Vendor and Product Reality

Lattice is the connective tissue of Anduril's portfolio. It ingests feeds from Anduril's own sensors and from third-party sources, runs detection, classification, and tracking on edge and cloud compute, produces a fused common operating picture, and pushes tasking to effectors across the portfolio, which spans counter-UAS interceptors such as Anvil and Roadrunner, loitering munitions in the Bolt family, the Barracuda cruise missile line, the Dive-LD undersea vehicle, and the Ghost and ALTIUS air systems. The mission-autonomy layer above Lattice, which Anduril markets under the Lattice brand and inside specific platform contracts, coordinates teams of unmanned systems against assigned mission objectives at machine speed. This is genuinely hard engineering, and Anduril does it well; nothing in this paper disputes the quality of that autonomy.

The commercial position is unusually strong for a company that is not a traditional prime. Anduril has publicly announced work on the U.S. Air Force Collaborative Combat Aircraft program, involvement in the Replicator initiative, counter-UAS programs, and a growing list of allied engagements. The company's stated pitch is that it builds software-defined systems on commercial timelines and sells them as products rather than as one-off platforms. The portfolio breadth across surveillance, counter-UAS, strike, undersea, and air, tied together by the Lattice software layer, is the structural moat, and the cross-domain coverage Lattice coordinates is a real advantage.

The architectural axis this paper addresses is specific and narrow. In a Lattice-class architecture, engagement-relevant decisions and the constraints that bound them are computed inside the coordination platform, and rules of engagement are loaded, configured by operators, and enforced by the vendor's autonomy logic, with operators able to see and intervene on the resulting decisions. That is a sound design for the coordination problem it solves. It is a different design point, however, from one in which engagement authority is structured as a revocable permission that is (a) gated at graduated confidence thresholds, (b) confirmed independently by multiple non-communicating governance channels before any consequential action, (c) continuously re-evaluated during execution so that authorization can be withdrawn mid-engagement, and (d) recorded in a lineage complete enough that an external reviewer can reconstruct which confidence computation and which rules-of-engagement evaluation admitted each action. Those four properties are what Application 19/647,395 discloses, and they are the axis on which this comparison is drawn. This is a statement about architectural structure, not a claim that Lattice lacks operator oversight or ROE handling, which it plainly has.

The Architectural Axis

The following framing about the lethal-autonomous-weapons debate is external market and policy context, not a claim of the filing; the filing's contribution is the governance architecture described in the next section. The international discussion over autonomous weapons, at the UN CCW and inside U.S. policy such as DOD Directive 3000.09 (updated in 2023), has centered on the principle of meaningful human control over the use of force. The unresolved question is what "meaningful" requires in an architecture. One defensible reading is that human control has to be structurally enforced rather than procedurally assumed: the conditions under which an autonomous system may act have to be checked continuously and independently at the moment of action, and each action has to leave a record complete enough to verify after the fact that those conditions held.

That reading is the axis on which Application 19/647,395 differs from a coordination-first architecture. Its defense embodiment does not add a policy brochure on top of an unchanged autonomy stack. It restructures engagement authority into four architectural properties: graduated escalation thresholds, quorum authorization across independent channels, continuous revocable re-evaluation, and complete lineage recording. The filing frames these as generic governance primitives instantiated in a defense domain, not as claims about any specific vendor's product.

Graduated escalation means the confidence governor authorizes progressively consequential actions only at progressively higher confidence: a first threshold to observe and classify, a second to warn, a third to recommend engagement to a human, and, only where autonomous engagement is legally and operationally authorized, a fourth to execute engagement. Each threshold draws on a confidence value the system computes from structured inputs, disclosed in the filing as target-identification confidence, rules-of-engagement compliance confidence, collateral-damage assessment confidence, and chain-of-command authorization confidence. This is a materially different design point from computing a single engagement decision and surfacing it for operator approval.

Quorum authorization means consequential engagement requires independent confirmation from multiple governance channels that do not share evaluation state: the confidence governor, which must compute sufficient confidence across all engagement dimensions; the integrity engine, which must confirm the action is consistent with the system's rules-of-engagement profile; and the chain-of-command channel, which supplies human authorization at the appropriate level. In the filing's disclosed embodiment, lethal engagement requires all channels to authorize independently, and any single channel's veto produces unconditional prohibition. Because the channels do not share state, a system that is confident but integrity-compromised cannot bias the integrity evaluation through a shared variable. This is architecturally distinct from a linear approval chain in which one evaluation feeds the next.

