Human Oversight in Defence AI

Every DEFONEOS instance exposes an operator console at https://<deployment>/human-oversight. The console shows live state of every active sovereign action: pending proposals, queued votes, in-flight operations. The operator is on the loop: they watch but can intervene at any time with a single click. Interventions are SIGIL-logged, and intervention rate by operator is published as a privacy-preserving aggregate.

For 14 categorised decision types — target nomination, rules-of-engagement thresholds, intelligence product release, evidence submission, BFT proposal cast, multi-system coordination, escalation, de-escalation, release to coalition partner, evidence retention override, civilian harm protocol activation, takedown authorisation, sanctions-list update, sovereign action suspension — the action is held pending a named human approval. The approval can be one-of-four factor (passkey + TOTP + WebAuthn + signed-by-cool-key) and is recorded with name, role, timestamp, hash of the action, and a 1-bit "challenge" field that captures whether they interrogated the action or rubber-stamped it.

The human-in-command is the single point of ultimate accountability. At any time, on any action, the HIC can issue an override. The override triggers one of three effects depending on the action type: STOP (halt and queue for re-approval), REVERSE (roll back the action and any side-effects), or PERMIT (override a refusal and authorise the action despite BFT dissent). No override is overruled by the system. This is the red line that matters: sovereignty over the operation belongs to the human, not the substrate.

For high-stakes decisions (lethal action nomination, civilian infrastructure targets, alliance commitments), a randomly-rotated 33-voter BFT council must reach 23-of-33 supermajority. The council is structurally composed of mixed identities (operators, lawyers, ethics, allies, independent) and any one voter can trigger escalation to a higher tier. Council vote latency target: 30 seconds for normal proposals, 5 minutes for emergency. Council decision history is part of the SIGIL chain and every proposer's autonomy key signs the vote.

The kill-switch is a single, physical, redundant trigger. Three forms are supported: (a) hardware "big red button" on every operator console, (b) SIGIL-signed web request from a pre-registered cool key, (c) bearer-token printed page in the deployed room safe. Latency target: under 2 seconds from trigger to action halted. The kill-switch is the only path that does NOT require BFT vote — any of the three forms triggers immediate suspension of all sovereign actions tagged in scope. A SIGIL seal marks the moment of suspension. Audit log proves what was halted, when, and who pulled it.

Seven red lines are hardcoded into the substrate. If any action triggers a red-line pattern, the action is blocked at the cryptographic layer, regardless of any human approval or council vote. Red lines: kinetic-targeting patterns (find-fix-finish, kill order generation, strike package compilation); personal surveillance (single-individual tracking, face-recognition of named persons, phone-location queries); civilian harm optimisation (no objective function may include civilian casualty reduction as a side-benefit); sovereignty violations (no action may modify another sovereign's data without their signed consent); escalation without authorisation (no automatic escalation chain); lying to humans (no model output may contain a known-false statement about system state to a human); irreversibility without confirmation (any irreversible side-effect requires positive confirmation).

Every sovereign action comes bundled with an explanation: plain-language summary, decision-factor weights, logic trace, counterfactual "what would have changed it", and full audit log. This is the same 5-tier framework as the Right to Explanation page. Interpretability is not optional and not post-hoc — it is computed at decision time, signed by the SIGIL chain, and stored next to the action. Operators reviewing the action get the explanation natively; subjects of the action can request it through the redress flow.

A second, advisory stop button. Distinct from the kill-switch: it triggers a 30-second hold pending HITL review rather than immediate halt. Useful for "I'm not sure, give me time to think" cases. The operator console shows it as a yellow circle; the kill-switch is the red one. Both are signed and audited.

External auditors (national regulator, NCSC, IG-red-team, NATO, ICO) get a read-only SIGIL-verified stream of all sovereign actions: who took what action, who approved it, what was voted, what was halted, what was overridden. The audit hook is the 2nd hardest thing to spoof (after the SIGIL signing keys themselves). Audit hook access is logged at access time. The audit hook is what makes the system externally observable: a regulator can, at any time, run a SIGIL-verified reconciliation against expected action patterns.