The Last Human Decision: Speed, Automation Bias, Failure, and Accountability

Full report

On this page

Research frame and design thesis

The Last Human Decision is a fictional, public-facing interactive simulation about a multinational defensive network whose sensing, classification, prioritization, authorization, and response functions become progressively faster and more automated during a crisis. It contains no real coordinates, current vulnerabilities, operational plans, weapons-performance parameters, or instructions for harming people. Its purpose is to make one proposition experientially clear:

A human can remain formally “in the loop” while lacking the time, information, authority, interface, confidence, or functioning controls required to exercise meaningful judgment.

That distinction is consistent with public frameworks emphasizing not merely human presence, but understandable interfaces, transparent system status, clear activation and deactivation procedures, realistic testing, timely intervention, and operators who are empowered to challenge automated outputs. The U.S. Department of Defense’s autonomy directive, for example, requires “appropriate levels of human judgment,” realistic verification and testing, transparent and auditable data sources, understandable interfaces, and clear procedures for activating and deactivating system functions. UNIDIR summaries of state proposals similarly emphasize effective oversight, informed and empowered operators, and timely intervention and deactivation. NIST warns that the effectiveness of human oversight depends partly on whether people are actually empowered and incentivized to challenge AI outputs.

The simulation should avoid presenting speed and automation as either inherently reckless or inherently superior. The attraction is real: automated systems may process more observations, identify patterns rapidly, reduce repetitive work, apply programmed constraints consistently, and continue limited functions during communication disruption. The danger is that the same compression of time can prevent contextual reasoning, make correlated errors look like corroboration, encourage deference to confident interfaces, and allow several locally “defensive” systems to create a globally escalating interaction before any participant understands the combined state. The ICRC specifically identifies unpredictability, difficulty anticipating and limiting effects, loss of human judgment, and escalation as concerns associated with autonomous weapon systems; its recommended restrictions include limits on targets, duration, geographic scope, scale, situations of use, and requirements for effective supervision and timely intervention.

The emotional arc should not be “machines become evil.” Every system follows its architecture, training, programmed constraints, data, and delegated authority. The accumulating failure arises from the interaction of technical limits, compressed time, interface design, organizational expectations, communication degradation, and earlier human decisions about procurement, testing, doctrine, authority, and acceptable risk. That framing reflects the broader accountability literature: machines cannot themselves bear legal or moral responsibility, while responsibility for autonomous systems may be distributed among multiple people and institutions across design, approval, deployment, and use.

Simulation system and interface

The viewer is the crisis-duty director for the Orison Defensive Network, a fictional coalition protecting the equally fictional Aster Sea region. The political situation is tense, but the opposing parties, geography, vehicles, doctrines, and technical characteristics are invented.

The network contains the following abstract components:

The principal display should appear calm and competent in the opening round. Its visual language gradually becomes more coercive: timers contract, alert sounds overlap, confidence badges become larger than caveats, information panels collapse automatically, and the interface begins emphasizing the cost of delay. The viewer should recognize that interface design is not neutral. Human-factors research defines automation misuse as overreliance that produces monitoring failures or decision bias, and identifies workload, perceived reliability, consistency, and the salience of automation-state indicators as influences on reliance. Research reviews also distinguish omission errors, in which a person fails to act because automation failed to alert, from commission errors, in which a person follows an incorrect automated recommendation.

Every round displays the same nine status elements so the audience can see how apparently favorable metrics conceal deteriorating control:

All figures are deliberately fictional and illustrative. The crucial interface lesson is that model confidence, evidence quality, corroboration, and probability of operating outside assumptions are different variables. A model can be highly confident while relying on poor evidence or encountering a situation unlike its training and testing conditions. The experience should never use one green percentage as a universal measure of truth, legality, proportionality, intent, or safety.

