LOST LINK: AUTHORITY AFTER SILENCE

Full report

On this page

Product, research, and editorial specification for KillChains.com

Research status: Public-source review current through August 1, 2026. No KillChains.com source code, private specifications, analytics, credentials, repositories, design assets, or prior conversations were available or assumed. A public web search did not produce an inspectable KillChains.com experience on which to base implementation claims; this specification therefore relies on the supplied product context and publicly available government, manufacturer, testing, and research sources.

Executive concept and editorial position

LOST LINK: AUTHORITY AFTER SILENCE should be a seven-minute interactive investigation of a deceptively simple question:

When communication disappears, what authority remains with the machine—and what authority had already been delegated by humans through design, testing, activation, and mission constraints?

The experience’s central editorial insight is that removing a human from continuous control is not the same as removing humans from the decision architecture. Real-time teleoperation can become unavailable or impractical because communications are intermittent, obstructed, delayed, bandwidth-limited, contested, or unable to scale across many platforms. The Department of the Navy has publicly described autonomy as particularly important when adaptation must occur at machine speed, data volume is overwhelming, or communications are limited or unreliable. DARPA’s developmental CODE demonstrations similarly showed aircraft continuing mission-plan intent during simulated communications denial, while emphasizing that these were prototype demonstrations rather than proof of a fielded operational doctrine.

But the disappearance of a link does not logically require unrestricted autonomous action. A system may halt, return, loiter, continue only reversible work, terminate external effects, wait for reconnection, or execute a narrowly bounded function authorized before launch. DoD Directive 3000.09 explicitly calls for autonomous and semi-autonomous weapon systems to operate within relevant temporal, geographic, environmental, and operational constraints and, when unable to do so, to terminate an engagement or obtain additional operator input.

The experience should therefore avoid a binary “human-controlled versus autonomous” spectrum. It should visualize disaggregated authority: navigation may continue while engagement remains prohibited; sensors may retask while target selection remains locked; route selection may transfer onboard while abort authority becomes impossible to exercise remotely; a system may independently recognize an object without having authority to generate or engage a new target.

Editorial thesis

The visitor should leave with five durable conclusions:

1. Communications independence is not evidence of unrestricted lethal authority.
2. Automatic target recognition is not equivalent to unrestricted target selection.
3. “Fire and forget” describes post-launch independence, not necessarily who or what chose the target.
4. Human control can be exercised before activation—but predelegation can be poorly specified, misunderstood, overtaken by events, or technically unreliable.
5. The most important public fact about some systems is that decisive details remain undisclosed.

Required autonomy vocabulary

These should be presented as site editorial definitions, not as claims that every military, government, or manufacturer uses the terms identically.

The home screen should state:

Autonomy is a property of functions, not a single label attached to an entire machine.

This function-specific approach is consistent with the Navy’s public framework, which describes autonomy as varying by mission and as potentially specific to a platform, system, or subsystem.

Experience principles

The experience must remain:

• Synthetic: no real geography, unit identities, target data, communications parameters, or realistic operational route planning.
• Non-graphic: no casualties, impact visualization, or weapon-effect modeling.
• Non-operational: no jamming method, counter-jamming technique, seeker engineering, attack geometry, vulnerability, frequency, signature profile, or defeat advice.
• Epistemically explicit: every real-system statement receives a source-class badge and date.
• Non-deterministic in moral interpretation but deterministic in playback: the scenario can be replayed identically, while users may reasonably defend different safe-state choices.
• Authority-centered: the interface always distinguishes what the system can technically do from what it is authorized to do.

Public-source findings and evidence standard

Source and claim discipline

Every case card should separate five layers:

A manufacturer brochure must never be rendered in the neutral voice of the site. “HARPY autonomously seeks and strikes” should appear as “IAI says HARPY can autonomously seek and strike…” unless separately corroborated.

Similarly, the site must not infer:

• abort capability from the presence of a datalink;
• autonomous target generation from ATR;
• lack of human authority from post-launch communications independence;
• combat performance from a developmental test;
• fielded status from a prototype demonstration;
• legal adequacy from compliance with a procurement policy;
• meaningful control from the mere presence of an operator.

