor · August 2026 · Opinion

The AI Arms Race Will Be Won in Year Two ↗

Argues that artificial-intelligence capability is unusually easy to display and unusually difficult to price, so the first purchase reveals little about strategic advantage: compute, energy, data pipelines, integration, cyber assurance, retraining, model monitoring, operator support, export restrictions, and the cost of leaving a vendor all sit offstage during a demonstration and determine whether a capability becomes durable military power. Uses a documented aviation-security case in which a technically proven countermeasure failed to close a commercial business case in one country, on reliability and operating-cost grounds, and later became operational across another country’s carriers under a different threat environment, fleet structure, financing model, and certification path. Concludes that fieldability is contextual, that the same model can be a strategic asset in one state and an expensive dependency in another, and that vendor dependence becomes a form of strategic dependence when a force cannot retrain, patch, revalidate, or migrate a system without external permission. Proposes that procurement force the ownership architecture into the competition before a winner is chosen.

The Red Sea Broke the Escalation Ladder ↗

Develops the author’s three-axis assessment model against a sequence in which major carriers widened their return to the Suez route and a lethal attack at the adjoining strait followed within a day. Argues that vertical escalation ladders cannot represent this, since attack counts can fall while insurance costs, rerouting, and transit times stay elevated: United Nations trade data recorded container tonnage through the canal down 82 percent by February 2024, and conflict-data researchers counted 150 attacks on commercial shipping in 2024 against seven in 2025 while transits through the strait remained 65 percent below their 2023 level. Warns that the danger is now computational, because command systems under pressure to compress data streams may average variables of different strategic meaning into one scalar, producing a number that looks precise while hiding the structure of the crisis. Proposes that decision aids preserve tactical threat, area denial, and economic imposition as separate channels showing which axis is moving, how fast, and with what uncertainty, and that they hold the policy boundary between measuring economic harm and recommending kinetic escalation.

We’re Building Beijing’s Spy Network for Them, One Convenient Device at a Time ↗

Written against a July 2026 decision adding foreign-produced advanced robotic devices to a federal covered list, after security agencies warned that networked robots could support surveillance, foreign intelligence collection, or remote manipulation. Accepts the direction as sensible while arguing that regulators are using the wrong unit of analysis: policy has proceeded category by category, restricting connected vehicles, then drones, routers, robots, and power inverters, with each action addressing a real exposure, while intelligence collection crosses all of those product boundaries.

Medical AI Can Pass the Test and Still Fail Patients ↗

Extends the author’s line of argument on assurance into clinical medicine, holding that a system can satisfy the evaluation it was measured against and still fail the people it is used on. Applies to healthcare the distinction he has developed across defence and technology policy, that performance on a benchmark is a claim about a test rather than about deployed practice, and that the conditions under which a safety claim was measured are part of the claim.

The Space Review · August 2026 · Op-Ed

Who Will Believe the Space Logs in 2040? Space Governance and the Quantum Audit Problem ↗

Identifies a variant of the harvest-now threat that applies to attribution rather than secrecy: an adversary collecting signed space records today could, once a cryptographically relevant quantum computer exists, break the signature scheme and retroactively forge historical telemetry, altering what a past orbital manoeuvre shows. Argues the space domain is uniquely exposed because records outlive their locks, because attribution is the cornerstone of space security and therefore the thing worth manipulating, and because an orbital event cannot be re-measured once its telemetry is compromised. Holds that migrating to new signature algorithms is structurally incomplete on its own, since a single new scheme is a new single point of failure and existing archives cannot be re-signed without breaking chain of custody. Proposes a three-layer architecture: dual classical and post-quantum signatures at record creation, a hash chain that explicitly tags the algorithm used at each step so old records remain verifiable under their original parameters, and periodic archival anchoring with a stateless hash-based signature, so that in the worst case where lattice cryptography fails, integrity assurance reduces to the security of a hash function. Ties the argument to treaty obligations that depend on reliable logs, and proposes four actions keyed to the 2030 and 2035 deprecation deadlines.

America Is Exporting AI to Allies: It Needs Rules for Turning Access Off ↗

Argues that the United States exports frontier artificial-intelligence systems to partners without matching rules for what happens when Washington decides access must be restricted. Uses a documented June 2026 episode, in which a directive to suspend foreign-national access to two frontier models led the developer to disable them for all users because nationality could not be verified in real time, with controls lifted weeks later after a targeted classifier was trained and evaluated, to show how a domestic security judgment becomes a cross-border availability shock. Proposes an allied access compact with five elements: a shared risk vocabulary tied to evidence, graduated intervention with worldwide suspension at the far end carrying a defined review period and restoration conditions, notification channels that work at crisis speed, continuity requirements including pre-identified alternatives and degraded operating modes, and a connected network of national evaluation institutions. Its sharpest line is that a government should not discover a strategic dependency has disappeared through a vendor status page.