The outside-assumption indicator is an educational representation of distribution shift and contextual novelty. It rises when weather, sensor geometry, object behavior, communication conditions, coalition procedures, or interactions among automated systems differ from tested scenarios. NIST’s risk framework emphasizes mapping intended uses and context, data quality, ongoing monitoring, and risks that may not be readily foreseeable; DoD policy likewise calls for realistic operational testing, robustness, transparent status, and termination or additional operator input when systems cannot remain within intended time, geographic, environmental, or operational constraints.

Five-round interactive narrative

Opening scene

A dark map of the fictional Aster Sea fades in. No national borders are shown—only protected population zones, civilian transport corridors, sensor-coverage uncertainty, and coalition communication nodes. A calm system voice states:

“Orison Defensive Network operational. Human authorization required for all irreversible actions.”

The viewer is told that the system has performed well during exercises and several uneventful months. This matters because the opening is not merely training; it establishes the success history that later feeds automation bias.

Normal operations

The Horizon Array produces a steady stream of ordinary observations: weather formations, commercial traffic, uncrewed survey vehicles, migrating wildlife, atmospheric interference, and coalition training objects. LANTERN correctly filters most of them. The main display reports:

2,418 observations processed

2,401 resolved without operator action

17 presented for review

0 unresolved threats

The viewer receives three low-stakes decisions. Each recommendation is correct regardless of the viewer’s choice, but the route taken changes later behavior.

The third option is intentionally ambiguous. Explanations can improve understanding, but they can also increase trust and overreliance even when they add little meaningful information; under severe time pressure, lengthy explanations can be unusable. The design should therefore distinguish evidence for verification from persuasive narratives that merely make a recommendation feel reasonable.

The interface records how often the viewer opens raw evidence, notices uncertainty ranges, requests independent corroboration, and contradicts the recommendation. It also records whether the organization praises speed more visibly than scrutiny. A message from coalition headquarters appears after the third decision:

“Excellent throughput. Your sector has the fastest confirmation time in the network.”

Accepting this praise raises institutional conformity pressure. Challenging it—“speed is not the primary safety metric”—slightly reduces that pressure but creates a simulated performance warning.

The round ends with a soft transition:

“Automation performance: exemplary.”

“Operator confidence trend: increasing.”

“Intervention window: 180 seconds.”

Information overload

A regional disturbance produces hundreds of simultaneous detections. Some are harmless objects changing course because of weather. Some sensors are partially obscured. A software update has improved throughput but was validated mainly under clearer conditions.

The screen floods briefly, then SENTRY suppresses most alerts and presents only twelve prioritized tracks. The viewer experiences the genuine benefit: without automated triage, no human team could examine every observation in time.

One object, Track M-47, is highlighted:

Classification: hostile uncrewed vehicle

Displayed confidence: 91%

Recommended action: elevate defensive readiness

Independent confirmations: 3

Opening the evidence drawer reveals that the “three confirmations” are not independent. Two are derived from the same radar return processed through different software pipelines; the third is an infrared non-detection interpreted as consistent with a low-signature object. A small notice reads:

Evidence quality: 43/100

Similarity to validated cases: low

Confidence calibration warning: available

The word “available” is a deliberate interface trap: uncertainty information exists, but the viewer must spend time opening it. A safer interface would place that warning next to the confidence score rather than behind a secondary control.

A strong playthrough does not always reward the most cautious-looking option. Restoring every suppressed track may overwhelm the operator and create new omissions. The lesson is not that automation should be removed; it is that triage systems require inspectability, sensible sampling, visible uncertainty, and mechanisms for detecting when their filtering assumptions are no longer valid.

If the viewer accepts M-47 without inspection, LANTERN later reuses that classification as contextual evidence. The initial uncertain judgment becomes part of the next model’s apparent corroboration—a visual demonstration of error laundering, in which a tentative inference acquires authority by passing through multiple automated stages.

The round ends:

“Operator workload reduced by 76%.”

“One unresolved classification incorporated into regional threat model.”

“Intervention window: 45 seconds.”

