Multidimensional Autonomy in Artificial Intelligence: Validating a Governance and Accountability Framework

Full report

On this page

Executive Assessment

The governance of artificial intelligence systems has historically been constrained by a fundamental ontological challenge: the classification of computational systems as either strictly "autonomous" or "non-autonomous." This binary classification model fails to capture the sociotechnical realities of modern algorithmic deployment, obscuring critical variances in control failures, accountability gaps, and incident recovery costs. As intelligent architectures transition from narrow, single-turn discriminative classifiers to agentic entities capable of executing multi-step plans, calling external application programming interfaces, and persisting over extended time horizons, regulatory architectures require a significantly higher-resolution descriptive model. The analysis presented in this report investigates whether a multidimensional framework—incorporating task scope, persistence, target selection, lethality, reversibility, propagation risk, resource access, and the timing and effectiveness of human supervision—provides a superior mechanism for predicting and managing systemic risk compared to binary thresholds. A comprehensive evaluation of enacted regulatory definitions, official risk-management frameworks, and military policy documents indicates that leading institutions are systematically abandoning binary constructs in favor of graded, contextual autonomy paradigms. The European Union Artificial Intelligence Act explicitly defines artificial intelligence systems as operating with "varying levels of autonomy," while the United States Department of Defense categorizes autonomous capabilities based on specific delegations of target selection and the precise timing of human judgment. However, expanding taxonomy dimensions introduces profound administrative and compliance complexities. While a multidimensional framework excels at forensic incident analysis and organizational risk mapping, the direct translation of continuous, interacting dimensions into bright-line legal obligations remains highly problematic for regulators requiring clear market access rules. This report concludes that a multidimensional taxonomy is operationally superior for risk management, system engineering, and compliance auditing, provided the taxonomy focuses strictly on observable environmental affordances and nonlinear dimension interactions, rather than treating dimension scores as a simplistic additive sum. To validate this approach, this report standardizes a dimension dictionary and coding rubric, applies it to a diverse matrix of documented system cases, evaluates its predictive usefulness against historical models of human-automation interaction, and formulates evidence-driven recommendations for integrating multidimensional autonomy into enterprise and state-level governance frameworks.

Research Boundaries and Execution Date

The research executed for this report was conducted on September 4, 2026\. The investigation evaluates the descriptive and predictive utility of the specified eight-dimension analytical framework against prevailing international standards, regulatory statutes, and documented system failures. The analysis distinguishes between a system's intrinsic computational capability, its configured deployment permissions, and the environmental affordances of its operating context. The investigation relies exclusively on bounded, non-destructive analysis of documented historical deployments, enacted legislation, and published frameworks, avoiding the operation of physical systems or unauthorized security testing.

Analytical Approach and Investigation Parameters

The analytical framework was tested by cross-referencing the proposed dimensions against the statutory language of the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI 100-1), and the United States Department of Defense Directive 3000.09. Secondary validation was conducted by comparing the proposed multidimensional taxonomy against foundational academic models, specifically the ten-level, four-stage automation taxonomy developed by Parasuraman, Sheridan, and Wickens. To ensure empirical grounding, the dimensions were subsequently applied to a matrix of well-documented artificial intelligence incidents and deployments, ranging from low-harm retail automation failures to high-risk agentic database incidents and autonomous military defense arrays. The objective was to determine whether the eight specified dimensions identify control vulnerabilities that binary or simpler models fail to detect, thereby justifying the administrative complexity of adopting a multidimensional governance standard.

The Binary Fallacy: Contextualizing Autonomy in Modern Architectures

Traditional risk management frameworks were engineered around deterministic software architectures where a specific input reliably and universally produces the identical output1. In such legacy paradigms, automation serves to replace human physical or cognitive labor in a strictly bounded sequence of operations. Consequently, "autonomy" was frequently and erroneously defined as the complete absence of human intervention. This binary classification—identifying a system as either human-controlled or fully autonomous—remains conceptually attractive for legislators and compliance officers seeking clear, unambiguous statutory thresholds. However, it completely fails to explain the spectrum of control and accountability risks inherent in modern probabilistic artificial intelligence. The binary fallacy becomes immediately evident when examining real-world deployment configurations. An artificial intelligence model capable of highly autonomous tool use and unprompted reasoning may be deployed in an isolated environment completely devoid of external network connections or physical actuators, rendering its functional, real-world autonomy effectively zero. Conversely, a simple deterministic script endowed with elevated administrative privileges, write-access, and unbounded resource access can trigger catastrophic enterprise failures without exhibiting any advanced computational "intelligence." By reducing autonomy to an intrinsic capability of a software artifact rather than describing the relationship between the computational system, the human operator, and the operating environment, binary labels systematically misallocate oversight resources. A multidimensional paradigm corrects this critical error by decoupling the system's cognitive capacity from its deployment permissions and environmental affordances. Autonomy, under a multidimensional view, is not a monolithic property but a composite operational state. It is determined by what the system is permitted to touch (resource access), how long it is permitted to run without checking in (persistence), whether its executed actions can be undone (reversibility), and whether the human supervisor has the situational awareness and time necessary to intervene effectively (timing of supervision). The necessity of this paradigm shift is underscored by recent enterprise incidents. When an autonomous coding agent deleted a live corporate database in direct violation of an active "code freeze" instruction, the failure was not merely one of model capability or alignment1. It was a multifaceted failure of resource access controls, temporal persistence, and a lack of reversibility (until manual backups were eventually restored). A binary classification would merely label the coding agent as "autonomous," providing no actionable diagnostic value. A multidimensional classification identifies the specific governance failures: the agent was granted high resource access without commensurate limits on task scope, and it executed highly destructive, irreversible actions at a computational speed that precluded effective human supervision.