Defense Networks Will Split. The Requirement Should Say Who Decides. ↗

Argues that programs specify whether software keeps running through a network partition but not what happens to delegated tasking authority while the network is divided, or how conflicting decisions are adjudicated when it reconnects. Observes that mission command gives a disconnected human subordinate intent, orders, defined relationships, and an obligation to account for decisions afterward, and that automated allocation systems do not inherit that framework merely because they can keep processing local data, so two partitions can each commit the same tanker, lift capacity, sensor window, or munition stock without either malfunctioning. Holds that the harder problem arrives at reconnection, because data consistency is not command validity: a generic synchronization rule can produce a clean database while concealing the operational disagreement that produced it. Proposes three requirements, a partition authority map preauthorizing which node may commit which resources under which conditions, bounded delegation in which authority operates as a lease that narrows or expires rather than persisting because communications remain unavailable, and reconvergence adjudication that preserves both decision histories, requires human review where consequences cannot be safely reversed, and records which decision prevailed and why.

Trump’s AI Exemption Isn’t an Oversight Gap. It’s a National Security Masterstroke ↗

Argues that keeping open-weight models outside a voluntary federal safety-testing framework is a defensible assurance judgment rather than a hole in oversight, because closed frontier systems and open-weight releases have different lifecycles and different relationships with the government. A prerelease review can examine a defined artifact under controlled conditions, while a published open model is fine-tuned, quantized, and recombined into thousands of downstream variants, so a federal test of the original could be obsolete within days while still conferring a misleading government-approved glow. Accepts the seriousness of recent containment failures at frontier developers and argues they demand better evaluation design from those developers rather than a federal review queue for every downloadable model. Proposes clearer boundaries instead: publishing the capability categories that trigger federal interest without disclosing classified benchmarks, encouraging reproducible capability evaluations, model hashes, and disclosure of the conditions under which safety claims were measured, and concentrating testing on the deployed system that actually runs. Its governing distinction is that a model sitting in a repository has possibilities, while an agent connected to credentials, browsers, code execution, and live networks has authority.

Geopolitical Monitor · August 2026 · Opinion

Europe’s Military AI Gap Begins at Fielding ↗

Argues that the defence exclusion in European artificial-intelligence law is real but is not the whole problem, and that treating it as such points toward the wrong remedy. The sharper question is what must be proven before an AI-enabled military system moves from funded development into national service and then into a multinational operation. Identifies a lifecycle break: a human-control condition can govern eligibility for one funding instrument without becoming a common, testable requirement for the system later fielded, updated, connected to other national systems, or operated under multinational command. Holds that interoperability changes the unit of risk, since technical interoperability can advance faster than reciprocal confidence in the authority rules enforced by the software. Proposes a fielding assurance profile narrow enough to respect national sovereignty and concrete enough to test, requiring an authorization boundary, runtime governability, tamper-evident traceability, and a pre-agreed conflict rule so incompatible national caveats trigger renewed human authorization rather than being silently resolved by whichever system acts first.

America’s Drone Standards Will Travel Far Beyond America ↗

Argues that the drone standards the United States sets domestically will govern well beyond its own jurisdiction. Extends the propagation mechanism the author set out a day earlier in his analysis of allied military AI governance, that manufacturers design to the requirements of their largest customers and forces buy what has already passed recognizable tests, so a domestic rule becomes an international norm without being negotiated as one.

Trump Isn’t John Lennon. That’s Why His Iran Strategy Might Actually Work ↗

A direct reply to another contributor’s argument in the same publication, holding that distrust of an adversary does not by itself justify regime change. Argues that military power has its greatest value when an adversary knows it can be used and the commander knows when to wait, and that the case for testing an off-ramp rests on prudence rather than optimism. Concedes the strongest objection, that repeated threat-and-pause cycles can burn presidential credibility, and answers it with structure: every pause should carry a fixed deadline, written objectives, independent verification, and consequences announced in advance, so that a bounded test forces a measurable choice while open-ended negotiation invites delay. Notes what force cannot guarantee after a government falls, including control of nuclear material and the behaviour of fragmented security units. Continues the author’s line on verification limits and on the design of decisions under uncertainty.

