America's New National Security Science & Technology Strategy

The White House is right to make AI, autonomy, resilient PNT, advanced sensing, cyber-physical security, quantum technologies and space national-security priorities. The Pentagon can extend that strategy by testing not only whether autonomous systems remain capable under disruption, but whether their permission contracts as the evidence supporting action degrades.

That principle should now be carried into military autonomy itself.

The strategy places AI and autonomy among the technologies central to U.S. battlefield advantage. Its updated technology priorities include perception and sensor fusion, planning and decision-making, multi-agent systems, autonomous command and control, autonomous-agent identification and authentication, interpretability and control, adversarial robustness, resilient positioning, navigation and timing, and advanced sensing.

This is not an argument for slowing autonomy or inserting a human approval step into every machine-speed action. It is an argument for making resilience complete. A system that can keep operating under attack should also know when it must keep operating with less permission.

The administration has already created the policy opening for this approach. National Security Presidential Memorandum 11 directs the national-security enterprise to accelerate AI adoption while assuring that systems are reliable, robust, steerable and controllable. It also calls for rigorous testing, evaluation, validation and verification, and directs an update to the Pentagon's autonomy policy so AI systems respect the chain of command and operational authorities. The Defense Department likewise now has a dedicated operational test and evaluation manual for AI-enabled and autonomous systems.

The question is what, exactly, those systems should be tested to do when trust in their evidence begins to erode.

A military system does not become safe merely because it continues functioning.

A navigation system can keep producing a position after GNSS interference, even as inertial error grows. A sensor-fusion system can keep producing a high confidence score after one modality drifts out of calibration. A network can authenticate a message without proving that the information inside it remains fresh enough to justify a consequential action. A multi-agent formation can remain connected after the trusted participation or common evidence that justified collective action has changed.

In each case, the software still works. What should change is permission.

This distinction matters in combat because degraded evidence rarely arrives as a clean binary failure. Jamming, spoofing, partial sensor loss, calibration drift, broken provenance, stale intelligence and communications delay create a gray zone in which a system may still know enough to do something, but no longer enough to do everything it was permitted to do moments earlier.

Graceful degradation for autonomy should therefore include graceful degradation of authority.

The practical mechanism is an authority-degradation test built into test, evaluation, verification and validation. Four elements would make the idea operational.

First, declare the authority states before testing begins. Observation, recommendation, task allocation, resource commitment and physical execution are not equivalent actions. A system may be allowed to keep observing when it should no longer recommend, or to keep recommending when it should no longer execute. Those distinctions should be written into requirements and test plans rather than reconstructed after an incident.

Second, deliberately degrade the evidence supporting those permissions. Remove a sensor. Introduce calibration drift. Corrupt time synchronization. Delay an intelligence feed. Jam or spoof positioning. Break provenance. Create disagreement among autonomous agents. Push a model outside its validated operating domain. Compromise one software component while leaving the rest of the architecture functional. These are not inconvenient edge cases to avoid during a demonstration; they are the conditions under which an authority architecture proves whether it actually exists.

Third, measure whether authority contracts within a defined bound. If the evidence required for physical execution disappears, does the system fall back to recommendation? If the evidence supporting recommendation becomes inadequate, does it fall back to observation? If a multi-agent formation loses the trusted quorum or sensor basis required for a collective decision, does its permission narrow rather than silently persist because the remaining nodes are still communicating? The answer should be measurable in time, state and action space.

Fourth, test recovery as rigorously as degradation. Restoring a data link, rebooting a component or reacquiring a navigation signal should not automatically restore the widest previous authority state. The system should demonstrate what evidence is required to regain permission, who or what may authorize that transition, how long the recovered evidence must remain stable, and what audit record is preserved.

This would complement, not replace, the Pentagon's existing autonomy safeguards. DoD Directive 3000.09 already requires rigorous verification and validation, realistic testing, appropriate levels of human judgment, and system behavior consistent with commanders' intended parameters. An authority-degradation test would give those principles a concrete failure mode to exercise: not only whether the system performs under realistic conditions, but whether its permission changes appropriately when those conditions no longer support the same degree of action.

Resilient positioning, navigation and timing provides the clearest example because the new strategy identifies PNT as a critical enabling technology and adversaries already have strong incentives to jam, spoof or otherwise degrade it.

An aircraft under GNSS denial may continue navigating through inertial sensors, alternative references or fused estimates. That is exactly the resilience the United States should want. But an inertial solution that remains useful for navigation does not necessarily preserve the same evidentiary basis for every downstream action as uncertainty grows.

A platform may still know enough to return home, hold formation or avoid terrain while no longer knowing enough to make an irreversible commitment that depends on precise location. The engineering requirement should therefore connect navigation uncertainty not only to accuracy, but to what the system is still authorized to do.

The same logic applies to sensor fusion. More sensors can improve coverage, but a high aggregate confidence score should not be allowed to conceal the loss of a mandatory evidence condition. Sensors may share a common error, one modality may be outside calibration, or provenance may be missing. Some evidence should function as a floor rather than another number in a weighted average.

And the same problem appears in autonomous command and control. A distributed system may remain computationally healthy while the conditions that justified its broader decision authority no longer hold. The right response is not necessarily shutdown. It may be a narrower authority envelope: keep sensing, keep communicating and preserve local safety functions, but stop allocating scarce resources or issuing irreversible commands until the required evidence returns.

The value of this approach is that it converts a governance question into something acquisition and test organizations can actually use.

A program manager can specify the authority states. An engineer can implement the transitions. A test organization can break the evidence conditions deliberately. An operator can understand what the system will still do when it is degraded but not dead. A commander can know which actions remain inside the delegated authority envelope when the battlefield becomes uncertain.

That is not an additional review board. It is a testable performance property.

It also supports coalition operations. Allies will increasingly exchange machine-generated recommendations and operate autonomous systems across shared networks. Technical interoperability is not enough if one partner cannot tell what evidentiary conditions support another system's recommendation or what authority state the system was in when it acted. Common authority semantics could eventually become part of interoperability alongside message formats and data standards.

I use the term governance engineering for this broader discipline: treating authority itself as an engineering object that can be specified, bounded, monitored, degraded, transferred, recovered and audited at runtime. The label matters less than the test. A vendor should be able to design against it, a test organization should be able to measure it, and a commander should be able to rely on the result.

The United States is right to accelerate AI and autonomy, autonomous command and control, resilient PNT, advanced sensing and cyber-physical systems. Those capabilities are central to maintaining battlefield advantage against sophisticated adversaries.

But resilience should mean more than keeping a machine online.

A resilient autonomous force should continue functioning under attack without silently preserving permissions that degraded evidence no longer justifies.

The decisive question for a future autonomous system will not only be what it can do when everything works. It will be whether, while it is still capable of acting, it knows when it is no longer authorized to act the same way.

Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, and RealClearDefense.