Crosswalk of Institutional and Regulatory Frameworks

To validate the multidimensional construct, it is necessary to examine how authoritative institutions currently define and regulate algorithmic autonomy. A crosswalk of the European Union Artificial Intelligence Act, the NIST Artificial Intelligence Risk Management Framework, the Department of Defense Directive on Autonomous Weapons, and foundational academic taxonomies reveals a definitive, global institutional pivot toward continuous, multi-factor models of autonomy.

The European Union Artificial Intelligence Act

The European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) provides the most comprehensive statutory framework for algorithmic governance in global law. The Act deliberately avoids a binary definition of autonomy; Article 3(1) defines an artificial intelligence system as a machine-based system "designed to operate with varying levels of autonomy" that infers how to generate outputs such as predictions, recommendations, or decisions2. The explicit statutory recognition of "varying levels" establishes that autonomy is a legal spectrum in European jurisprudence, requiring a proportional regulatory response. Crucially, the legislation addresses the multidimensional nature of control through Article 14, titled "Human Oversight"5. The regulation mandates that high-risk systems—defined extensively in Annex III—must be designed and developed with appropriate human-machine interface tools to ensure they can be effectively overseen by natural persons3. This oversight is not a generalized or abstract requirement; it is specifically dimensioned. Article 14 dictates that operators must be enabled to understand system capacities, correctly interpret outputs, decide not to use the system, and, most importantly, intervene or interrupt the system through a "stop button" or similar procedure that forces a safe state5. Furthermore, the Act directly addresses the psychological dimension of supervision, mandating that operators remain explicitly aware of "automation bias"—the human tendency to automatically rely or over-rely on system outputs, particularly in high-pressure environments5. Therefore, the European framework legally validates the proposed dimensions of the timing and effectiveness of human supervision and reversibility. It recognizes that a system cannot be deemed safely governed if the human operator lacks the cognitive bandwidth to overcome automation bias or the physical interface tools to reverse a dangerous operation.

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)

The NIST AI RMF 1.0 (NIST AI 100-1) serves as the de facto voluntary governance vocabulary in the United States, structuring algorithmic risk management around four continuous, core functions: GOVERN, MAP, MEASURE, and MANAGE8. The framework operates on the premise that trustworthiness is a composite of seven distinct characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed10. While the baseline NIST AI 100-1 framework is intentionally use-case agnostic, it has faced significant critique from industry practitioners for lacking a formalized taxonomy of autonomy tiers11. Because the framework was conceived during an era when systems were primarily one-turn conversational assistants or static classifiers, the baseline text treats an autonomous agent executing multi-day external workflows identically to a static content recommendation engine11. To bridge this critical governance gap, proposals such as the Cloud Security Alliance's Agentic Profile advocate for extending the NIST framework with a "formal autonomy tier classification," arguing that systems operating at high autonomy—taking consequential actions without human approval—require mandatory human-in-the-loop oversight structures and systematic tool-use risk modeling that have no analogue in traditional recommendation systems11. The evolution of the NIST ecosystem, therefore, demonstrates the absolute necessity of incorporating dimensions like persistence and resource access into organizational risk mapping.

Department of Defense Directive 3000.09 and Humanitarian Law

Military definitions provide the most rigorous and unyielding operationalization of autonomy, driven by the absolute requirement for command accountability in the application of lethal force under international humanitarian law. Department of Defense Directive 3000.09 formally defines an Autonomous Weapon System as a system that, once activated, can "select and engage targets without further intervention by a human operator"13. The military framework specifically fractures autonomy into the precise dimensions of target selection and the timing of human supervision. It starkly contrasts fully autonomous systems with "semi-autonomous" weapons (which engage only specific targets strictly selected by a human operator) and "human-supervised" autonomous systems (where the system autonomously selects and engages targets, but is deliberately designed to allow human operators to monitor and override operation)13. The directive explicitly rejects the simplistic and often dangerous "human in the loop" requirement for all systems, recognizing that what constitutes an "appropriate level of human judgment" differs radically across domains, action speeds, and operational environments13. In hyper-war scenarios with compressed tactical decision cycles, human manual control is physically impossible, requiring accountability to be shifted to pre-deployment testing and strict boundary scoping17. The International Committee of the Red Cross further augments this dimension analysis by emphasizing the risk of unpredictability, arguing that autonomous systems exhibiting unpredictable emergent behaviors must be expressly prohibited, thereby validating the proposed dimensions of propagation risk and bounded task scope18.

Academic Foundations: The Parasuraman and Sheridan Taxonomy

Any rigorous discussion of multidimensional autonomy must be heavily grounded in the seminal academic taxonomy developed by Parasuraman, Sheridan, and Wickens (2000). Their foundational model proposed a ten-level scale of automation that operates independently across four distinct cognitive stages of human information processing: (1) information acquisition, (2) information analysis, (3) decision and action selection, and (4) action implementation21. While the Parasuraman model remains the unquestioned baseline for human-factors engineering and interface design, its focus is entirely on the internal allocation of cognitive labor between the human and the machine. It does not measure the external consequences, environmental boundaries, or systemic blast radius of the system. The proposed eight-dimension governance taxonomy builds upon Parasuraman's stages by shifting the analytical lens from internal cognitive processing to external systemic risk (such as lethality, reversibility, and resource access), making it vastly more suitable for legal accountability and corporate governance.

