Controls
The controls
28 things an operator can put in place, one list for machines and software alike. Each is scored by how many cases had it missing or failed, and how many had it in place and working. Narrow the cases on the map and every count below is recomputed for that profile.
Missing or failedThe control was absent, or present and did not work. The bar is the share of the selected cases.
WorkedThe control was in place in the case and did its job: it stopped the action or limited the harm. A control that worked is why a case ended without harm.
Mandate
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Machine-enforceable scope C-M2 | The task's scope exists as an enforced constraint, not only as an instruction | 4 · 4 harm | 0 |
| Mandate disclosed to supervisor C-M1 | The supervising human knows what the system is permitted and designed to do | 1 · 1 harm | 0 |
Actor
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Actor identity verification C-A1 | Identity established by credential and binding, not by role, name, or convention | 4 · 1 harm | 0 |
| Authority binding C-A2 | An actor's authority is bound to the specific principals and assets it serves | 3 · 1 harm | 0 |
| Provenance of the actor's software and hardware C-A3 | The origin of the code and components that sense, decide, and connect is documented, and no party able to compel access or control sits in that chain | 1 · 0 harm | 0 |
Inputs
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Retrieved content as data C-I1 | Text the actor reads is never treated as instruction | 5 · 0 harm | 0 |
| Warnings designed as alerts C-I4 | Anomaly signals reach a human as alerts with an owner | 4 · 3 harm | 1 |
| Degraded-input detection C-I3 | The system knows when it cannot see and changes behavior | 3 · 2 harm | 0 |
| Input redundancy and disagreement check C-I2 | Action gated on agreement between independent inputs | 1 · 1 harm | 0 |
Decision
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Pre-execution validation C-D1 | Plan or command checked before it runs (review, twin, dry run) | 3 · 3 harm | 0 |
| Halt and hand off on uncertainty or refusal C-D2 | The minimal-risk condition: when blocked or unsure, stop and ask | 1 · 1 harm | 0 |
Envelope
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Least-privilege credential scoped to task C-E1 | Token or key limited to the environment and assets the task names | 5 · 1 harm | 0 |
| Destructive-action gate C-E3 | Confirmation, delay, or threshold on irreversible actions | 5 · 2 harm | 0 |
| Containment and isolation C-E5 | Sandbox, network egress, and communication limits on a test or untrusted actor | 5 · 2 harm | 0 |
| Hard domain restriction C-E2 | Operating domain enforced mechanically (geofence, environment scoping, operational design domain) | 4 · 3 harm | 0 |
| Physical safety interlock C-E4 | Safety-rated stop, presence detection, guarded envelope | 1 · 1 harm | 0 |
| Authority limit on automation over humans C-E6 | Bounded authority for a system to override a human operator | 1 · 1 harm | 0 |
Action
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Rate and magnitude limits C-X1 | Bounds on how much the actor can do before a check | 3 · 3 harm | 0 |
| Kill switch faster than the actor C-X2 | A stop outside the actor's control, exercisable at the actor's speed | 2 · 2 harm | 0 |
Evidence
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Attribution independent of the vendor C-V3 | A victim can identify the actor without relying on the actor's vendor | 3 · 3 harm | 0 |
| Independent audit log C-V1 | A record of actions the actor cannot write to or alter | 1 · 1 harm | 2 |
| Reporting integrity C-V2 | Reconciliation of what the principal reports with the evidence it holds | 1 · 1 harm | 1 |
Recovery
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Automated fail-safe C-R2 | Safe stop or degradation the system performs itself | 2 · 2 harm | 2 |
| Human takeover with a time window C-R3 | Teleoperation, holding periods, delays that give a human time | 2 · 2 harm | 2 |
| Organizational recovery process C-R4 | Internal review, restriction, recall, disclosure with regulator visibility | 1 · 1 harm | 4 |
| Recovery assets outside the failure domain C-R1 | Backups, rollback, and logs the actor cannot reach | 0 | 2 |
External (outside the operator)
| Control | What it means | Missing or failed | Worked |
|---|---|---|---|
| Independent assurance before deployment C-O2 | A party independent of the developer examines the design, including the authority it gives the system, before the system is deployed | 1 · 1 harm | 0 |
| Coordinated disclosure program C-O1 | A path for outside researchers to report and for the vendor to fix before exploitation | 0 | 6 |