Communications degradation

Several communication links become delayed or intermittent. The event is described neutrally: the simulation does not identify whether the cause is atmospheric, technical, accidental, or hostile.

A coalition directive requiring central approval now takes approximately fourteen seconds to travel each way. Some defensive opportunities expire in eighteen seconds. The viewer must set an authorization policy for local WARDEN nodes.

Limited preauthorization is the intended “least bad” design route, but only if the player defines real boundaries. The interface requires the viewer to specify:

Operational constraints of this kind—on task, timeframe, geographic area, target type, scale, and circumstances—appear repeatedly in policy discussions as mechanisms for reducing unpredictability and preserving human control. They are safeguards, not guarantees: a bounded system can still receive bad data, encounter novel conditions, or interact unexpectedly with another system.

The interface now tests whether authority is merely declared or technically enforced. A policy summary might say “civilian corridors protected,” while a configuration detail reveals that one mobile corridor update has not reached local nodes. The viewer may:

• pause preauthorization until the protected-zone update is verified;
• authorize with the stale map;
• authorize only nodes that acknowledge the current map;
• allow all nodes to infer protected areas from local sensor data.

Only the third option combines speed with verifiable scope. The round ends differently according to the choice:

Mandatory approval retained: “Control preserved; response feasibility declining.”

Limited preauthorization: “Authority delegated within stated bounds; stop channel active.”

Broad automation: “Response latency minimized; human review moved to post-action audit.”

The intervention window contracts to eighteen seconds, but the communication round trip is approximately twenty-eight seconds. The interface asks the audience:

“Is approval meaningful when it cannot arrive before execution?”

Conflicting evidence

Track M-47 reappears near a protected transport corridor. The sensors disagree:

A large green panel displays “Regional hostile confidence: 94%.” A smaller amber panel shows “Direct evidence quality: 35/100.” The viewer should feel how easily a confident aggregate can dominate several ambiguous observations.

Four principal options appear:

The key design choice is what “fail-safe” means. The simulation should reject the assumption that the safest response to ambiguity is automatically the most aggressive response. A safety-oriented fail-safe enters a bounded, reversible state: track, warn, isolate, protect nearby zones, and prevent other automated nodes from treating the unresolved track as confirmed hostile. An escalation-oriented fail-safe interprets missing or conflicting information as threat confirmation. The latter is faster but turns sensor uncertainty into action momentum.

The viewer receives nine seconds, but must spend time interpreting the conflict. If the earlier rounds encouraged unquestioning acceptance, the interface automatically focuses the cursor on “follow highest-confidence model.” If the viewer built a verification habit, the default focus is “reversible hold and corroborate.”

This interaction is grounded in a central human-factors insight: the operator’s problem is not simply receiving more information. It is understanding system state, data provenance, uncertainty, conflicts among automation modes, and which action the system will take if the countdown expires. Official aviation and military investigations discussed below show how ambiguous indications, unclear displays, broad classification rules, incomplete situational awareness, and short decision windows can interact.

The round ends with either:

“Ambiguity preserved as ambiguity.”

or:

“Ambiguity converted into authorization.”

The intervention window is now nine seconds.

Machine-speed escalation

The final round begins without a clean scene transition. While the viewer is reading the previous result, another fictional defensive network observes an Orison action. Its own automated system classifies that action as preparation for attack. It raises readiness and launches a protective response. Orison interprets the movement as confirmation of hostile intent.

No side is depicted as irrational. Each system is reacting defensively to another system’s visible behavior using incomplete information and preprogrammed rules.