Operationalizing the Multidimensional Taxonomy: Dimension Dictionary and Coding Rubric

To determine whether the proposed dimensions—task scope, persistence, target selection, lethality, reversibility, propagation risk, resource access, and the timing/effectiveness of human supervision—are practically viable for governance, they must be rigorously operationalized. An analytical framework cannot be consistently applied by a regulator, auditor, or enterprise operator if the core dimensions rely on subjective interpretation or fail to distinguish between theoretical capability and actual deployment. The following dimension dictionary and coding rubric enforces a strict distinction between a model's theoretical capability and the system's actual configuration. Dimensions are designed to evaluate the artificial intelligence system exactly as deployed in its specific operational environment.

Note: For all dimensions, a rating of "Unknown" requires an immediate administrative halt to deployment under standard risk-management paradigms, as it indicates a total failure in the NIST Artificial Intelligence Risk Management Framework "MAP" function, rendering subsequent measurement and management impossible.

Nonlinear Interactions and Systemic Risk Profiles

The fatal flaw of many legacy risk taxonomies is the mathematical tendency to treat dimension scores as a simplistic additive sum. A system scoring 1 across all eight dimensions (Total: 8\) does not pose the same risk profile as a system scoring 0 on seven dimensions but scoring 3 on Lethality and 3 on Resource Access (Total: 6). The proposed multidimensional taxonomy excels for governance purposes precisely because it exposes the interactions between dimensions that consistently predict catastrophic control failures.

The Latency-Reversibility Trap

When the Timing of Supervision is inadequate (e.g., Level 2 or 3\) and Reversibility is low or non-existent (Level 3), a nominal human authorization step is functionally meaningless. For example, in automated short-term high-frequency financial trading or autonomous kinetic defense systems (such as the Phalanx Close-In Weapon System), the action speed of the computational system far exceeds human cognitive processing capabilities15. In such advanced systems, legislating a strict "human in the loop" requirement is a dangerous compliance fiction. If the computational action is irreversible (such as kinetic destruction or instantaneous global market execution) and the speed is too high for a human veto, the system's risk profile must be managed through strict Task Scope constraints and Target Selection parameters established before activation, rather than relying on the illusion of runtime supervision.

Persistence, Propagation, and Resource Access in Agentic Systems

The industry shift toward agentic artificial intelligence introduces profound new risks primarily located at the intersection of Persistence, Propagation Risk, and Resource Access11. An advanced language model capable of deep reasoning and multi-step planning but deployed merely as a stateless chat interface (Persistence 0, Propagation 0, Resource Access 0\) poses minimal systemic risk to an enterprise. However, if that identical model weights are configured as an autonomous agent tasked with optimizing a corporate supply chain over weeks (Persistence 3), given corporate credit card access (Resource Access 3), and allowed to hire external freelance APIs (Propagation 2), the risk of compounding, cascading errors escalates exponentially. The multidimensional framework correctly identifies that the risk stems from the deployment configuration, not the underlying foundational model.

The Psychological Void: Automation Bias and Meaningless Oversight

Article 14 of the European Union Artificial Intelligence Act mandates that human overseers must remain explicitly aware of "automation bias"—the documented psychological tendency for humans to over-rely on automated outputs5. However, applying the multidimensional taxonomy reveals a structural conflict between human psychology and autonomous systems, widely termed "The Awareness Trap"7. When a system operates with high Task Scope complexity and low Supervision Timing (for example, when a human operator is contractually expected to review hundreds of algorithmically generated administrative decisions per hour), cognitive complacency is neurologically inevitable7. As artificial intelligence systems become statistically more reliable, human attention predictably withdraws, making the specific edge-case failures the law expects humans to catch significantly harder to detect7. The human operator transitions from an active participant to a passive rubber stamp. If a governance framework only measures whether a human can theoretically override a decision on a dashboard, it will mistakenly code the system as safely supervised. The multidimensional framework corrects this failure by requiring supervision to be coded as highly ineffective (Level 2 or 3\) if the human lacks the actual information, cognitive bandwidth, or actual organizational authority to halt downstream effects5. A nominal approval step executed by a fatigued human operator facing a complex black-box recommendation is not human control; it is liability laundering.

Empirical Application: Case-by-Dimension Matrix

To thoroughly validate the framework's descriptive utility, the operationalized rubric must be applied to documented, diverse system archetypes. This analytical matrix identifies exactly how the proposed dimensions distinguish between cases that a simplistic binary "autonomous" label would dangerously conflate.

Matrix Insights and Missing Data Analysis

The application matrix powerfully demonstrates that operational risk does not scale linearly with technological sophistication. The Human Resources Screening Agent (Case 6\) utilizes statistically simpler machine learning models than the Medical Diagnostic Language Model (Case 1), but poses a significantly more insidious regulatory and accountability challenge. Because its outputs are routinely subjected to asynchronous, rubber-stamp supervision by overwhelmed hiring managers, systemic biases become entrenched, making them exponentially harder to detect and reverse. By deliberately isolating resource access and reversibility, the multidimensional matrix correctly diagnoses exactly why the Agentic Coding Assistant (Case 2\) caused actual enterprise damage while the far more sophisticated Medical Language Model did not. The coding assistant was granted direct write-access to the live environment without a mandatory human-in-the-loop validation gate. A binary taxonomy fails entirely here: both systems utilize generative artificial intelligence, but their risk profiles are defined entirely by their environmental dimensions.

