Runtime-Assured Autonomy
The problem is not whether an autonomous system reasons well. It is whether the system can take an action nobody authorized — and whether you can prove afterward that it didn't.
The failure mode
A model that is correct 95% of the time is an excellent research result and an unacceptable operator. In any domain where an action has consequence, the residual is not a quality problem to be driven down — it is a liability that has to be structurally contained, because it will never reach zero.
Containment by prompt does not survive contact with an adversary or with an ordinary edge case. The instruction "do not take irreversible actions without approval" lives in the same channel as the input, is subject to the same injection surface, and is enforced by the same component whose judgment is in question. Assurance has to live outside the model.
The assurance model
Four properties, enforced by the runtime rather than requested of the model.
01 · Declared authority
Every executable unit of work declares, ahead of execution, what it touches: risk class, permitted data classes, redaction profile, whether a human must approve, whether the effect is idempotent. A unit that has not declared these cannot be lowered into an executable plan, so it cannot run. Undeclared is unrunnable — the enforcement is structural, not advisory.
02 · No ambient authority
Stochastic components never receive raw database, storage, connector, or sensitive-data access. They receive a scoped view produced through an explicit seam that checks purpose and policy, applies a redaction profile, issues a grant, and writes an audit record. A component gets data because a policy permitted it, never because a prompt asked for it.
03 · Effects disarmed by default
Paths capable of irreversible external effect ship switched off. In their disarmed state they validate the request, write the audit row, and return an explicit refusal — so the path is continuously exercised without ever being live. Enabling one is a deliberate authorization step, not a configuration default. A capability whose blast radius is first observed in production was never assured.
04 · Audit precedes effect
The record of intent is committed before the external call, not after. The failure that matters is not the one where an action fails — it is the one where the action may have succeeded and cannot be accounted for. A crash mid-effect therefore leaves an honest "pending" state requiring reconciliation, rather than silence.
Commercial proof-of-work
Two production systems in regulated civilian domains, described by mechanism. Client identities, volumes, and commercial outcomes are omitted deliberately.
Clinical operations
A reconciliation control plane over clinical scheduling and demand. Sensitive identifiers cross explicit seams into redacted views; the path capable of writing into the clinical system of record is implemented, tested, and ships disarmed, returning an audited refusal until authorized. Identity resolution refuses to act on an ambiguous match, escalating to a human rather than selecting a candidate — the same discipline as a tracker declining to commit to a low-confidence association.
Legal document review
Model-assisted classification across a document corpus under privilege constraints. Every machine proposal is routed to a licensed reviewer, and the artifact of record captures the human decision, the decider, the timestamp, and the stated basis — with the machine's proposal preserved alongside it rather than in place of it.
Commercial engagements. Not federal past performance — see the Past Performance section for contracts of public record.
Relevance to autonomy programs
The civilian and defense versions of this problem differ in consequence, not in structure. Both ask the same question: can an autonomous system be permitted to act, and can its authority to act be established independently of the component exercising it? A monitoring architecture that has been fielded against real regulatory constraint — real sensitive data, real audit obligation, real human accountability — has been tested against something. One that has only been specified has not.
Target for the defense formulation: DAF26BZ01-NV008 (DoD Phase I SBIR, proposal in development). Bayesian decision-consistency monitoring of autonomy commands against counter-factual replay environments.