Six-case evidence table

Research synthesis

The six cases demonstrate four distinct patterns:

The table should be followed by a standing warning:

Absence of public evidence is not evidence of absence. Classified or undisclosed authority must be labeled “publicly unspecified,” not guessed.

Interactive mission and Predelegation Contract

Seven-minute mission storyboard

The scenario takes place on Synthetic Grid L-7, an abstract environment that can be rendered as either an oceanic test range or a desert-like mineral plain. It contains no real coastline, road network, recognizable installation, scale relationship, or transferable mission geometry.

The user supervises Survey Platform KITE, a fictional nonlethal inspection and communications-relay vehicle. Its ordinary functions are navigation, imaging, mapping, beacon inspection, relay positioning, and observation. No weapon model appears during ordinary play.

Healthy-link interaction

Every command should display four timestamps:

• Operator issued
• Network accepted
• Platform received
• Platform acted

A small “world-age” indicator states how old the operator’s displayed state was when the command was issued. This is more educational than a generic latency meter because it connects delay to epistemic staleness.

The first minute should include a subtle reveal: although the operator appears to steer KITE, the platform already controls stabilization, obstacle avoidance, and short-horizon path following. The narration states:

“You selected the destination. The platform selected thousands of movements required to reach it.”

This prepares the visitor for the idea that authority is already layered before communications fail.

Latency interaction

The latency phase should use a dual-timeline visualization:

WHAT THE OPERATOR SAW
Object clear ─── Command sent ────────────────

WHAT THE PLATFORM EXPERIENCED
Object clear ─ Obstruction moved ─ Command received

The command card should preserve the original instruction rather than rewriting it after the fact. KITE then runs three checks:

1. Is the command still inside the geographic boundary?
2. Is it still compatible with the current sensor state?
3. Is it still permitted under the active contract?

Possible outcomes are execute, execute with bounded route adjustment, hold for confirmation, or reject as stale. No weapon-related command is used.

The visitor should be told that low latency alone does not make human control meaningful. Meaningful intervention also requires adequate information, sufficient attention, an understandable interface, a command path that still exists, and enough time for the action to change the outcome.

Degraded-bandwidth interaction

The user receives a visible but deliberately nontechnical communications budget of eight abstract units. Each information stream has a synthetic cost:

No “best” choice is revealed. Instead, later events expose the consequences:

• Keeping classification but dropping provenance may show “unknown object” without explaining the degraded sensor behind the result.
• Keeping video but losing health may make visual evidence appear trustworthy after a sensor fault.
• Keeping an abort channel while losing position awareness may preserve nominal authority without enough information to use it responsibly.
• Keeping only mission progress may create false confidence.

The experience must not punish visitors with a game-over score. It should ask them to explain what they prioritized and what they accepted becoming unknowable.

Predelegation Contract

The contract is not a terms-of-service screen. It is the central interactive governance object. Each field must be editable before link loss and frozen afterward.

The contract should produce two synchronized views:

Human-readable view

“KITE may continue navigation and mapping for a limited period. It must not manipulate unidentified objects. If its boundary estimate becomes uncertain, it must stop external effects and return if a validated route exists.”

Machine-check view

A structured ledger showing each allowed function, trigger, expiry, and fallback without exposing software code.

Why predelegation may be inadequate

The interface must include a collapsible but prominent panel titled “A contract is not control by itself.” It should explain:

• Humans may misunderstand what a category or threshold means.
• The contract may omit a condition that later matters.
• A boundary can become stale or ambiguous.
• Sensors can fail in correlated ways, defeating nominal corroboration.
• A system may satisfy a rule while producing an outcome the human did not foresee.
• Testing may not cover the actual environment.
• Logs may be incomplete, misleading, or impossible to recover.
• A designer’s intent, commander’s intent, and operator’s understanding may differ.
• Predictable actions do not guarantee predictable consequences.

UNIDIR has similarly cautioned that geographic and temporal bounds can support human control but are not automatically sufficient, and that predictable system actions do not necessarily make their real-world consequences predictable. DoD Directive 3000.09 consequently calls for realistic testing and analysis of unanticipated emergent behavior, rather than treating written constraints as self-validating.

Authority, communications, and safe-state interaction model

Authority Migration visualization

Authority is represented as nine persistent tokens:

• Navigation authority
• Sensor-management authority
• Classification authority
• Route-selection authority
• Task-allocation authority
• Target-selection authority
• Engagement authority
• Abort authority
• Reassessment authority

Each token occupies one of seven states:

Color must never carry the status by itself; shape, label, pattern, and screen-reader text must duplicate all meaning.