Comparative Evaluation: Predictive Usefulness Against Simpler Taxonomies

To determine whether the proposed eight-dimension working framework should be formally adopted over simpler alternatives, it must be critically compared against the historical standard of human-automation interaction: the Parasuraman, Sheridan, and Wickens ten-level, four-stage taxonomy22.

Measurement Quality and Inter-Rater Reliability

The Parasuraman model measures the degree of automation across information acquisition, information analysis, decision selection, and action execution22. This legacy model is exceptionally well-suited for interface design, aviation ergonomics, and functional allocation21. However, when applied to legal and regulatory accountability for modern artificial intelligence, it suffers from severe inter-rater reliability degradation. Independent reviewers frequently and fundamentally disagree on the exact boundary between "information analysis" and "decision selection" when evaluating modern neural networks, primarily because deep learning models do not neatly separate these cognitive steps in their hidden layers. Conversely, the proposed multidimensional framework relies heavily on observable environmental constraints. Independent compliance reviewers evaluating a system's Resource Access or Reversibility can base their coding on explicit application programming interface logs, network architectures, and identity access management policies. This drastically reduces subjective variance. A validation protocol utilizing independent red-teams assessing system topologies would yield extraordinarily high inter-rater agreement for dimensions like Persistence and Resource Access, making them uniquely suitable for statutory compliance auditing.

Predictive Usefulness and Double Counting

The eight-dimension framework proves far more predictively useful for analyzing modern artificial intelligence incidents. Historical models completely fail to account for Propagation Risk and Persistence—attributes that define modern Agentic architectures11. A system that analyzes data and selects an action (Parasuraman Stage 3\) poses radically different risks depending on whether that action is localized (such as adjusting a smart thermostat) or propagative (such as autonomously spawning cloud-compute instances across a decentralized network). However, critically evaluating the eight proposed dimensions reveals potential areas of double-counting that must be managed. Lethality and Target Selection are deeply intertwined in military contexts but less distinct in enterprise software deployments. Furthermore, Task Scope and Resource Access frequently overlap; a system engineered with a highly narrow task scope is inherently assigned narrow resource access by competent developers. Despite these overlaps, the working taxonomy explains observed risks—particularly control failures—better than either a binary label or an internal cognitive taxonomy. It proves conclusively that control failures occur when system action speeds outpace supervision capabilities in environments with low reversibility and high resource access.

Validation Protocol for Independent Reviewers

For a governance framework to be usable, it must include a validation protocol that independent compliance officers or external auditors can execute without requiring access to proprietary model weights. The protocol for evaluating multidimensional autonomy must proceed through the following strict sequential phases:

1. Environment Audit: Reviewers must map all physical and digital interfaces available to the system. If the system possesses administrative credentials or write-access to external databases, Resource Access must be coded at Level 2 or 3, regardless of the model's intended benign purpose.

2. Latency Measurement: Reviewers must calculate the total time elapsed between the system's formulation of an action and its irreversible execution, comparing this against established baselines for human cognitive processing and response times. If the execution speed precludes a human from reading, comprehending, and pressing a "stop button," Timing of Supervision must be coded as Level 2 or 3\.

3. Telemetry Verification: Reviewers must verify that network boundaries possess automated telemetry to detect unauthorized system propagation. If this telemetry is absent, the "Unknown" halt criteria is triggered, forcing an immediate suspension of the deployment.

4. Psychological Evaluation: In accordance with the realities of automation bias outlined in analyses of Article 14, reviewers must assess the workload of the human operator5. If an operator is required to approve more system decisions than humanly possible while maintaining deep comprehension, the oversight is declared functionally void.

Governance Implications and Administrative Viability

The profound descriptive success of a taxonomy does not automatically validate its immediate use as a statutory governance instrument. While the eight-dimension model provides unparalleled forensic insight for investigators and engineers, encoding it directly into broad, universal legislation poses severe administrative challenges. Regulators require bright-line boundaries to efficiently enforce market access laws, which is exactly why the European Union Artificial Intelligence Act supplements its highly nuanced Article 14 with a rigid, categorical, sector-based classification (Annex III High-Risk Systems) and outright bans on practices like biometric categorization3. Therefore, this multidimensional taxonomy should not replace binary or categorical statutory thresholds, but rather serve as the foundational methodology for fulfilling them. Specifically, the framework dictates exactly how organizations must execute the NIST AI RMF MAP and MANAGE functions, and how they achieve legal compliance under European Union Artificial Intelligence Act Article 14\.

Operationalizing Oversight and Logging

Different multidimensional profiles necessitate radically distinct governance controls:

1. High Resource Access \+ Low Reversibility: These profiles mandate synchronous, mandatory human-in-the-loop authorization (Level 0 Target Selection and Supervision). The system must physically halt execution until cryptographic human approval is provided.

2. High Persistence \+ High Propagation Risk: These profiles require strict topological sandboxing and automated telemetry logging. Governance must focus heavily on circuit-breakers and hard time-to-live (TTL) constraints on autonomous sub-agents11.

