Vendor and Product Reality
Anduril Industries operates Lattice OS as a sensor-fusion, track-management, and effector-tasking platform across a vertically integrated portfolio. Sentry Towers contribute persistent EO/IR and radar tracks; Ghost-series sUAS provide loiter and ISR; Pulsar contributes RF detection and electronic attack; Roadrunner and Anvil close the kinetic loop on aerial threats as counter-UAS interceptors; Bolt contributes man-portable precision strike as a loitering munition. The platform exposes Lattice for Mission Autonomy as the higher-order layer that ingests these tracks, fuses them into a common operating picture, and dispatches engagement directives to the appropriate effector. Anduril has been publicly reported as a participant in Department of Defense autonomy efforts including the Replicator initiative and border-security tower deployments for U.S. Customs and Border Protection, and Lattice is generally positioned by the company to interoperate with U.S. and allied command-and-control and battle-management reference architectures. This article does not attribute any specific contract scope, program role, or capability to Anduril beyond what the company and the Department have publicly stated; the comparison below is at the architecture level.
The technical execution at platform scale is mature and, on its own terms, justified by the operational record. What Lattice provides is a Lattice-internal control plane. Mission rules, identification logic, engagement criteria, and cross-platform handoff sequences are evaluated inside Lattice services running on Lattice-controlled compute, against a data model curated by Anduril. Partner contributions enter through SDK adapters that translate external sensor and effector telemetry into Lattice's internal representation; once translated, they are governed by Lattice-side policy. This architecture is operationally coherent within the Anduril perimeter and produces the cross-platform integration story the company markets. It is also where the architectural gap originates.
Architectural Gap
Coalition warfighting under contested-logistics, contested-comms conditions does not have a single mission-autonomy authority. A combined task force operating under CENTCOM with U.K., Australian, Japanese, and Korean contributions, augmented by industry-supplied autonomy from multiple primes, has at minimum six independent rule-issuing authorities, national, service, theater, coalition, vendor, and unit, each of which must retain the ability to bind, revoke, or condition the use of its sensors and effectors in real time. Lattice as deployed today expresses this multi-authority reality through partner-integration agreements and per-deployment policy configuration on the Lattice server side; the rules do not travel with the data object across authority boundaries.
The distinctions that follow are architectural properties of any platform-centric control plane, not criticisms specific to Anduril's engineering, which is strong on its own terms. First, representational normalization: when a coalition's sensor and effector inventory is translated into a single platform's internal data model, that model becomes the integration point, and interoperation with any other stack is mediated through it. Second, authority locus: partner contributions, once ingested, are evaluated under the policy configured on the platform's own services rather than under a rule set that each contributing authority binds to its own data. Whether this is acceptable is a governance and sovereignty question that coalition programs weigh case by case; it is not a defect, but it is a structural property worth naming. Third, boundary composition: a non-platform autonomy stack, whether a competing prime's mission system, a national lab's experimental controller, or a coalition partner's sovereign autonomy service, generally interoperates by acting as a client of the platform or by running a parallel command-and-control thread, because a platform-centric design does not, by construction, provide a neutral credentialed peer-to-peer composition layer. Fourth, and most concretely, rules do not ship with the data: a track produced by one nation's sensor, identified under that nation's rules of engagement, and offered to another party's effector does not carry its identification credential and engagement constraints as a structural property of the data object; those constraints are re-evaluated server-side under whatever policy the receiving platform instance is configured with.
What the Spatial-Mesh Primitive Provides
The Governed Spatial Mesh inverts the locus of authority. In the disclosed architecture, every contribution to the mesh is formatted as a governed observation: a self-describing data object that carries, at minimum, an authority-credential field identifying the authority responsible for the observation, a device-identity attestation, a temporal-scope field expressing freshness and validity period, and the payload. The authority credential encodes the issuing authority, the credential's validity period, and a device-binding attestation, and it locates the observation within a hierarchical authority taxonomy. The disclosure gives a defense-domain taxonomy with levels including theater-command, division, brigade, battalion, company, and individual-operator authority, though the mechanism is not limited to any fixed set of levels. Because these fields are bound to the object, a track, an identification claim, an engagement authorization, or a no-strike constraint carries its own admissibility basis rather than depending on a rule set stored on whatever server happens to be processing it.
Critically, the disclosure places evaluation at the receiving unit. Each receiving device runs a composite admissibility evaluator that verifies the credential chain, weighs the observation's authority level, freshness, and corroboration, and admits, gates, or rejects the observation, recording the outcome in a lineage record. Data carries authority; the network does not confer it. When an observation originating under one nation's rules is offered to another party's effector, the receiving party evaluates the bound constraints against its own published policy and either composes the action or declines it. No party surrenders authority to a single vendor's server-side rule engine, because there is no privileged issuer: the open-contribution primitive admits any source carrying a valid authority credential and formatting observations to the governed-observation schema, without that source needing to be onboarded into a coordinator's internal data model.