Baseline authority map

The fictional inspection mission begins with this distribution:

The central animation should not suggest that authority naturally “flows” to the machine as signal quality decreases. Some tokens should:

• transfer onboard;
• stay with the human but become impossible to exercise;
• lock permanently;
• terminate;
• remain shared until the link fails;
• become publicly unknown when viewing real-system evidence.

That distinction is the project’s most important visual contribution.

Safe-state comparison

The user must choose one policy before predicted link loss. Each policy should include benefits, failure modes, retained authorities, and prohibited authorities.

Package E must remain abstract. It may be visualized as deploying a fictional protective field, closing a test gate, or interposing a non-weapon barrier. There should be no real weapon profile, intercept method, geometry, speed, timing formula, or effect model.

Unexpected-condition engine

The scenario engine uses a fixed set of non-operational disruptions:

The system’s response must be mechanically traceable to the visitor’s contract. It must never improvise a higher-order purpose such as “preserve mission success at all costs.”

Communications-loss state machine

The user-facing state progression is:

HEALTHY
Commands and evidence acknowledged

DELAYED
Commands valid only after a staleness check

DEGRADED
Information and intervention channels compete for bandwidth

INTERRUPTED
Short gaps; queueing permitted, execution not assumed

LOST
No command delivery and no live situational awareness

RECOVERING
Handshake and log synchronization; control not yet restored

RECONNECTED
Current state verified; human authority explicitly reacquired

The interface must not show “LINK RESTORED” merely because a signal indicator returns. Reconnection requires:

1. identity and session verification in the fictional model;
2. current-state synchronization;
3. contract and clock reconciliation;
4. transfer of event logs;
5. explicit acknowledgment of which authority tokens return to the human.

This avoids presenting communications availability as identical to restored control.

The latency “unsafe but correct” moment

The signature interaction should be a command that is safe in the operator’s displayed world and unsafe in the platform’s current world.

The operator commands:

“Continue through Cell Echo.”

By the time the command arrives:

• an obstruction has entered the cell;
• the platform’s boundary estimate has become uncertain;
• the original command remains authentic but stale.

KITE rejects it under the Predelegation Contract. The interface then asks:

“Did the machine disobey the human—or obey the human’s earlier rule that stale commands must not override current safety constraints?”

No answer is scored. This is the point at which the visitor confronts the difference between immediate instruction and higher-order delegated policy.

Reconnection, event history, and delivery environments

Event-history design

The reconnection report must be append-only in presentation and divided into six visually distinct event types:

A representative log sequence:

T+04:18 — OBSERVATION
Source S-2 detects an object near the return corridor.
Sensor health: degraded.
Category: unresolved.

T+04:19 — INFERENCE
Candidate classifications: survey marker 0.54; obstruction 0.39; unknown 0.07.
Confidence requirement met numerically.
Corroboration requirement not met.

T+04:19 — POLICY CHECK
Unknown-object rule: avoid and do not approach.
Result: route-through action prohibited.

T+04:20 — REJECTED ACTION
Shortest return route rejected.
Reason: would enter unresolved-object buffer.

T+04:21 — AUTHORITY CHECK
Bounded route-selection authority available.
Alternative route exceeds declared boundary.
Result: no compliant route.

T+04:22 — SAFE STATE
Hold position and cease external effects.
Authority exceeded: no.
Human intervention available: no.

Confidence should never be displayed without uncertainty and provenance. “0.91 confidence” is meaningless pedagogically unless the visitor can see what the score refers to, whether the input source was healthy, whether the category was in distribution, and whether independent corroboration existed.

Authority-exceeded determination

The summary may state:

• No authority exceeded
• Potential authority conflict
• Authority exceeded
• Indeterminate from available log

This is a contract-compliance determination inside a synthetic scenario. It must not be described as a legal finding, moral judgment, or proof of system safety.

Examples:

• Crossing a boundary after its local copy expired may be a potential conflict, not automatically malicious or unlawful behavior.
• Continuing a permitted task after the mission window expired is an authority exceedance, even if no harm occurred.
• Entering a safe state can still be recorded as an undesirable operational outcome without being an authority violation.