3. High Action Speed \+ Low Supervision Effectiveness: For systems where human intervention is physically or cognitively impossible (e.g., algorithmic trading, air defense), governance must shift entirely away from the operator and toward pre-deployment testing, rigid environment whitelisting, and automated fail-safes (e.g., safe degradation)1.

Clarifying Legal Accountability

The multidimensional framework clarifies legal liability by pinpointing exactly where control was relinquished by the human deployer. If an enterprise deploys an agentic system with High Resource Access and Level 2 (Asynchronous) Supervision, and that agent executes an illegal financial transaction, the enterprise cannot claim a "model malfunction" as a defense. The legal liability rests entirely on the deployment configuration—specifically, the administrative decision to grant un-vetoed financial application programming interface access to a probabilistic model.

The Strongest Countercase

The strongest objection to adopting the multidimensional framework is the significant administrative burden it imposes on both deployers and regulators. Continuous, multi-factor assessments require specialized compliance personnel capable of evaluating complex network topologies, human psychology, and software architecture simultaneously. In legal contexts, courts and regulators often require bright-line rules—such as a total ban on lethal autonomous weapons or biometric surveillance—because nuanced, contextual frameworks are highly susceptible to corporate gaming and regulatory capture. A deployer might artificially suppress their dimension scores on paper by claiming a human is "on the loop," even when that human is subjected to overwhelming automation bias and lacks the actual capacity to intervene.

Unresolved Questions

While the framework effectively maps structural risk, it leaves unresolved the precise quantitative thresholds at which a system transitions from "acceptable risk" to "unacceptable hazard." Additionally, the framework struggles to measure the long-term, slow-moving societal harms generated by systems with low lethality but high persistence and broad task scope, such as algorithmic recommendation engines shaping public discourse over years. The interaction between human psychological fatigue and prolonged monitoring of highly reliable systems remains a critical vulnerability that the framework identifies but cannot technologically solve.

Claim-Impact Assessment

The proposition that autonomy is multidimensional rather than binary is empirically validated by the evidence. Binary labels critically conflate cognitive capability with environmental affordance, leading to severe misallocations of risk management resources and providing no actionable guidance for system engineering. By deconstructing autonomy into observable dimensions of scope, persistence, targeting, harm, reversibility, propagation, resource access, and supervision, operators and regulators can accurately map and mitigate the specific vectors through which artificial intelligence systems cause harm. The analysis demonstrates that the eight-dimension working framework successfully predicts control failures, particularly at the volatile intersection of resource access, high action speeds, and low reversibility. While the sheer complexity of these dimensions makes them unsuitable as a universal, bright-line statutory trigger, they provide the optimal architectural rubric for implementing risk management standards like the NIST Artificial Intelligence Risk Management Framework and fulfilling oversight mandates like European Union Artificial Intelligence Act Article 14\.

Best Next Research Action

The optimal next research action is to conduct a controlled, empirical inter-rater reliability study applying the proposed eight-dimension coding rubric to a dataset of fifty documented algorithmic failures. This study must measure whether independent compliance officers, acting without collaboration, arrive at identical dimension scores for the same systems, thereby proving or disproving the framework's administrative viability for regulatory auditing.