The Race to Write NATO’s Military AI Rulebook Has Begun ↗

Argues that because the European Union deliberately placed exclusively military and national-security systems outside its artificial-intelligence law, the practical rulebook is being written elsewhere, through American procurement, alliance testing and interoperability mechanisms, European experimentation, and national certification. Observes that military standards spread through markets before diplomacy, so a procurement rule can become an alliance norm without ever being negotiated as a treaty. Proposes four minimum requirements clear enough to be compared, tested, and recognized across the alliance: explicit authorization boundaries including how authority changes as data quality, communications, or confidence deteriorate; governed software change with defined retesting and the ability to restore a previously approved version; reconstructable records establishing what a system recommended or did and which human or machine held authority; and interoperability treated as a governance requirement, since allied systems must exchange operational caveats, authorization limits, and stop conditions rather than data formats alone. Calls for an unclassified minimum baseline alongside any classified annex, on the reasoning that a standard allies and suppliers cannot examine cannot be compared, contracted for, or recognized.

Silicon Valley Can’t Own the Pentagon’s Kill Switch ↗

Argues that the live question is no longer whether the Pentagon will use commercial artificial intelligence but who controls the software once it becomes part of a mission, and that the answer belongs in the contract rather than in the crisis. Holds that for mission-critical AI the government must retain both the contractual and the technical authority to stop the system, freeze an approved version, roll back to a previous one, and continue essential operations if the vendor relationship fails. Written against the Department’s 2025 awards to four frontier AI developers, each carrying a ceiling of 200 million dollars, and its subsequent expansion of commercial AI into classified environments: private firms supplying talent and technology is a strength, provided dependence does not become delegated command authority.

Chokepoint Coercion in the Next Phase of the Iran Conflict ↗

Argues that chokepoint coercion works by altering commercial behaviour through uncertainty rather than by defeating navies, and that military assessments still compress three unlike effects into one number. Uses the Red Sea as the completed experiment: allied forces won intercepts while carriers rerouted anyway, canal transits halved, and the coercion succeeded through the accumulated judgement of owners, crews, and insurers. Proposes assessing tactical threat to platforms, operational denial of access, and strategic economic imposition as separate, interacting axes, with the commander’s update displaying them in separate panels and decision-critical indicators keyed to commercial behaviour rather than attack counts alone. Notes that automated decision aids optimised for imminent physical danger cannot infer commercial confidence unless those variables are deliberately represented and kept distinct, and applies the framework to the Strait of Hormuz, where a passage open on Tuesday and shut on Thursday imposes much of the cost of closure without ever requiring one.

The Vulnerability of Autonomous Warfare Systems ↗

Argues that the joint force is buying autonomy faster than it can measure whether it can fight without it. Reads Ukraine as a dependency story: front-line reporting consistently identifies jamming rather than kinetic defense as the dominant killer of small uncrewed systems, and the winning adaptations reduced dependence on the vulnerable link and pushed judgment to the edge. Government Accountability Office findings on alternative navigation and on the joint command-and-control effort show the measurement gap running from the rifle squad to the enterprise. Prescribes three commitments requiring no new program of record: build denial into ordinary training by exercise design, make degraded-mode competence a measured and reported readiness standard alongside gunnery and fitness, and resource the manual layer as a capability, rehearsing the handoff from automated to manual under stress. A force is defined by what its people can still do when the machines go dark, and by whether the institution knew in advance which of its units could do it.

Europe Delayed Its AI Rules Because the Institutions Were Not Ready ↗

Argues that governments are writing artificial-intelligence law faster than they are building the bodies that can investigate failures, hear appeals, and order corrections. Notes which duties survived the European deferral and which slipped: the transparency obligations took effect on schedule, while every obligation requiring someone to inspect, evaluate, and judge a system moved to a later date. Contends that accountability is a relationship rather than a property added through documentation, so a decision can be transparent, tested, and formally compliant and still be practically unaccountable when no competent body can question it. Proposes naming an institutional forum before deployment, empowered to compel evidence, evaluate against an articulated standard, and impose a consequence, and argues that building the interface between an AI system and the institutions meant to govern it is an engineering task that is currently nobody’s job.