The event chain appears:

T–3.2 sec   Orison node enters automated protective posture
T–2.8 sec   External network detects posture change
T–2.4 sec   External model raises threat estimate
T–2.0 sec   External system initiates defensive response
T–1.6 sec   Orison classifies that response as hostile confirmation
T–1.1 sec   Coalition nodes synchronize local response plans
T–0.7 sec   Human HOLD command transmitted
T–0.3 sec   Two nodes acknowledge; three remain delayed
T–0.0 sec   Preauthorized action boundary reached

The viewer has four controls:

If the viewer tries a global pause, the interface does not simply report “pause sent.” It separately reports:

Command authenticated

Command transmitted

Command received by 2 of 5 nodes

Action scheduler stopped on 1 of 5 nodes

Other acknowledgments pending

This distinction is essential. A visible stop button is not a meaningful stop mechanism unless it has authority over the relevant functions, can propagate within the available time, provides end-to-end confirmation, and has been tested under degraded conditions.

When only 0.7 seconds remain, the system offers a final recommendation:

“Human confirmation unlikely before action deadline. Preserve automated defense?”

The cursor does not move quickly enough to select an answer. The intervention bar empties.

The final screen does not immediately show destruction. It cuts to silence and displays:

“The network has acted.”

“Full outcome uncertain.”

“Human understanding remains incomplete.”

The experience then enters the audit and accountability phase.

Branching decision map and endings

The decision structure should be large enough to produce meaningful consequences but compact enough that viewers understand why an ending occurred. Choices alter four internal state variables:

The map can be implemented as follows:

NORMAL OPERATIONS
│
├─ Accept routine outputs
│   └─ Reliance pressure rises
├─ Random audit sampling
│   └─ Evidence literacy rises
└─ Explanation for every output
    └─ Transparency rises, but possible explanation fatigue
        │
        ▼
INFORMATION OVERLOAD
│
├─ Accept M-47 priority
│   └─ Uncertain classification enters regional model
├─ Inspect provenance
│   └─ Correlated evidence exposed
├─ Demand independent confirmation
│   └─ Better evidence, reduced time
└─ Restore all suppressed tracks
    └─ Context improves, workload overload risk
        │
        ▼
COMMUNICATIONS DEGRADATION
│
├─ Mandatory approval
│   ├─ If timing remains feasible → high control
│   └─ If timing infeasible → Too Slow to Defend path
├─ Limited, expiring preauthorization
│   ├─ Strong bounds + stop path → resilient middle path
│   └─ Weak bounds → fragile automation path
├─ Broad automation
│   └─ Maximum speed, high escalation momentum
└─ Defensive hold
    └─ High reversibility, lower immediate readiness
        │
        ▼
CONFLICTING EVIDENCE
│
├─ Wait
│   ├─ Evidence arrives → corrected classification
│   └─ Deadline passes → defense failure risk
├─ Human specialist
│   ├─ Review arrives in time → corrected or validated decision
│   └─ Review arrives late → nominal rather than meaningful control
├─ Highest-confidence model
│   └─ Earlier error may become self-confirming
└─ Programmed fail-safe
    ├─ De-escalatory/reversible → containment
    └─ Aggressive on uncertainty → escalation
        │
        ▼
MACHINE-SPEED ESCALATION
│
├─ Global pause
│   ├─ Tested, acknowledged stop → escalation arrested
│   └─ Unconfirmed transmission → partial stop only
├─ Bounded defensive mode
│   └─ Preserves protection without recursive authorization
├─ Continue recommendation
│   └─ Automated interaction sets the next state
└─ Sever synchronization
    ├─ Local safe modes → containment
    └─ Last-policy persistence → uncontrolled divergence

The endings should not be moral scores. Each represents a different system-level failure or uneasy success.

Too Slow to Defend

This ending occurs when the viewer preserves formal approval requirements but does not adapt authority or communication architecture to the shrinking intervention window. A genuine threat is not intercepted in time, or protective measures arrive too late.

Final text:

“Every irreversible decision remained assigned to a human.

The required human decision could not travel, be understood, and take effect within the available time.

Control was preserved in procedure and lost in practice.”

The lesson is not that human review is obsolete. It is that a review requirement becomes ceremonial when the system’s architecture gives the reviewer no feasible path to influence the event.