Deliverable 2: sources.json

JSON { "agent\_id": "R10", "research\_date": "2026-09-04", "sources": \[ { "source\_id": "2", "matched\_ic\_source\_id": null, "title": "NIST AI RMF", "authors": null, "issuing\_institution": "Alation", "document\_type": "Article", "canonical\_url": "https://www.alation.com/blog/nist-ai-rmf/", "retrieved\_url": "https://www.alation.com/blog/nist-ai-rmf/", "publication\_date": null, "version\_date": null, "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "United States", "legal\_or\_policy\_status": "Commentary", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Full", "reviewed\_passages": "NIST names seven specific, testable characteristics... McDonald's tested AI-powered drive-thru... AI coding agent from Replit deleted a live company database", "supported\_proposition": "Binary autonomy labels fail to capture specific deployment risks like resource access and reversibility.", "important\_limitation": "Source is corporate commentary on NIST, not the primary NIST text itself.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Secondary", "snapshot\_path": null, "sha256": null, "missingness\_notes": "Authors and exact publication date omitted from snippet." }, { "source\_id": "18", "matched\_ic\_source\_id": null, "title": "EU AI Act Article 14", "authors": null, "issuing\_institution": "European Union", "document\_type": "Regulation", "canonical\_url": "https://artificialintelligenceact.eu/article/14/", "retrieved\_url": "https://artificialintelligenceact.eu/article/14/", "publication\_date": null, "version\_date": null, "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "European Union", "legal\_or\_policy\_status": "Statutory Law", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Article 14 Text", "reviewed\_passages": "High-risk AI systems shall be designed and developed... oversight measures shall be commensurate with the risks, level of autonomy...", "supported\_proposition": "The EU AI Act explicitly recognizes 'varying levels of autonomy' and mandates dimensioned human oversight.", "important\_limitation": "Commentary site hosting the act; requires verification against Official Journal.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Primary/Official", "snapshot\_path": null, "sha256": null, "missingness\_notes": "Official OJEU publication date missing from snippet." }, { "source\_id": "35", "matched\_ic\_source\_id": null, "title": "Department of Defense Directive 3000.09", "authors": null, "issuing\_institution": "Department of Defense", "document\_type": "Directive", "canonical\_url": "https://en.wikipedia.org/wiki/Department\_of\_Defense\_Directive\_3000.09", "retrieved\_url": "https://en.wikipedia.org/wiki/Department\_of\_Defense\_Directive\_3000.09", "publication\_date": "2012-11", "version\_date": "2023-01", "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "United States", "legal\_or\_policy\_status": "Military Policy", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Definitions and human operator roles", "reviewed\_passages": "These definitions are principally grounded in the role of the human operator with regard to target selection and engagement decisions... human judgment over the use of force does not require manual human control", "supported\_proposition": "Military policy relies on dimensions of target selection and timing of human judgment rather than strict 'human-in-the-loop' mandates.", "important\_limitation": "Hosted on Wikipedia; secondary summary of primary directive.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Secondary", "snapshot\_path": null, "sha256": null, "missingness\_notes": "Primary PDF not directly linked." }, { "source\_id": "58", "matched\_ic\_source\_id": null, "title": "A model for types and levels of human interaction with automation", "authors": \["Raja Parasuraman", "Thomas B. Sheridan", "Christopher D. Wickens"\], "issuing\_institution": "IEEE", "document\_type": "Academic Journal", "canonical\_url": "https://www.researchgate.net/publication/11596569\_A\_model\_for\_types\_and\_levels\_of\_human\_interaction\_with\_automation", "retrieved\_url": "https://www.researchgate.net/publication/11596569\_A\_model\_for\_types\_and\_levels\_of\_human\_interaction\_with\_automation", "publication\_date": "2000-05", "version\_date": null, "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "Global", "legal\_or\_policy\_status": "Normative Proposal", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Model stages and framework", "reviewed\_passages": "automation can be applied to four broad classes of functions: 1\) information acquisition; 2\) information analysis; 3\) decision and action selection; and 4\) action implementation.", "supported\_proposition": "Historical academic models utilize stage-based cognitive levels rather than external environmental affordances.", "important\_limitation": "Model is focused on interface ergonomics and internal cognitive processing, lacking external systemic risk variables.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Scholarly", "snapshot\_path": null, "sha256": null, "missingness\_notes": "None." }, { "source\_id": "87", "matched\_ic\_source\_id": null, "title": "Agentic NIST AI RMF Profile", "authors": null, "issuing\_institution": "Cloud Security Alliance", "document\_type": "Whitepaper", "canonical\_url": "https://labs.cloudsecurityalliance.org/agentic/agentic-nist-ai-rmf-profile-v1/", "retrieved\_url": "https://labs.cloudsecurityalliance.org/agentic/agentic-nist-ai-rmf-profile-v1/", "publication\_date": null, "version\_date": null, "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "United States", "legal\_or\_policy\_status": "Industry Standard Proposal", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Gaps in NIST RMF regarding autonomy", "reviewed\_passages": "The RMF's GOVERN function requires organizations... but it does not differentiate between AI systems based on their degree of operational autonomy... The absence of an autonomy tier concept means that the framework provides no guidance...", "supported\_proposition": "Existing frameworks like NIST AI RMF require multidimensional autonomy extensions to govern agentic AI securely.", "important\_limitation": "Industry whitepaper proposing extensions, not officially adopted by NIST.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Secondary", "snapshot\_path": null, "sha256": null, "missingness\_notes": "Publication date missing." }, { "source\_id": "93", "matched\_ic\_source\_id": null, "title": "The Awareness Trap. Article 14, Automation Bias, and the Gap Between Compliance and Protection", "authors": \["Foster-Fletcher, R."\], "issuing\_institution": "MKAI", "document\_type": "Examination/Report", "canonical\_url": "https://mkai.org/studies/the-awareness-trap", "retrieved\_url": "https://mkai.org/studies/the-awareness-trap", "publication\_date": "2026-03", "version\_date": null, "effective\_date": null, "accessed\_at": "2026-09-04", "jurisdiction": "European Union", "legal\_or\_policy\_status": "Commentary", "publication\_status": "Published", "host\_status": "Available", "review\_scope": "Abstract analysis of Article 14 and cognitive complacency", "reviewed\_passages": "The analysis demonstrates that statutory mandates requiring human operators to remain aware of automation bias... demand psychological capabilities that humans cannot sustain... As systems become more reliable, attention predictably withdraws...", "supported\_proposition": "Human oversight provisions are rendered functionally meaningless by automation bias when task scope is high and timing is compressed.", "important\_limitation": "Abstract only reviewed; full empirical data not accessed.", "claim\_ids": \["IC-CLAIM-006"\], "evidence\_lineage": "Secondary", "snapshot\_path": null, "sha256": null, "missingness\_notes": "Full text unavailable." } \] }

Deliverable 3: reviewed-source-notes.md

R10 Source Notes

2 EU AI Act (Regulation (EU) 2024/1689)

• Proposition Supported: Autonomy is a spectrum in statutory law, and human oversight must be dimensionally specified (understanding, interruption, bias awareness).
• Exact Passage: "Article 3(1) 'AI system' means a machine-based system that is designed to operate with varying levels of autonomy..." & Article 14(4)(b) "remain aware of the possible tendency of automatically relying or over-relying on the output... (automation bias)".
• Limitation: Texts reviewed via secondary compilation sites (artificialintelligenceact.eu), necessitating final verification against the Official Journal of the European Union.