Security Boulevard · July 2026 · Analysis

Zero Trust Stops at the AI ↗

Introduces a concept the author calls the confidence half-life: a detection model ships with a certified confidence value that erodes under sustained adversarial pressure, and the half-life is the time it takes to fall by half. Argues that recalibration cadences were tuned to a human attacker clock that no longer exists, so a model can spend much of its operational life below its certified threshold while dashboards still show confident answers, since calibration drift fails silently. The deeper argument is that organizations which dismantled perimeter trust for people and devices have quietly re-embedded it at the AI layer, granting a model that performed well in evaluation standing authority that persists until something breaks. Maps Zero Trust principles onto machine authority almost one to one: verified current confidence for the specific task rather than a procurement-time trust score, minimum authority rather than maximum supportable, assume drift in place of assume breach, tiered authority with hard boundaries so a model on a correct streak cannot accumulate unauthorized latitude, and logged reversible deliberation on every escalation.

What Trump’s Record Border Numbers Are Hiding ↗

A measurement argument about what enforcement statistics can and cannot establish. Observes that apprehension and encounter figures are enforcement outputs rather than complete measures of security or of harms prevented, since they count the people officers encountered but do not count successful entries, explain why fewer people attempted the journey, or establish what followed from a decline. Argues the change cannot be attributed to any single policy, because enforcement by a neighboring state, asylum restrictions predating the current administration, regional migration patterns, and deterrence signaling all bear on the result, and separating those contributions is analytic work an announcement cannot perform. Separates three questions routinely collapsed into one: whether the numbers are real, what produced them, and what they imply.

Military AI · July 2026 · Commentary

The Human-in-the-Loop Is Becoming a Rubber Stamp. Acquisition Can Fix It. ↗

Argues the human-in-the-loop safeguard is thinning into a formality not because operators fail but because acquisition contracts never required systems to explain themselves. Notes that when automated tools surface thousands of candidate items a day and each must be cleared by a human, an alert carrying no rationale, no supporting evidence, and no stated confidence is difficult to act on and easy to accept unquestioned, producing either disuse or automation-bias misuse. Frames this as a specification defect rather than a training one, since no operator discipline can recover a rationale the system was never required to produce. Prescribes buying understanding rather than detection, and names three acquisition controls: a standardized explainable alert format as a condition of the test-to-production gate, operational testing of the human-machine interface with the same rigor applied to the algorithm, and continuous monitoring written into the lifecycle so a fielded system signals its own reduced reliability as inputs drift.

Geopolitical Monitor · July 2026 · Op-Ed

Six Governments Wrote One Driverless Rule, But They Kept Four Regulators ↗

Examines the first global regulatory framework for fully driverless automated driving systems, adopted in June by the United Nations vehicle-regulation forum and backed by six markets accounting for most of the world’s vehicle production. Notes that because statistical proof by mileage is unattainable, as RAND analysts established in 2016, the framework validates through a lifecycle safety case, simulation, track and road testing, independent audits, and in-service monitoring. Argues that once proof moves from miles to documents the document becomes the regulation, while what an operational design domain description must specify and how a regulator judges an argument complete rather than merely plausible is left to guidance still being finalized. Observes that the six governments harmonized the standard but not the machinery that applies it, since type-approval, self-certification, and centrally administered pilot systems read the same text differently, producing convergence on paper and divergence in practice.

Eurasia Review · July 2026 · Analysis

From Fordow to New York: What Force Cannot Verify in Iran’s Nuclear Program ↗

Argues that three rounds of strikes across thirteen months have produced three damage assessments and no verified baseline, because force can destroy facilities and lengthen a timeline but cannot by itself establish what material survived, what expertise remains, or what undeclared infrastructure exists. Those are safeguards questions that battle-damage assessment cannot answer. Notes that AI-enabled tools compressed targeting processes once measured in hours or days into seconds, which the piece treats as the clearest publicly acknowledged demonstration of machine-assisted targeting at the scale of a major interstate campaign, while insisting that officials chose the objectives and authorized the strikes. Contrasts a scripted earlier operation, whose weapon-to-target pairings and intelligence validation were settled in advance by planners with time to weigh them, against the compressed tempo of the later campaign, and asks how equivalent validation quality was preserved. Closes with three recommendations, including unclassified publication of the governance lessons of machine-assisted targeting, on the principle that speed which cannot be examined is not a capability anyone can govern.

RealClearDefense · July 2026 · Op-Ed

Arming Local Police With Drones. Who Pulls the Trigger? ↗

Argues that recent counter-drone law has settled who may act and funded the tools to act with, while leaving unresolved how the decision itself gets made. Identifies three gaps: a declaration problem, since a statutory credible-threat standard becomes a judgment call made in under a minute by whoever holds the certification; a handoff problem, since a drone can cross private, municipal, county, and federal boundaries in about ninety seconds through layers of permission that specify no moment or mechanism of transfer; and an evidence problem, since engagement decisions will be litigated from both directions and unrecorded sensor and decision data forfeits in court what was won in statute. Prescribes an authority architecture set before an event: a named decision authority with pre-planned succession, risk-based engagement windows fixed in advance, and an evidence chain built in from first sensor contact.