Continuous revocable re-evaluation means authorization obtained at one instant does not persist if the conditions that supported it change. The filing discloses that the confidence governor re-evaluates at each computational cycle during engagement, and that if confidence falls below a re-evaluation threshold, because target behavior changes, because collateral-damage assessment shifts, or because new information arrives, it can revoke authorization mid-engagement and return the system to the observation state. Engagement authority is a permission that is continuously earned, not a gate that latches open.

Complete lineage recording means every confidence computation and every escalation decision is recorded deterministically, producing an accountability chain from sensor data through confidence evaluation through the escalation decision. The filing's stated purpose for this is post-action accountability: an external reviewer can reconstruct which confidence computation and which rules-of-engagement evaluation admitted a given action. This is the property that turns oversight from a matter of trusting after-action narrative into a matter of reading the record.

How Confidence-Governed Authorization Works

The mechanism disclosed in Application 19/647,395 treats execution as a revocable permission enforced by a confidence governor: a structural subsystem, not an advisory module, that grants execution authority only while defined conditions hold and withdraws it when they no longer do. The filing is explicit that the governor is a hard gate. When it withdraws authorization, execution ceases, and the agent cannot override the withdrawal through self-assessment, urgency, or policy reinterpretation, because no execution pathway bypasses the gate. In the defense embodiment this is instantiated as the graduated escalation architecture, and the following description is written to enable a skilled implementer to build it.

Confidence is a first-class computed state variable. It is not a heuristic score or a metadata annotation but a continuously computed scalar written to a dedicated confidence field, participating in the same lineage, policy, and audit mechanisms as every other agent field. A confidence computation subsystem takes structured inputs, applies a defined evaluation function, and produces a value in a bounded range. In the defense instantiation the inputs disclosed are target-identification confidence, rules-of-engagement compliance confidence, collateral-damage assessment confidence, and chain-of-command authorization confidence. An implementer is free to substitute or extend these inputs for a given system class; the enabling point is that the value is computed from state, not declared.

Authorization operates in one of three states. In the authorized state the confidence value is above the authorization threshold and the confidence trajectory triggers no alarm, so execution is permitted. In the suspended state the value has fallen below threshold, or a trajectory-based projection has triggered preemptive suspension, so execution is prohibited while cognition continues; the system can still forecast, plan, and re-assess while unable to act. In the locked state a severe integrity violation or governance-mandated halt has occurred and recovery requires external authorization. Recovery from suspended to authorized requires the confidence value to exceed the threshold by a configurable hysteresis margin, so the system does not oscillate near the boundary. For physically embodied systems the filing further discloses a physical safety floor set above the general authorization threshold, below which no physical action is permitted regardless of task urgency or delegation command, and a transition to a predefined safe physical state when confidence drops below it.

Quorum authorization sits on top of the governor for consequential actions. Engagement requires independent confirmation from the confidence governor, the integrity engine, and the chain-of-command channel, evaluated without shared state, with a single-channel veto producing unconditional prohibition for lethal engagement. The integrity engine independently tracks rules-of-engagement compliance across proportionality, distinction, necessity, and precaution, records deviations with full semantic context, and, through an integrity-to-confidence pathway, progressively restricts engagement authorization for a system that has accumulated deviations. Policy constraints on all of these are enforced through the cryptographic policy framework disclosed in the co-pending governance application, which provides signed policy constraints, scoped mutation gating, and quorum-governed protocols; the confidence governor applies policy-defined authorization and suspension thresholds within that framework.

Enabling variations. The graduated thresholds can be instantiated with more or fewer escalation tiers for different system classes. The quorum membership can be widened, for example to include a coalition-partner authorization channel, provided the channels remain independent. The confidence inputs, the hysteresis margin, and the physical safety floor are configuration parameters, not fixed constants. The lineage record can be extended to capture additional evidence, and the same graduated-authorization and quorum structure disclosed for the defense domain is disclosed in the filing as generic across embodied and robotic execution, not specific to any one vendor's stack. Critically, none of this relocates the autonomy that a Lattice-class integrator provides: detection, classification, tracking, planning, and effector coordination remain the integrator's, and the governor consumes their outputs, including reported confidence, as inputs to an admissibility decision it does not itself compute the perception for.