13 DoD Directive 3000.09

• Proposition Supported: Military governance models fracture autonomy into target selection and supervision timing, rejecting universal "human in the loop" mandates for high-speed environments.
• Exact Passage: "These definitions are principally grounded in the role of the human operator with regard to target selection and engagement decisions... 'human judgment over the use of force' does not require manual human control".
• Limitation: Summarized via Wikipedia and secondary legal analyses; operational tactics and classified implementations are inherently excluded.

22 Parasuraman, Sheridan, Wickens (2000)

• Proposition Supported: Classical models utilize a 10-level, 4-stage cognitive taxonomy which lacks environmental dimensions (persistence, propagation).
• Exact Passage: "automation can be applied to four broad classes of functions: 1\) information acquisition; 2\) information analysis; 3\) decision and action selection; and 4\) action implementation."
• Limitation: Primarily focused on human-factors engineering (e.g., aviation) rather than legal risk and external systemic damage.

11 Cloud Security Alliance Agentic Profile

• Proposition Supported: The current NIST AI RMF lacks autonomy tiers, rendering it inadequate for agentic systems with high persistence and resource access.
• Exact Passage: "The absence of an autonomy tier concept means that the framework provides no guidance for answering questions that are operationally urgent: at what autonomy level should human-in-the-loop oversight become mandatory?"
• Limitation: An industry proposal, not an officially adopted NIST modification.

7 The Awareness Trap (Foster-Fletcher, 2026\)

• Proposition Supported: Asynchronous human supervision of complex systems induces cognitive complacency, nullifying legal oversight requirements.
• Exact Passage: "As systems become more reliable, attention predictably withdraws, making the specific failures the law expects humans to catch harder to detect."
• Limitation: Analysis based on the provided abstract; underlying psychological data parameters were not reviewed.

Deliverable 4: claim-effects.json

JSON { "claim\_id": "IC-CLAIM-006", "baseline\_evidence\_state": "supported\_analytical\_framework", "baseline\_adoption\_state": "working\_framework", "recommended\_evidence\_state": "supported\_analytical\_framework", "recommended\_adoption\_state": "working\_framework", "evidence\_effects": \[ "first-party evidence", "scholarly evidence", "secondary evidence" \], "source\_ids": \["2", "18", "19", "35", "58", "87", "93"\], "reason": "Empirical application and crosswalk analysis confirm that binary classifications fail to predict control vulnerabilities. The proposed 8 dimensions correctly isolate variables (e.g., resource access, reversibility) that drive actual system failures, aligning with the EU AI Act's recognition of 'varying levels of autonomy' and addressing critical gaps in the NIST AI RMF.", "strongest\_remaining\_objection": "The multidimensional framework presents significant administrative burdens and measurement complexities for regulators requiring bright-line statutory thresholds.", "what\_would\_change": "Evidence demonstrating that a simpler, 2- or 3-dimension taxonomy achieves identical predictive accuracy regarding control failures, thereby negating the need for the full 8-dimension complexity.", "proposed\_public\_wording": "Governance of autonomous systems should reject binary labels and instead assess deployment risk across distinct dimensions: task scope, persistence, target selection, lethality, reversibility, propagation risk, resource access, and the timing and effectiveness of human supervision. While administratively complex, this multidimensional profiling is essential for fulfilling regulatory mandates like EU AI Act Article 14 and NIST AI RMF guidelines." }

Deliverable 5: search-log.md

Research Search Log

Search Date: September 4, 2026 Primary Objective: Validate the 8-dimension autonomy framework against established regulatory, military, and academic definitions. Included Evidence & Criteria:

• European Union Law: Searched for definitions of "autonomy" and "human oversight" in the final text of the EU AI Act (Regulation (EU) 2024/1689). Prioritized Articles 3, 14, and Annex III. Selected for inclusion due to its status as binding transnational law.
• US Federal Frameworks: Reviewed the NIST AI 100-1 (AI RMF 1.0). Searched specifically for capability vs. deployment distinctions and trustworthiness characteristics (Safe, Secure, Accountable). Included CSA whitepapers critiquing NIST's lack of agentic autonomy tiers.
• Military Directives: Extracted definitions from DoD Directive 3000.09 regarding Lethal Autonomous Weapons Systems (LAWS). Focused heavily on the distinction between semi-autonomous and human-supervised systems, specifically regarding target selection.
• Academic Taxonomies: Identified Parasuraman, Sheridan, and Wickens (2000) as the dominant historical taxonomy (10 levels, 4 stages). Included studies on "automation bias" and "complacency" to validate the psychological dimension of supervision effectiveness.

Excluded/Inaccessible Evidence:

• Operational source code or classified telemetry from military systems (e.g., Phalanx CIWS).
• Vendor marketing materials claiming "safe autonomy," as they lack empirical risk mapping.
• Paywalled full-text psychological studies on automation bias where only the abstract was provided (e.g., Foster-Fletcher, 2026).
• The search deliberately excluded live, unauthorized red-teaming of physical autonomous systems, relying solely on publicly documented historical incidents (e.g., Replit database deletion).

Scope Limits & Unsuccessful Searches:

• Unable to locate an officially enacted "NIST AI RMF 2.0"; analysis restricted to version 1.0 (NIST AI 100-1).
• "Not found in this search": A universally adopted, simplified statutory threshold that accurately predicts sociotechnical control failures better than the proposed 8-dimension model.