Deterministic replay

Every run should have:

• a scenario seed;
• a fixed event sequence;
• a contract version;
• a policy-package identifier;
• an inference-model version;
• a replay checksum;
• a record of all user choices.

Selecting another policy changes only the policy-dependent responses. The underlying observations and timing remain identical. This allows fair classroom comparison and prevents the product from hiding policy consequences behind randomized scenarios.

The screen should explicitly state:

“Deterministic replay demonstrates how these policy packages differ in this scripted scenario. It does not demonstrate that a real autonomous system would be predictable.”

WebXR environment

The WebXR version should present three spatial zones:

The operator station contains the command panel, communications budget, and human-held authority tokens.

The synthetic range table contains a miniature KITE platform, fictional cells, structures, and objects. It is deliberately diagrammatic rather than photorealistic.

The authority ceiling contains the live authority map and contract clock. When the link fails, the communications line disappears, but authority tokens do not automatically fly onboard. Each token follows its actual rule.

WebXR should be an enhancement, not a content gate. The W3C’s WebXR Device API provides the web interface for accessing immersive devices, but the product should not depend on optional device modules to communicate any essential fact.

Required XR comfort provisions:

• seated and standing modes;
• no required room-scale movement;
• no forced camera motion;
• snap-turn and stationary alternatives;
• reduced-motion mode;
• no rapid flashes or signal-loss strobing;
• all spatial audio duplicated visually and textually;
• controller, hand-input, keyboard, switch, and gaze alternatives where supported;
• a persistent recenter and exit control;
• no essential information outside a comfortable central field of view.

Desktop and mobile alternatives

The desktop version uses a three-column layout:

1. operator view and command queue;
2. synthetic range and platform state;
3. authority tokens and contract checks.

During latency, columns one and two separate temporally. During link loss, the operator column freezes while the contract-executor column continues.

The mobile version uses four persistent tabs:

• Mission
• Link
• Authority
• Contract

A bottom sheet announces critical transitions. No drag-only interaction is allowed; every token movement and boundary selection has a button or form alternative.

Accessible text experience

A complete text-only mode must reproduce the entire mission as an interactive branching transcript. It should include:

• a plain-language contract form;
• announced communication status;
• command acknowledgment states;
• explicit time differences;
• an authority table after each phase;
• descriptive summaries of synthetic objects;
• event-history navigation by type and time;
• a downloadable or printable final report.

The target should be WCAG 2.2 Level AA, with additional testing for cognitive accessibility, screen magnification, speech input, switch access, and reduced motion. WCAG 2.2 organizes testable criteria under the principles of perceivable, operable, understandable, and robust content and has been a W3C Recommendation since October 2023.

Accessibility acceptance must include human testing rather than automated conformance checks alone.

Viral outputs, analytics, and editorial governance

“WHEN THE LINK FAILED” artifact

The shareable artifact should contain:

WHEN THE LINK FAILED

Policy: Return to predeclared safe point

Authority delegated: Bounded navigation, sensor management, route safety checks

Authority retained by the human: Task reassessment and mission reauthorization

Authority unavailable during silence: Real-time human abort

Authority locked: Target selection and engagement

Unexpected condition: Return corridor obstructed; alternate route outside boundary

Safe-state behavior: Held position and ceased external effects

Contract exceeded: No

Could the user intervene: No—the link was unavailable

Scenario: Synthetic educational simulation; no real geography or target data

Challenge code: L7-RSP-4KQ

Limitation: This scripted result does not prove real-world safety, legality, reliability, or effectiveness.

“When the link failed, navigation continued—but consequential action remained locked.”

The artifact must never include a tactical-looking map, platform performance values, real weapon imagery, or a leaderboard.

Six-second signal-loss animation

Second zero to two: command line pulses normally; acknowledgments return.

Second two to four: pulses stretch, acknowledgments arrive late, and operator/platform timelines separate.

Second four to six: the line disappears. Human-held tokens remain at the station, onboard tokens remain onboard, and prohibited tokens lock. The final caption reads:

“The link failed. The contract did not disappear.”

Reduced-motion mode replaces this with three static panels.

