The five controls
Each control is a policy ask met by an operational artifact.
Each of the five controls below satisfies a specific policy requirement and produces a specific evidence artifact the Authorizing Official, commander, and Inspector General can each reference. Controls are architecturally mechanical — not policy wrappers around existing tools. When a control fires, it leaves a cryptographic trace.
01
Behavior
Continuous envelope monitoring
Artifact · Behavior signature log
Policy asks
AI must operate within its authorized scope. No drift from baseline. No silent capability expansion. No out-of-policy output classes.
Operations needs
Immediate flag when an agent operates outside its sanctioned behavior envelope — before the deviation compounds into a compliance failure or an operational incident.
Composite provides
Per-inference behavioral fingerprint. Baseline envelope per agent class. Anomaly score computed and appended to every determination. Auto-gate on out-of-envelope; notification to ISSM and AO on threshold breach.
What is produced
Behavior signature log — append-only, per-agent, per-inference. Replayable. Hash-anchored. Reconstructible years later to establish what the agent was doing at any inference point in time.
Maps to
NIST SP 800-53 AU-6 (Audit Review), SI-4 (Information System Monitoring), SI-7 (Software/Firmware Integrity) ·
DoDI 8500.01 behavioral-baseline monitoring ·
Army AR 25-2 continuous-monitoring requirement
02
Provenance
Cryptographic chain of custody · sensor-to-decision
Artifact · Provenance Ledger
Policy asks
Every input, every decision, every output must be traceable to its source with non-repudiable evidence. No dark pipes. No silent data.
Operations needs
Replay-able timeline for every sensor feed, model inference, and downstream decision — to answer “where did this come from?” in minutes, not days.
Composite provides
Every input hashed on ingress. Every model inference tagged with weight hash, policy version, timestamp, and upstream chain. Every output sealed and anchored to time. Ledger is append-only, cryptographically chained, and readable without the runtime present.
What is produced
Provenance Ledger — a replayable chain from sensor pixel (or packet) to signed determination to downstream consumer. This is the direct answer to Earl’s network-sensor-tracking question.
Maps to
NIST SP 800-53 AU-10 (Non-repudiation), AU-11 (Audit Record Retention), SA-12 (Supply Chain Protection), SC-16 (Transmission of Security Attributes) ·
NDP-1 §5.2.3 provenance requirements ·
DoDI 8582.01 data-management lineage
03
Glass-Box Output
IG-defensible determination · sensitivity · context · authority
Artifact · Glass-Box determination
Policy asks
AI decisions must be explainable, defensible, reconstructible to the Authorizing Official, the Inspector General, and in oversight hearings — years after the operation.
Operations needs
Human reviewer can read the reasoning in plain language, verify the citations, and challenge the determination without reverse-engineering a model.
Composite provides
Every determination decomposes into three human-readable lenses: sensitivity (what classification / protection posture applies), context (what operational frame and precedent), authority (whose signature is required). Confidence score. Citation to policy corpus. Full disputation transcript attached.
What is produced
Glass-Box determination card — the human-signable, human-defensible artifact. See our cross-domain release and risk-acceptance examples for the visual treatment. Every signed Composite decision is one of these.
Maps to
NIST SP 800-53 CA-7 (Continuous Monitoring), PM-7 (Enterprise Architecture) ·
DoD AI ethical principles: traceable, reliable ·
EO 14110 §4.5 transparency-for-deployed-AI requirements
04
Adversarial Triad
Counter-tested by construction · Advocate / Defender / Arbiter
Artifact · Disputation transcript
Policy asks
AI decisions must be counter-tested — examined by a mechanism whose design prevents it from finding what it wants to find. NCDSMO’s raise-the-bar makes this explicit.
Operations needs
Assurance that the system didn’t just confirm its own bias. A single model can’t counter-test itself. An ensemble voting yes together can’t either.
Composite provides
Two opposing agents architecturally separated — no shared process, no shared context, no counterparty reflection. A third Arbiter reasons from artifacts only. Disputation is preserved and attached to the determination. Counter-testing is a property of the architecture, not a procedure.
What is produced
Disputation transcript — both agents' briefs, their counter-arguments, their cited policy references, and the Arbiter’s reasoning. Attached to every Glass-Box output. Reproducible from artifacts by any competent reviewer.
Maps to
NCDSMO raise-the-bar (counter-tested content inspection) ·
NIST SP 800-53 SA-15 (Development Process), SA-11 (Developer Security Testing) ·
DoD AI ethical principle: robust
05
Agent Fleet
Mint · scope · revoke at AI speed
Artifact · Agent attestation record
Policy asks
AI capabilities must be mintable, scopable, and revocable on the commander’s authority. No forever-agents. No un-scoped deployments. Kill-switch per agent, per mission.
Operations needs
Commanders authorize specific agents for specific missions, for specific durations, and revoke them instantly when scope changes. Changes take effect on the next inference, not the next deployment.
Composite provides
Library of mission-shaped agents. Each deployment is an attestation: who (authorizer), what (agent identity + version), when (validity window), scope (boundary, inputs, output classes), revocation conditions. Control-plane UI for the governance officer. Every action logged to the ledger.
What is produced
Agent attestation record — signed authorization with scope and revocation conditions. Revocation creates an immutable end-of-life marker. Authority flows from the commander, enforced by the runtime.
Maps to
NIST SP 800-53 AC-2 (Account Management), AC-3 (Access Enforcement), AC-24 (Access Control Decisions), CM-3 (Configuration Change Control) ·
Zero Trust reference architecture: user & workload attestation