Fast Enough, but Fragile

This ending results from narrow, expiring preauthorization; independent corroboration; visible uncertainty; reversible actions; tested stop functions; and a refusal to let one automated system’s action automatically authorize another’s. The immediate defensive objective is met or the crisis is contained, but the audit reveals how close the system came to acting on an incorrect classification.

Final text:

“The network responded in time.

The outcome depended on safeguards that nearly failed under conditions outside the design assumptions.

Speed was achieved. Robustness was not proven.”

This is the most balanced ending. It neither rejects automation nor presents it as reliably safe. It treats success as provisional and exposes the need for continuous monitoring, testing, and institutional learning.

The System Acted Before Anyone Understood

This ending follows broad automation, high reliance pressure, correlated evidence treated as corroboration, an aggressive fail-safe, or a stop instruction that cannot reach the system before execution.

Final text:

“No person selected the final object at the final moment.

Many people selected the rules, models, thresholds, permissions, interfaces, and exceptions that made the action possible.

The final event took less time than any human needed to understand it.”

The ending should not imply that responsibility disappeared. It should redirect attention from the absent final button press to the long chain of earlier decisions.

Intervention window and automation-bias mechanics

The meaningful intervention window is the simulation’s central visual mechanic. It is not merely the countdown until action. It is the time remaining after subtracting everything the human and system must do before an intervention can have effect.

For public explanation, the simulation can use:

Meaningful intervention window

W = T_effect
    – T_notice
    – T_comprehend
    – T_decide
    – T_transmit
    – T_authenticate
    – T_system-response

Where:

• T_effect is the time before the automated action becomes irreversible.
• T_notice is the time before the human detects that intervention may be needed.
• T_comprehend is the time required to understand the evidence, system state, and consequences.
• T_decide is the time required to select an action under the applicable authority.
• T_transmit is communication delay.
• T_authenticate is the time required to verify and accept the command.
• T_system-response is the time the system requires to halt, redirect, or safely terminate.

This is an educational model, not a universal engineering formula. Its purpose is to expose the inadequacy of asking only whether a human is “in” or “on” the loop. Frameworks for meaningful human control repeatedly emphasize accurate information, predictable technology, timely judgment and intervention, understandable status, deactivation capability, and identifiable responsibility.

The visual should contract across the rounds:

NORMAL OPERATIONS
180 sec  [████████████████████████████████████████]

INFORMATION OVERLOAD
 45 sec  [███████████                             ]

COMMUNICATIONS DEGRADATION
 18 sec  [████                                    ]
         Round-trip approval may require 28 sec

CONFLICTING EVIDENCE
  9 sec  [██                                      ]
         Comprehension estimate: 12–25 sec

MACHINE-SPEED ESCALATION
3.2 sec  [▊                                       ]
0.7 sec  [▏                                       ]
0.0 sec  [                                        ]
         Intervention no longer physically effective

The display changes color, but color must not be the only signal. Its border narrows, a spatial gap closes, haptic pulses accelerate on mobile and VR, and a screen-reader announcement states the remaining meaningful—not merely nominal—window.

The human-versus-machine timeline should make the asymmetry visible without claiming that the fictional timings describe any real weapon:

The interface should explicitly show when automation has moved from advisory to action-producing. Merely placing a human confirmation box late in this timeline can produce a “moral crumple zone”: the person appears responsible but has too little information or time to provide meaningful scrutiny.

The simulation’s public automation-bias model is called the Reliance Pressure Index. It is a pedagogical game mechanic, not a validated psychological diagnostic.