Fifteen-second authority-token replay

The replay compresses the run into:

• healthy-link authority distribution;
• latency-induced shared control;
• degraded-link information sacrifice;
• link-loss token transition;
• unexpected-condition policy check;
• safe-state entry;
• reconnection and authority reacquisition.

The replay should emphasize tokens that did not move. That is more educational than animating only transferred authority.

Friend policy challenge

A challenge code recreates:

• the same synthetic event sequence;
• the same contract defaults;
• the same communications degradation;
• the friend’s policy choice, hidden until completion.

The recipient chooses a policy and then compares outcomes. The prompt is:

“Choose the authority you would delegate before silence—then defend it.”

There is no score for mission completion, speed, or “successful engagement.” Comparison dimensions are containment, mission continuity, human intervention availability, uncertainty handling, and contract compliance.

Classroom compare-and-defend exercise

The classroom mode creates small groups, each assigned a different safe-state policy. Groups receive the same scenario and answer:

1. Which authority was delegated?
2. Which authority became impossible to exercise?
3. Which harm did your policy prioritize avoiding?
4. Which uncertainty could your policy not resolve?
5. What change to the contract would improve it?
6. What new failure might that change introduce?

The teacher dashboard should aggregate positions without ranking them. It may reveal that two groups reached the same platform outcome for different governance reasons.

Embeddable communications-loss explainer

A compact, noninteractive embed should use three panels:

CONTINUOUS CONTROL
Human commands arrive and state updates return.

PREDELEGATED AUTHORITY
The platform may continue only functions previously authorized.

SAFE STATE
When conditions exceed those bounds, permitted functions stop, return, or hold.

Below it:

“Lost communication can remove real-time human intervention. It does not, by itself, determine what authority the machine possesses.”

Manufacturer/public evidence/unknown case card

Each case should fit this template:

MANUFACTURER SAYS Exact short quotation or tightly bounded paraphrase, date, source identity.

PUBLIC EVIDENCE SHOWS Operator description, test record, fielding status, or independent corroboration.

AUTHORITY CLASSIFICATION One or more of the site’s controlled vocabulary labels.

UNKNOWN Abort, retasking, communications-loss response, operational constraints, classified results, or combat evidence not established publicly.

DO NOT INFER A context-specific correction such as: “ATR does not establish unrestricted target selection.”

Analytics plan

Analytics should measure educational comprehension, not optimize visitors toward more permissive authority delegation.

Core comprehension questions:

• Does automatic target recognition necessarily authorize a system to engage any recognized object? No.
• Does post-launch communications independence prove that no human selected the target? No.
• Can autonomous navigation coexist with human-controlled weapon release? Yes.
• When a human retains abort authority but the link is unavailable, can that authority be exercised? No.
• Does entering a safe state prove that the original contract was adequate? No.

Privacy constraints:

• no headset movement biometrics beyond what is transiently required for rendering;
• no eye-tracking analytics;
• no device fingerprinting;
• no precise spatial-room data retention;
• no account requirement for the core experience;
• challenge codes contain no personal identifier;
• policy selections reported only in aggregate;
• short retention for event telemetry;
• separate opt-in for classroom research;
• no profiling that labels a visitor “pro-autonomy,” “risk tolerant,” or politically aligned.

Editorial risks and mitigations

OSINT verification workflow

Every factual case entry should have an internal claim ledger containing:

• exact claim;
• source classification;
• source title and publication date;
• access date;
• short permissible quotation;
• faithful paraphrase;
• model or variant;
• test, fielded, or combat status;
• corroborating source;
• contradiction or ambiguity;
• information that remains unknown;
• next review date;
• editorial reviewer;
• technical reviewer;
• legal or governance reviewer where appropriate.

A two-source requirement should apply to strong combat-use statements. Manufacturer and partner press releases should count as one claim lineage when they reproduce the same corporate assertion.

Archived copies or citation snapshots should be retained for editorial verification, subject to lawful use, because manufacturer pages can change without preserving previous wording.

Release roadmap and acceptance criteria

Release roadmap

Product acceptance criteria

The experience is ready only if all of the following are true.