Today’s Hydra Problem: Decapitation Without Degradation ↗

Argues the recurring debate over whether leadership decapitation works is mis-specified, because its effect depends on a structural property of the target rarely assessed before a strike: the number of independent pathways an organization has to reach a strategic decision. Reads three well-documented cases as a single pattern (a centralized node that never rebuilt, a distributed framework that absorbed removal as routine succession, and an intermediate case), distinguishes bureaucratized succession from functional redundancy, and observes that two decades of sustained pressure selected for adversaries against which the instrument accomplishes less. Concludes that pressure belongs on the substrate (financing, recruitment, doctrine, logistics) and that planning horizons must match the years-long timescale of what is being degraded rather than the days-long clock of removing an individual.

Dark Reading · July 2026 · Opinion

Adversaries Don’t Need a Zero-Day — They Read Your Rulebook ↗

Published in the leading cybersecurity trade press, responding to a reported fall in confidence in autonomous penetration testing (willingness to rely on it dropping to nine percent in 2026 from twenty-nine a year earlier). Names a failure mode the author calls cap weaponization: once an autonomous system’s governance rules are written down and certified, they become public information an adversary can read and exploit, engineering a rhythm of cheap probing and free recovery that talks a defensive system out of its own authority without firing a single exploit. Prescribes the author’s core engineering principle: the authority a system acts on must always equal the authority its audit records, computed in one place, enforced in another, and cross-checked, so any single-layer manipulation produces a catchable mismatch.

Lieber Institute, West Point · Articles of War · July 2026

Whose Decision Was It? Drone Swarms and the Accountability Gap in Ukraine ↗

Published by the Lieber Institute’s Articles of War, the legal-scholarship forum at the United States Military Academy. Argues that the accountability gap for autonomous swarms is opening not because the law of armed conflict is silent, but because the human decision the law depends on is being designed out at the point where a swarm’s composition rule is chosen. Distinguishes three ways a swarm composes a decision, each locating human responsibility differently, and argues the composition rule is a legal decision as much as an engineering one, reviewable under Article 36 weapons review before a system flies. Adds that a tamper-evident record is necessary but not sufficient, because it cannot show whether what the system observed was true, making input integrity a separate obligation.

America Just Did the World’s Dirty Work ↗

A burden-sharing argument about how a distributed threat came to be described as one government’s private undertaking, and what that description does to the accounting. Sets the concentration of exposure in Europe, the Gulf, and East Asia against the pattern of participation, gives the contrary evidence a fair hearing, including thousands of American flights launched from allied territory and logistical support from several capitals, and argues that sovereign states may decline a war but cannot decline it and still send the invoice elsewhere. Extends the author’s preparedness-paradox analysis: countable costs sit on one side of the ledger while the benefit is a weapon not finished and an attack not launched, which leaves no wreckage to photograph.

Geopolitical Monitor · July 2026 · Op-Ed

The Wax Was Melting: AI Speed and the Nuclear Decision ↗

Uses the Icarus myth, in which a boundary announces itself only after it has been crossed, to argue that military AI is compressing the one resource careful decision-making depends on, which is time. Notes that AI-enabled targeting has, by the military’s own account, reduced processes once measured in hours or days to seconds, and argues structurally that when a pipeline runs faster than a human can verify its inputs, verification is not merely harder but compressed out of existence. Carries the argument to nuclear command and control, where no later correction exists: the risk is not that an AI decides to launch, but that the cycle compresses until the human holding launch authority has no genuine opportunity to exercise it, leaving the appearance of control rather than control. Prescribes building verification back in and treating human deliberation time as a condition of survival.

Binders Won’t Stop Bullets: When Military AI Can’t Say ‘No’ ↗

Examines Section 1513 of the Fiscal Year 2026 National Defense Authorization Act, which directs a framework for the cybersecurity of acquired artificial intelligence systems folded into existing acquisition rules and the Cybersecurity Maturity Model Certification program, and notes that the first status report to Congress was due in mid-June and the deadline has passed. Argues the statute names the right risks (adversarial tampering, supply chain compromise, data theft, and AI-specific vulnerabilities) because an adversary can corrupt a system without breaching a firewall, by poisoning a sensor feed, spoofing an identification signal, or nudging a model toward a decision its operators never intended, and that the difficulty is that the compliance tools the law points to were built for a different kind of technology.