Composition Pathway

Composition onto a Lattice-class coordination layer is incremental because the confidence governor consumes existing platform outputs rather than replacing them. The first step is to expose the confidence signals the platform already computes, target-identification confidence, track quality, and the rule-match result of the ROE evaluation, as structured inputs to a confidence field. The second step is to place the graduated-escalation governor and the quorum gate in front of consequential tasking, so that engagement tasking becomes a hard precondition satisfied only when the confidence governor, the integrity engine, and the chain-of-command channel independently confirm. The third step is to extend the audit pipeline to record every confidence computation and escalation decision deterministically, so that the accountability chain the filing describes is materialized in the platform's post-mission review surfaces. None of these steps requires re-architecting the perception and coordination logic that is the integrator's advantage.

The cross-system property follows from a single governor discipline applied uniformly. Because each coordinated effector runs the same graduated-authorization and quorum logic, the escalation thresholds and the veto semantics are enforced consistently across the portfolio, and continuous re-evaluation lets a mid-mission tightening of constraints propagate as an updated policy the governor consumes. Coalition interoperability composes cleanly with the quorum structure: because the quorum admits independent channels, a partner authorization channel can be added as an additional non-communicating veto without collapsing the independence that makes the quorum meaningful.

For the customer, the effect is an architectural answer to the questions oversight bodies ask: under what confidence, past which independent checks, and with what recorded evidence was this action taken. The following program references are external market context, not claims of the filing. Programs oriented toward fielding autonomous mass at scale sharpen the accountability problem, because oversight that depends on the number of human reviewers does not scale to large numbers of effectors, whereas an accountability chain recorded per action scales with the effectors themselves. The same composition logic is domain-general in the filing, which discloses the graduated-authorization and quorum structure for embodied and robotic execution broadly rather than for any single program or vendor.

Commercial and Licensing

The following market observations are external context, not claims of the filing. The defense-autonomy procurement environment is moving toward auditable governance and operator-trusted autonomy as evaluation criteria rather than marketing features, a direction reflected in CDAO's responsible-AI work, the updated DOD Directive 3000.09, and allied discussion of meaningful human control. A vendor that meets such a requirement structurally, rather than by attaching a governance layer to an unchanged autonomy stack, is better positioned in the segment where governance is a hard requirement.

A software-defined coordination layer such as Lattice is a favorable host for confidence-governed authorization precisely because the governor consumes the perception and coordination outputs the platform already produces, so adding graduated escalation, quorum authorization, and lineage recording is an additive change rather than a redesign. That is a genuine architectural advantage of the software-first design, and it is stated here as an observation about integration surface, not as a claim about any competitor's deficiency.

For Adaptive Query as the owner of the confidence-governance inventive step, the natural licensing structures align with defense procurement norms: per-platform, per-deployment, or usage-based royalties tied to the volume of governed engagement authorization across a customer's fielded portfolio, with a path to cross-vendor licensing. Because the disclosed governance structure is domain-general, the same primitive licenses across integrators and platform vendors rather than being tied to a single stack. The specific royalty structures described here are illustrative business framing, not part of the disclosure.

Disclosure Scope

The technical mechanisms described in this paper, confidence as a first-class computed state variable, the confidence governor as a hard revocable gate, the authorized, suspended, and locked authorization states with hysteresis on recovery, the graduated defense escalation architecture from observation through warning through engagement recommendation through engagement authorization, quorum-based engagement authorization across independent non-shared-state channels, integrity-tracked rules-of-engagement compliance, continuous revocable re-evaluation during engagement, the physical safety floor for embodied systems, and complete lineage recording of every confidence computation and engagement decision for post-action accountability, are disclosed in United States Patent Application 19/647,395. This constitutes a dated public technical disclosure enabling a skilled implementer to build the described approach and to vary it across the embodiments enumerated above.

All references to Anduril, Lattice, and the named systems and programs (including Anvil, Roadrunner, Bolt, Barracuda, Dive-LD, Ghost, ALTIUS, Collaborative Combat Aircraft, and Replicator), and all references to the lethal-autonomous-weapons debate, DOD Directive 3000.09, the UN CCW, procurement direction, and defense-market dynamics, are external context provided for comparison and situational framing only. They are not claims of United States Patent Application 19/647,395, and nothing in this paper should be read as an assertion about Anduril's internal architecture beyond what is publicly and generally known about a coordination-layer design, or as a statement that any named product lacks operator oversight or rules-of-engagement handling.