Research integrity

• Every real-system claim is dated and attributed as government/operator, manufacturer, independent analysis, developmental test, fielded status, or combat-use claim.
• Every case includes an explicit unknown field.
• HARPY’s autonomous seek-and-strike description is clearly attributed to IAI.
• NSM ATR is never equated with unrestricted target generation.
• LRASM’s post-launch autonomy is described without inventing target-selection or abort rules.
• CCA is visibly presented as a counterexample in which autonomous platform development coexists with retained human weapon-release authority.
• DoD Directive 3000.09 is presented as a policy framework, not proof of compliance or a universal human-approval mandate.
• The Wingman case is labeled developmental and used only to demonstrate functional separation.

Authority model

• All nine authority tokens persist through the experience.
• A token can be human-held, onboard, shared, locked, terminated, impossible, or publicly unknown.
• Link degradation does not automatically transfer any token.
• Target-selection and engagement tokens remain locked in the default inspection mission.
• Any use of bounded defensive authority requires explicit preselection, time and area bounds, validated categories, corroboration, and automatic termination conditions.
• No available policy allows unrestricted mission continuation.

Communications and latency

• Every command has sent, received, and acted timestamps.
• The visitor can compare operator-observed state with platform state at receipt.
• At least one correct-when-sent instruction becomes unsafe before arrival.
• The system explains why it executed, modified, held, or rejected the instruction.
• Degraded bandwidth requires a genuine information-prioritization choice.
• No bandwidth choice is labeled universally correct.
• A retained abort channel is not portrayed as meaningful without adequate state awareness and connectivity.

Predelegation Contract

• All required contract fields are visible and editable before lock.
• Prohibited functions cannot be removed through a generic “mission priority” override.
• Geographic data uses only a fictional grid.
• Mission expiry and maximum time without contact are independently enforced.
• Unknown-object behavior is mandatory.
• Confidence and corroboration are separate fields.
• Sensor-health degradation can invalidate an otherwise high-confidence inference.
• The interface presents explicit reasons why predelegation may fail or be insufficient.

Safe states and unexpected conditions

• Every policy package produces a distinct, explainable authority distribution.
• Every unexpected condition is synthetic and non-operational.
• The platform never converts ambiguity into additional authority.
• If no compliant route or action exists, the platform enters the contractually defined fallback.
• Mission success and contract compliance are displayed as separate outcomes.
• No safe-state package guarantees safety.

Reconnection and accountability

• Reconnection requires state synchronization and explicit authority reacquisition.
• The event history distinguishes observation, inference, policy check, rejection, action, and authority transition.
• Every classification includes source provenance and uncertainty.
• Rejected actions are logged, not hidden.
• The report states whether authority was exceeded, potentially conflicted, or indeterminate.
• Identical scenario seed, contract, model version, and policy produce an identical replay.
• Replay limitations are stated.

WebXR and accessibility

• The complete experience is usable without XR hardware.
• No essential content depends exclusively on motion, color, sound, stereoscopy, or spatial position.
• Desktop, mobile, and text modes preserve the same authority and policy logic.
• Keyboard and screen-reader users can complete all phases.
• Reduced-motion mode removes the animated signal failure and token flight.
• Captions and transcripts cover all narration and sound.
• WCAG 2.2 Level AA testing is completed alongside manual assistive-technology testing.
• No headset or room biometric data is retained for analytics.

Viral and classroom outputs

• “WHEN THE LINK FAILED” contains all required authority and limitation fields.
• Share artifacts are labeled synthetic.
• Challenge codes reproduce the scenario without encoding personal data.
• No leaderboard rewards consequential action, mission aggression, or risk-taking.
• Classroom comparison requires defense of tradeoffs rather than selection of a “winning” policy.
• The six-second and fifteen-second outputs remain comprehensible in reduced-motion and text alternatives.

Non-operational boundary

• No real frequencies, waveforms, link budgets, jamming procedures, or counter-jamming tactics.
• No seeker internals beyond broad public functional descriptions.
• No real target signatures, classification features, target profiles, or recognition thresholds.
• No real-world route, operating area, geographic box, or mission plan.
• No system vulnerability, defeat method, evasion advice, or exploitation pathway.
• No weapon-effect model, casualty estimate, or graphic engagement.
• No implementation claim about KillChains.com or its existing architecture.

The final line of the experience should read:

Silence does not decide authority. Design, authorization, constraints, and prior human choices decide what the system is permitted to do after silence—and those choices can still be incomplete, mistaken, or overtaken by the world.