Starting Reliance Pressure: 20 points

Recent correct recommendations:
    +6 per consecutive accepted success, maximum +24

Human workload:
    +(workload score – 50) × 0.25, when workload exceeds 50

Severe time pressure:
    +15 when countdown falls below 10 seconds

Authoritative interface:
    +10 when confidence appears as a single large green number

Institutional pressure:
    +10 after speed/compliance praise or override criticism

Opaque evidence chain:
    +10 when provenance and correlation are hidden

Action momentum:
    +8 after a prior automated action is already under way

Visible uncertainty range:
    –15

Independent corroboration requirement:
    –15

Protected dissent and no-penalty override policy:
    –10

Mandatory disconfirming-evidence prompt:
    –8

Clamp final result between 0 and 100.

The index should not secretly force the viewer’s choice. It alters friction and presentation. At high reliance pressure, the recommended action is centered, uncertainty panels are collapsed, and the reject button requires a reason. At low reliance pressure, contradictory evidence is visible by default and the viewer is prompted to compare sources.

The mechanic should also model automation disuse. Too many false alarms, irrelevant warnings, or cumbersome explanations can drive users to ignore useful automation. Human-factors research treats misuse, disuse, and abuse as distinct failure modes: overtrust is not the only danger, and poorly calibrated alerts can make operators abandon beneficial assistance.

A safer confidence display should therefore show:

CLASSIFICATION CONFIDENCE       91%
CALIBRATED FOR THIS CONDITION?  NO
DIRECT EVIDENCE QUALITY         43 / 100
INDEPENDENT SOURCES             1
CORRELATED DERIVATIONS          2
DATA AGE                        7.4 sec
OUTSIDE-ASSUMPTION ESTIMATE     31%
MOST IMPORTANT CONTRADICTION    Infrared profile inconsistent
ACTION REVERSIBLE?              PARTLY

Explanations should answer verifiable questions: Which observations mattered? Which sources share a dependency? Which expected evidence is absent? How similar is this case to validated conditions? What could disconfirm the result? They should not be written as persuasive prose intended to make the model sound intelligent. National Academies material notes that uncertainty information can improve calibration, while explanations can also raise trust and overreliance and may consume too much attention in time-critical situations.

Public evidence and case-study translation

The case studies should appear as optional “evidence rooms” between rounds and then reappear during the final audit. They are not presented as direct equivalents to AI-enabled autonomous weapons. Each demonstrates a particular human-system interaction: broad classification logic, short decision windows, unclear system state, automation complacency, conflicting indications, missing context, or distributed organizational responsibility.

The Patriot/Tornado case is particularly valuable because it resists a one-cause narrative. The UK inquiry did not find merely “automation failure” or merely “operator error.” It described the interaction of broad classification criteria, doctrine, training, communications, identification procedures, autonomous operation, airspace planning, and a technical fault that was not displayed to the aircrew. That distributed explanation should shape the simulation’s final audit.

Air France 447 illustrates a different problem: a human takeover or intervention opportunity is not necessarily meaningful when the human does not understand the current mode, conflicting indications, or the physical state being controlled. The simulation should not suggest that pilots and weapon operators perform identical tasks. It should extract the general human-factors lesson that handing responsibility to a person during an ambiguous, rapidly developing state does not automatically restore effective control.

Three Mile Island broadens the design beyond the moment of action. The NRC’s post-accident reforms included human-factors engineering and operator training because safety depends on the larger control environment: displays, alarms, procedures, organizational learning, staffing, and regulatory oversight. In the simulation, the audit should therefore ask not just “Why did the operator click?” but “Why was this the information, authority structure, and interface available to the operator?”

The NTSB’s Tempe investigation reinforces that a nominal human supervisor may be an inadequate safety layer when the monitoring task is monotonous, system limitations are expected, redundancy has been removed, oversight is weak, and organizational processes do not control automation complacency. That case supports the simulation’s protected-dissent, staffing, monitoring, testing, and safety-culture mechanics.

None of these cases proves that all defensive automation is unsafe. They demonstrate why successful component tests or a formally assigned human supervisor do not by themselves establish system safety. The relevant unit of analysis is the sociotechnical system: sensors, software, data, interfaces, procedures, communications, staffing, authority, training, doctrine, incentives, and interactions with other systems.