Federation across authority boundaries is explicit. The disclosure describes a governance-credentialed boundary agent that performs cross-authority boundary translation, and forecasting and training agents that compose in declared federations. Two parties wishing to share observations, hand off authority, or compose a multi-platform effect declare which object classes cross the boundary, under what credential requirements, and with what revocation semantics. Revocation is structural rather than advisory: the disclosure specifies credential revocation with a policy-defined retroactive-invalidation semantics, so that once an authority credential is revoked, the affected device is ineligible to emit or relay observations under that authority context and downstream consumers lose the basis to admit the affected objects, whether or not any central service has refreshed. This is the property that makes cross-authority composition survivable under partner-withdrawal, contested-comms, and adversarial-deception conditions that a platform-centric control plane does not, by construction, address.
Composition Pathway With Lattice
The primitive composes with Lattice additively rather than as a replacement. Lattice continues to serve as Anduril's internal sensor-fusion and effector-tasking platform; its tracks, identifications, and engagement directives are emitted as credentialed mesh objects rather than as platform-internal messages. From the perspective of an external party, a coalition partner's sovereign autonomy service, a competing prime's mission system, a DoD-operated reference C2, the Anduril contribution appears as one credentialed mesh participant among many, with its objects carrying Anduril's credentials and the constraints negotiated through the relevant federation agreement.
Concretely, a Sentry Tower track passes into Lattice as it does today, undergoes Lattice's fusion and identification, and is then published into the mesh as an object credentialed by Anduril and conditioned by the operating authority's ROE. A Roadrunner engagement directive is emitted as a mesh object whose authorization chain includes the issuing operator, the cognizant ROE authority, and the platform. Non-Anduril participants, a partner-nation Aegis cell, a competing counter-UAS vendor, an experimental autonomy from a service lab, contribute their own credentialed objects into the same mesh, federate with the Anduril contribution under declared agreements, and compose engagements peer-to-peer. Cross-platform handoff between, for example, an Anduril Ghost track and a non-Anduril interceptor proceeds through credentialed mesh composition rather than requiring the non-Anduril effector to operate as a Lattice client.
The integration is engineering-tractable, and a skilled implementer could build it from the disclosure. The mesh substrate sits beside a platform's existing publish surface: the platform's fusion output is wrapped as a governed observation by attaching an authority-credential field per the disclosed schema, a device-identity attestation, and a temporal-scope field, and is emitted on the mesh; existing platform-internal integrations continue to function unchanged for parties that prefer platform-internal operation; the cross-authority composition layer is additive for parties that require it. The disclosure enumerates a range of embodiments this spans: progressive-density deployment from a no-device baseline up through dense governance-credentialed coverage, with graceful degradation as devices are lost; operation across ground, maritime, aviation, and other domains; multi-hop relay in which each hop re-evaluates through the relaying device's own composite admissibility evaluator; and signaling-mechanism independence, so the substrate is not tied to any particular radio or transport. Operator workflows are unchanged, and any reference-architecture interoperability a platform vendor has publicly committed to is preserved.
Commercial and Licensing Trajectory
Defense procurement is broadly reported to favor interoperable, non-vendor-locked autonomy, with coalition-interoperability and sovereign-authority preservation appearing as evaluation themes in publicly discussed program lines. A platform that can operate as a credentialed mesh participant, rather than requiring coalition partners to enter its perimeter, is well positioned against those themes. This is a market observation offered as context, not an attribution of any specific award outcome to any party.
A platform vendor's competitive position can benefit from adopting a cross-authority substrate layer additively. Adoption preserves the platform's role as an internal mission-autonomy engine while addressing the governance question of whether cross-authority evaluation should happen inside a single vendor's services. The licensing pathway is conventional: a field-of-use license for the mesh substrate within a vendor's control plane, with the underlying primitive remaining available for federation with other participants under the filing's broader terms.
The adoption case is reinforced by contested-comms operations, which are a widely acknowledged planning concern. A platform-internal mission-autonomy stack tends, under communications denial, to fall back to whatever rules it last held, mediated by whatever fragmentary updates cross degraded links. A credentialed mesh substrate degrades differently: because each observation carries its own authority basis and freshness, and each receiving unit evaluates locally through its own composite admissibility evaluator, participants can retain the credentialed objects they have cached, the federations they have declared, and the revocations they have accepted, and compose locally without dependence on a reachable central service. This is the disclosure's graceful-degradation and progressive-density behavior applied to the coalition case, and it is where a data-carries-authority substrate is not merely a convenience but an architectural requirement.
Disclosure Scope
The invention described in this article, the Governed Spatial Mesh substrate in which each spatial observation is a self-describing, authority-credentialed data object evaluated by each receiving unit through a composite admissibility evaluator against its own published policy, is disclosed in U.S. Provisional Application No. 64/049,409. Every statement in this article about what the substrate does, including the governed-observation schema, the authority-credential and temporal-scope fields, the composite admissibility evaluator, the hierarchical authority taxonomy, cross-authority boundary translation, credential revocation semantics, open contribution from any credentialed source, and progressive-density deployment with graceful degradation, traces to that disclosure. All references to Anduril, Lattice, and any specific defense program, product, or reference architecture are external context describing third-party systems as publicly reported; they are not claims of U.S. Provisional Application No. 64/049,409, and no contract, program role, capability, or figure is attributed to any third party beyond what that party or the relevant public authority has stated. Anduril, Lattice, and other named products are the property of their respective owners and are referenced for accurate architectural comparison only.
