The Autonomous Kill Chain: Where Human Authority Must Live and Why
Autonomy is not the opposite of accountability. The right architecture places human authority at the intent envelope and keeps it there — auditable, scoped, and inviolable.
The autonomous kill chain debate has been miscast for a decade. The question is not whether machines should make lethal decisions. The question is where in the chain the human authority lives, how it is scoped, and how it is verified after the fact. Frame the debate that way and the answer becomes architectural rather than philosophical.
Three positions for the human exist in any kill chain. The trigger — a human pulls each shot. This is current direct-control doctrine and it does not scale past a one-to-one operator-to-platform ratio. The veto — a human can override any machine decision within a window. This is the loyal-wingman doctrine and it works at one-to-ten ratios. The intent — a human authorizes a scoped envelope of permitted actions, and the machine executes within it. This is the only position that scales to one-to-ten-thousand.
KhanBMS places human authority at the intent envelope and keeps it there. The Khan-tier commander signs an envelope that defines: rules of engagement, geographic scope, temporal window, target categories, escalation thresholds. Every lethal action executed by any node in the resulting Tumen is cryptographically traceable to the named human who signed the envelope.
This is a stronger accountability model than the trigger position offers, because the envelope is auditable in a way that a fired round is not. The envelope exists. It is signed. It is scoped. It is reviewable after the fact by any cleared authority. A Reaper pilot's intent at the moment of release is not auditable in this way. An envelope is.
The moral architecture matters. The decimal hierarchy means every tier — Arban, Zuun, Minghan, Tumen — operates within an envelope inherited from above. A node cannot escape its envelope. A tier cannot expand its envelope. The human at the top is structurally responsible because the structure makes them responsible.
KhanBMS is the only commercial BMS that treats the envelope as a first-class cryptographic object. Every other approach — direct control, simple veto, ad hoc rules of engagement — either fails to scale or fails to audit. The autonomous kill chain has a correct answer, and the architecture exists to deploy it.