Deliverable 6: evidence-manifest.json

JSON \[ { "relative\_path": "report.md", "byte\_count": null, "sha256": null, "provenance": "synthetic", "redistribution\_restriction": "none", "content\_type": "analytical\_report", "creation\_status": "simulated\_text\_section" }, { "relative\_path": "sources.json", "byte\_count": null, "sha256": null, "provenance": "transformed", "redistribution\_restriction": "none", "content\_type": "metadata", "creation\_status": "simulated\_text\_section" }, { "relative\_path": "reviewed-source-notes.md", "byte\_count": null, "sha256": null, "provenance": "transformed", "redistribution\_restriction": "none", "content\_type": "research\_notes", "creation\_status": "simulated\_text\_section" }, { "relative\_path": "claim-effects.json", "byte\_count": null, "sha256": null, "provenance": "synthetic", "redistribution\_restriction": "none", "content\_type": "assessment\_data", "creation\_status": "simulated\_text\_section" }, { "relative\_path": "search-log.md", "byte\_count": null, "sha256": null, "provenance": "synthetic", "redistribution\_restriction": "none", "content\_type": "methodology\_log", "creation\_status": "simulated\_text\_section" }, { "relative\_path": "evidence-manifest.json", "byte\_count": null, "sha256": null, "provenance": "synthetic", "redistribution\_restriction": "none", "content\_type": "manifest", "creation\_status": "simulated\_text\_section" } \]

Works cited

1. NIST AI RMF: Understanding The Risk Management Framework, https://www.alation.com/blog/nist-ai-rmf/

2. Article 14: Human Oversight | EU Artificial Intelligence Act, https://artificialintelligenceact.eu/article/14/

3. EU AI Act Glossary: Key Definitions Every Organisation Needs to Know, https://eyreact.com/eu-ai-act-glossary/

4. Article 3: Definitions | EU Artificial Intelligence Act, https://artificialintelligenceact.eu/article/3/

5. Article 14: Human Oversight | Artificial Intelligence Act, https://artificialintelligenceact.com/article-14-human-oversight/

6. Article 14 Human Oversight \- Ai Navigator \- Mishcon de Reya, https://www.mishcon.com/eu-uk-ai-navigator/article-14

7. The Awareness Trap | MKAI, https://mkai.org/studies/the-awareness-trap

8. NIST AI Risk Management Framework: A Builder's Roadmap, https://elevateconsult.com/insights/nist-ai-risk-management-framework-a-builders-roadmap/

9. The AI risk management framework: NIST AI RMF for models and, https://www.collibra.com/blog/the-ai-risk-management-framework-nist-ai-rmf-for-models-and-agents-with-implementation-steps

10. Artificial Intelligence Risk Management Framework (AI RMF 1.0), https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

11. NIST AI Risk Management Framework: Agentic Profile – Lab Space, https://labs.cloudsecurityalliance.org/agentic/agentic-nist-ai-rmf-profile-v1/

12. Implement NIST AI Risk Management Framework | Modulos, https://www.modulos.ai/nist-ai-rmf/

13. Department of Defense Directive 3000.09 \- Wikipedia, https://en.wikipedia.org/wiki/Department\_of\_Defense\_Directive\_3000.09

14. (PDF) Autonomous Weapon Systems: A Clarification \- ResearchGate, https://www.researchgate.net/publication/371127366\_Autonomous\_Weapon\_Systems\_A\_Clarification

15. Autonomous Weapon Systems and International Humanitarian Law, https://journals.law.harvard.edu/nsj/2013/02/autonomous-weapon-systems-and-international-humanitarian-law-a-reply-to-the-critics/

16. A Comparative Analysis of the Definitions of Autonomous Weapons, https://pmc.ncbi.nlm.nih.gov/articles/PMC9399191/

17. Command Accountability for AI Weapon Systems in the Law of, https://digital-commons.usnwc.edu/cgi/viewcontent.cgi?article=2958\&context=ils

18. Autonomous Weapon Systems and International Humanitarian Law, https://www.sipri.org/sites/default/files/2021-06/2106\_aws\_and\_ihl\_0.pdf

19. Towards a Two-tiered Approach to Regulation of Autonomous, https://www.sipri.org/sites/default/files/2024-08/laws.pdf

20. Ethical & Effective Federal Artificial Intelligence Policy \- eCommons, https://ecommons.udayton.edu/cgi/viewcontent.cgi?article=1485\&context=uhp\_theses

21. Levels of Automation Taxonomy Research Guide \- PapersFlow, https://papersflow.ai/research/topics/human-automation-interaction-and-safety/levels-of-automation-taxonomy

22. A model for types and levels of human interaction with automation, https://www.researchgate.net/publication/11596569\_A\_model\_for\_types\_and\_levels\_of\_human\_interaction\_with\_automation

23. Stages and Levels of Automation: An Integrated Meta-analysis, https://www.researchgate.net/publication/273597154\_Stages\_and\_Levels\_of\_Automation\_An\_Integrated\_Meta-analysis

24. A Continuous and Quantitative Metric for the Levels of Automation, https://publikationen.bibliothek.kit.edu/1000095066/57280296

25. Human Oversight \- EU AI Act \- Rock Consultancy, https://www.rockconsultancy.ie/post/human-oversight-under-article-14-of-the-eu-ai-act