Anduril Mission Control Lacks Architectural Intent Substrate

Vendor and Product Reality: Lattice and Mission Control

Anduril's Lattice is an autonomy and command operating system for defense. It ingests sensor feeds across a heterogeneous fleet — counter-UAS radars, perimeter towers, autonomous undersea and surface vessels, loitering munitions, attritable aircraft — fuses them into a common operational picture, and exposes that picture to operators through Mission Control. Operators issue tasking through Mission Control; Lattice translates tasking into platform-specific behaviors; autonomous platforms execute within tasked scope; the loop closes through telemetry that updates the picture and informs the next tasking cycle. The product has matured from counter-UAS at fixed sites to attritable-aircraft orchestration, undersea autonomy, and integration into joint kill chains under JADC2-class data fabrics.

Mission Control's design center is operational coherence under time pressure. It compresses the OODA loop. It surfaces the right platforms to the right operators with the right context. It integrates upward into ATAK for the dismounted user, sideways into partner systems for joint operations, and downward into Anduril and partner platforms for actuation. Operators report that the integrated experience is materially faster and more legible than the legacy stovepipes it replaces. Within the operating envelope of "operator tasks platforms, platforms execute, telemetry returns," the product is excellent and arguably state-of-the-art for the U.S. defense market.

The architectural posture, however, is software-centralized. Mission authority lives inside the application layer — in the tasking flows, the state machines, the autonomy policies, and the audit logs that Mission Control generates as a byproduct of operation. Authority is real, but it is authority by software convention, not authority by cryptographic structure. The operator's intent enters the system as a directive and lives, thereafter, as an entry in a mission log.

The Architectural Gap: Intent as Log Entry, Not as Binding Substrate

The gap that Mission Control does not close is the binding between operator intent and admissible platform action. Under the current architecture, the operator's intent — the objective, the rules of engagement, the escalation envelope, the permitted target classes, the geographic and temporal scope — is expressed through a sequence of tasking actions and exists, structurally, as the trail those actions leave. Subsequent platform behavior is constrained by the autonomy policy and by additional operator interventions, but it is not constrained by a cryptographically-anchored declaration of what the operator authorized in the first place. If the autonomy policy admits an action, the action proceeds; the original intent is reconstructed, after the fact, from logs.

This is the architectural shape that the emerging international and domestic doctrine on lethal autonomous weapon systems (LAWS) and meaningful human control will not accept indefinitely. The doctrine asks a structural question: at the moment of action, was the action within the scope that an identified human operator authorized, and can that authorization be evaluated independently of the system that took the action. A log entry generated by the actuating system is not an answer to that question; it is the same system marking its own homework. The compliance posture under this doctrine requires intent that is externalized, signed, scoped, and admissible as evidence in adversarial review — not intent that is implicit in the configuration of the autonomy stack.

Mission Control treats intent operationally and excellently. It does not treat intent architecturally. The gap is not a bug; it is the natural consequence of optimizing the product for the OODA loop rather than for the meaningful-human-control evidentiary loop. As LAWS doctrine matures and as procurement begins to require structurally-supported intent rather than logs of tasking, the gap becomes a procurement-blocker.

What the Operator-Intent Primitive Provides

The operator-intent primitive externalizes intent as a first-class architectural object. Each tasking event produces an intent declaration: a structured, signed, time-scoped record carrying operator identity, the intended objective, the intended target or effect class, the intended geographic and temporal scope, the intended escalation profile, and the credential chain authorizing the operator to issue intent of that class. The declaration is anchored — cryptographically bound such that subsequent modification is detectable — and is admissible as a substrate against which platform actuations are evaluated.

Platform actions, in this model, do not merely log against a mission record; they admit against an active intent declaration. An actuation is admissible when it lies within the scope of a current, valid intent declaration whose authorizing operator is credentialed for the action class. The admissibility check is structural and machine-evaluable; the evaluation can be performed independently of the actuating system; the record of admission is itself signed and anchored. Post-action review is no longer a forensic reconstruction from telemetry — it is a verification, against the intent substrate, that each action was scoped by an authorization the operator actually issued.

The primitive inverts the locus of authority. Authority is no longer the property of the software stack that runs the mission; it is the property of the credentialed declaration that scopes what the stack is permitted to do. The autonomy policy continues to operate, but it operates within an envelope defined externally by intent rather than within an envelope defined by its own configuration. The operator's authority becomes architecturally durable rather than implicit in the audit trail.

Composition Pathway: Intent Substrate as Mission Control Extension

Composition with Mission Control is additive and preserves Anduril's existing operator workflow. The current tasking surface continues to be the way operators interact with the system; the change is that each tasking event also produces an intent declaration in the substrate, signed by the operator's credential and bound to the mission context. Lattice's autonomy stack continues to plan and execute; the change is that each actuation carries an admissibility check against the active intent declaration and produces a signed admission record alongside its existing telemetry. The integration is at the boundary, not at the core; the operator does not learn a new product, and the autonomy stack does not relinquish its decision authority.

The first surface this opens is LAWS-doctrine compliance. As policy matures from advisory to procurement-binding, programs that have an intent substrate ready ship into the new envelope; programs that rely on log reconstruction face architectural retrofit under schedule pressure. The second surface is allied interoperability: an externalized intent substrate, anchored in a credential model that partner nations can co-validate, becomes a basis for coalition autonomy where today the lack of common intent semantics blocks shared tasking across national boundaries. The third surface is post-action review and adversarial audit, where the intent substrate provides a structurally-supported answer to the question "was the operator's authorization sufficient for the action that occurred."

Each surface treats intent as something the architecture supports rather than something the audit log approximates. Mission Control gains the layer above mission tasking that doctrine is moving toward and that pure software-centralized authority cannot provide.

Commercial and Licensing Posture

Anduril is the natural licensee for the operator-intent primitive because Anduril already occupies the architectural seat above which the primitive composes. Mission Control is the surface where intent is generated; Lattice is the surface where intent must be admitted against; the credential model that the primitive requires is consistent with the identity and authority infrastructure that defense-grade Mission Control already maintains. Adopting the primitive as a Mission Control extension converts a forward-looking compliance burden into a procurement differentiator at exactly the moment the LAWS doctrine begins to bind.

The patent positions the operator-intent primitive at the architectural layer where Anduril's product roadmap, the meaningful-human-control regulatory trajectory, and allied-interoperability requirements all converge. Early adoption preserves the architectural lead Anduril enjoys today; deferred adoption invites a competitor or a regulator to define the substrate from outside, after which retrofit will be more expensive than incorporation would have been. The licensing posture favors composition with the existing leader; the strategic posture favors the leader composing.