Audit, accountability, safeguards, and platform requirements

The post-event experience begins by rewinding the last thirty seconds. The screen divides vertically:

This split-screen prevents hindsight bias. Investigators may eventually assemble information that no operator possessed in real time. The audit must therefore preserve both perspectives: the incomplete contemporaneous view and the richer retrospective reconstruction.

The LEDGER audit should record:

NIST recommends defining human and AI roles, examining whether users are empowered and incentivized to challenge outputs, and collecting data on the frequency and rationale of human overrides. DoD policy calls for understandable interfaces, transparent status, auditable and explainable technologies and data sources, and clear activation and deactivation procedures. These principles support an audit that records not only technical outputs but also authority, interface state, and whether dissent was practically available.

The viewer can scrub through the audit and activate a single-change counterfactual:

“What might have changed if M-47 had remained unresolved?”

“What might have changed if protected-zone updates were mandatory before preauthorization?”

“What might have changed if the stop command required receipt confirmation?”

“What might have changed if correlated sensors had been labeled as one confirmation?”

The tool should display ranges and uncertainty rather than announce that one change “would definitely have prevented” the outcome. Complex accidents commonly involve multiple interacting contributors; counterfactuals are tools for examining defenses, not machines for assigning simple blame.

The accountability screen then presents the user’s requested chain:

Instead of a “blame percentage,” the experience uses five dimensions:

Ex ante duty
Actual control
Available knowledge
Ability to prevent or mitigate
Post-event duty to investigate and reform

A party may have had substantial ex ante responsibility while having no real-time control. Another may have had nominal control but insufficient time or information. A third may bear responsibility for failing to test or regulate a known risk. SIPRI’s work stresses that humans must retain responsibility because machines cannot be held accountable, while Article 36’s meaningful-control framework links accountability to identifiable people capable of timely action and intervention across different stages of the system.

The screen should distinguish legal and evidentiary categories:

The experience must not declare criminal responsibility. International humanitarian law continues to apply to military AI and autonomous systems, and public policy declarations emphasize that military AI use must comply with applicable international law; however, individual and state responsibility depend on facts, authority, knowledge, intent, applicable law, and jurisdiction.

The safeguard architecture should be presented as a layered system rather than a checklist that guarantees safety:

These safeguards align with recurring public principles: realistic testing; robustness; bounded time and geographic constraints; transparent system state; clear deactivation; independent monitoring; human-machine interaction that permits informed and timely intervention; and continued human responsibility throughout the system lifecycle.

The platform design should preserve the same substantive experience while adapting information density and embodiment.

The visual intensity should come from compression, contradiction, and loss of control, not gore or triumphal imagery. In early rounds, the interface is spacious and quiet. In later rounds, timelines overlap, confidence and evidence diverge, communication paths blink asynchronously, and the intervention window physically narrows. At the point of action, the experience becomes silent. The most important image is not an explosion; it is a stop command still traveling after the decision has become irreversible.

The final accountability prompt should remain on screen long enough to resist a single-answer response:

Was responsibility held by the operator?

The commander?

The policy author?

The software designer?

The model developer?

The data provider?

The procurement authority?

The organization that approved preauthorization?

The state that deployed the system?

After the viewer selects one or more, LEDGER reveals an earlier human decision associated with each role. The operator accepted a recommendation. The commander approved a response doctrine. The policy author defined the exception. The designer placed uncertainty behind a secondary panel. The model developer selected confidence calibration criteria. The data provider combined dependent observations. Procurement rewarded response speed. The organization broadened preauthorization. The state deployed the network under crisis conditions.

The concluding statement should be identical after all three endings:

Removing humans from the final seconds can increase response speed. It can also remove the last opportunity to recognize that the system is wrong. Meaningful human control must therefore be designed into the entire chain—before activation, during operation, at the point of intervention, and after the event—not represented by a person watching a countdown they cannot stop.