Global Security Review · July 2026 · Op-Ed

Allied Autonomy Is Creating a New Seam in Extended Deterrence ↗

Argues that allied autonomy has outpaced the alliance frameworks governing who may authorize a machine to act. Because each ally encodes its own national rules for engagement, human review, and halting, a combined formation can contain systems that would act under one national authority profile and hold under another, and adversaries study seams. Prescribes authority interoperability built as deliberately as data interoperability was: published national authority profiles, shared reversion standards so any coalition system can be halted by a common tested procedure, and an autonomy annex to extended-deterrence consultations. Adds legibility as a third term alongside capability and will.

The Iran War Began With Biden, Not Trump ↗

A deterrence-credibility analysis arguing the honest ledger on the Iran campaign opens on April 13, 2024, when a barrage of more than 300 drones and missiles followed a one-word American warning and carried no cost. Traces Schelling’s credibility requirement through the IAEA stockpile record (274.8 kilograms of 60 percent enriched uranium in February 2025 rising to 440.9 by June, roughly nine weapons’ worth, before an inspection blackout), argues the February 2026 campaign was arithmetic rather than choice, and frames the lesson as bipartisan: wars of this kind are compound interest on deterrence lapses, and resolve becomes legible only when holding it costs something.

Who Yields in Orbit? Autonomous Satellites Need a Right-of-Way Rule ↗

Opens with the European Space Agency’s September 2019 collision-avoidance decision, made with almost no framework, and argues that low Earth orbit is approaching a regime of continuous conjunctions, with the largest constellation seeking to grow from twelve thousand satellites toward forty-two thousand. If the first collision between two autonomous, maneuver-capable satellites happens under the present non-system, both operators will honestly insist they had priority, and neither will be wrong, because no rule ever established who did. The sea drew its rules of the road before its traffic became unmanageable; orbit still has that chance, and the window is closing at eight kilometers a second.

Why We Punish the Protection That Works ↗

Names the preparedness paradox: successful prevention erases the evidence of its own necessity, so publics weigh visible costs against invisible benefits and judge protection an overreaction. Traces the pattern from the Y2K remediation effort through ozone recovery and epidemic prevention, applies it to the debate over the US strike on Iran’s nuclear program, and prescribes an evidentiary remedy: preserve contemporaneous records of the perceived threat, the alternatives considered, and the basis for acting, so later verdicts weigh the decision actually made under the uncertainty that existed.

Geopolitical Monitor · July 2026 · Op-Ed

America’s Allies Should Test the AI They Plan to Depend On ↗

Uses the June 2026 export-control suspension of the most capable publicly available AI model (nineteen days, restored only after a US government review no ally performed or observed) to argue that allied access to frontier AI is conditional and revocable, and that readmission runs on someone else’s evidence. Prescribes a standing national test-and-evaluation capability (a funded bench of people, test protocols, and red teams) rather than sovereign frontier models, with allied pooling: shared test benches, common red-team protocols, and reciprocal recognition of evaluations modeled on shared airworthiness findings.

The Next Offset Won’t Be a Smarter AI, It Will Be a Governable One ↗

Argues US military-AI strategy is organized around the wrong question, chasing model capability when the binding constraint is governable authority: who or what is permitted to act, through which interface, with what oversight. Contends capability that cannot be governed is exposure, not advantage, and calls for an authority offset (permission control, verification, segmentation, exercised human fallback) rather than a fourth capability offset, since capable models proliferate fastest while governed deployment does not. Draws on CrowdStrike, the 2015 Ukraine grid recovery, and nuclear command-and-control (Sandia’s always/never principle) to locate the real risk in integration and validation, not model intelligence. This is the clearest public statement of the thesis underlying the author’s AUTHREX research program.

We Guarded China’s Oil for Free. Trump Sent Them the Bill ↗

Reads President Trump’s July 2026 demand that the United States be reimbursed for guarding the Strait of Hormuz as an overdue burden-sharing doctrine rather than a transit-fee gimmick. Notes that Asia takes nearly 90 percent of the strait’s crude and China is the largest customer, while U.S. energy independence makes the demand credible, and argues Congress should pair the war supplemental with allied and consumer pledges, citing the 1991 Gulf War precedent and the Defense Cooperation Account (10 U.S.C. 2608).