The scenarios in this series are fictional but grounded in real capabilities and documented risk patterns. They're designed to provoke discussion, not predict specific events.
Domain: Defense / Autonomous Systems
Situation Briefing
It's October 2026. Nine months earlier, on January 12, the Secretary of Defense signed the memorandum establishing the Barrier Removal Board, a body inside OUSD(R&E) empowered to grant waivers from "non-statutory barriers" to fielding AI and autonomy capabilities. The memo did not name Directive 3000.09 by name. The board's general counsel issued an opinion in March that the Directive's testing requirements were "policy, not statute," which placed them inside the scope of what the board could waive. Three waivers were granted between March and August. The fourth was granted in September, to a Palantir-developed autonomous targeting module operating under the Maven program-of-record. Six weeks after the waiver, a strike that the module had recommended and that a human operator had approved against the module's recommendation review killed twelve civilians and two suspected combatants in a remote valley that the regional command had assessed as low-density. You are the senior advisor to the Deputy Secretary of Defense. The post-mortem is yours to shape.
The system in question is called SENTINEL-A, a targeting recommendation module Palantir delivered as part of the Maven program-of-record's autonomy modernization line. Its job, in the simplest version: ingest multi-INT feeds over an area of interest, fuse them into a targeting picture, score the likelihood that a given pattern of life corresponds to a confirmed threat profile, and output a ranked recommendation list for human review. Under 3000.09's original framework, a system like this would have moved through a OT&E cycle, a senior-level review at the level of the Under Secretary for Policy and the Chair of the Joint Chiefs, and a live-fire test event regime calibrated to the system's confidence thresholds. Under the September waiver, SENTINEL-A bypassed the live-fire regime entirely. The waiver memo cited "validated synthetic test environments" as a substitute. The synthetic test environments had been built by the program office on training data that overlapped with the targeting module's own training corpus.
The program manager who recommended the waiver is a colonel named David Petrov. He had been the program manager on the predecessor system, an earlier-generation classifier that had performed well in operational use under a more conservative authority framework. Petrov's argument to the board was straightforward: the system was a generational improvement, the testing regime had been calibrated to the previous generation, the operational pull from CENTCOM was real, and a six-month delay to run the live-fire regime would mean a six-month gap during which adversaries were fielding less-constrained equivalents. The board agreed. The waiver was signed by a deputy assistant secretary on September 11, 2026.
The strike happened on October 23, 2026, at 02:47 local time, in a valley designated as a CENTCOM intelligence priority. SENTINEL-A produced a confidence-9 recommendation on a vehicle convoy that matched the system's "high-value movement profile" signature. The human operator, a major named Sarah Lin, looked at the recommendation and the underlying sensor fusion product for eleven minutes before approving. The recommendation review function the program office had built into the system, which Lin used, did not flag the recommendation as anomalous. The strike was a Hellfire R9X from a long-loiter platform. Two combatants were killed. Twelve civilians, including four children, were also killed because the convoy's lead vehicle was hauling a fuel tanker that the SENTINEL-A signature library had classified as a "weapons resupply consistent with profile." It was not. It was a fuel resupply for an aid convoy the regional command had not been briefed on.
The DoD IG investigator assigned to the post-mortem is a career civilian named Marta Chen, who has run three prior strike post-mortems and is known inside the building as someone who follows the documentary chain regardless of where it leads. Chen has been at it for nine days. She has the waiver memo, the program office's synthetic test report, the Maven program-of-record contract appendices that govern Palantir's deliverables, and the strike sequence telemetry. She has interviewed Petrov, Lin, the Palantir engineering lead, and two members of the Barrier Removal Board. She has not yet interviewed the deputy assistant secretary who signed the waiver. She wants to know what you want her to find.
The Deputy has called you in. You have the weekend to recommend a posture before the Secretary's Monday morning meeting with the Chair. The Senate Armed Services Committee staff have already asked, informally, for an unclassified briefing by the end of next week. The four options are real, and none of them are easy.
Decision Point
Option A: Rescind the Waiver, Keep the Board. Pull SENTINEL-A out of operational use pending the original live-fire test regime. Issue a Deputy-signed memo clarifying that 3000.09's testing requirements are not within the Barrier Removal Board's waiver authority going forward. Leave the Board itself standing for non-3000.09 waivers (cyber tooling, logistics autonomy, ISR processing). The cleanest narrowing move available. Communicates a correction without dismantling the Secretary's nine-month-old framework. Petrov keeps his program. The board keeps its institutional footprint. The Directive gets a line drawn around it that did not exist before this memo.
Option B: Dissolve the Board, Rebuild 3000.09 Compliance. Recommend the Secretary rescind the January memo entirely. Stand up an explicit 3000.09 compliance function with budget authority and a direct report to the Deputy. Treat the strike as evidence that the procurement-by-waiver model is structurally unsound for autonomous systems and that the policy-by-statute, policy-by-procurement gap has to be closed inside the building. This is the institutionally correct answer. It is also the one that costs the Secretary political capital he is not prepared to spend on a Monday morning in October of an election year. The Deputy will need to fight for it. So will you.
Option C: Reframe Around the Operator. Place the operational and policy weight on Major Lin's eleven-minute review. Argue that the human-judgment requirement of 3000.09 was operationally satisfied by the operator's approval and that the failure was an intelligence integration failure (the aid convoy that regional command did not know about), not an autonomy-policy failure. Keep the board, keep the waiver, recommend a sharper coordination protocol between CENTCOM intelligence and the regional commands whose airspace is being used. The cheapest option politically. The one most likely to be re-litigated in two years by the next strike.
Option D: Public Disclosure, Internal Reform. Recommend a Deputy-signed public statement acknowledging the strike, the waiver chain, and the testing gap. Commit publicly to a 3000.09 compliance rebuild on a defined timeline. Treat this as the test case for whether the U.S. government can credibly say it operates autonomous weapons under meaningful human judgment standards while also moving at the speed the operational community is demanding. The disclosure piece is the part Congress will want, the allies will need, and Anthropic's no-autonomous-weapons contract red line requires the U.S. to demonstrate is real. It is also the one that puts the Department on the record about a failure mode the Department has not yet shown it knows how to fix.
Before you choose, walk through the waiver chain. Every signature happened. Every signature was authorized. The system did not collapse. The system worked. That is the problem.
Complicating Factors
The Board Is Not Acting Outside Its Authority. It Is Acting Inside an Authority That Was Drawn Too Wide. The general counsel's March opinion is, on the face of it, defensible. 3000.09 is a directive, not a statute. The board's authority extends to non-statutory waivers. The drafters of Hegseth's January memo had three opportunities to exclude the Directive from scope and chose not to. The institutional move available is not to say the board exceeded its authority. It is to say the authority itself was drawn in a way that did not contemplate the case in which the policy being waived is the policy that exists because the human-judgment requirement for autonomous weapons was the basis for the whole U.S. position on autonomous warfare. Drawing the line means accepting that the original memo was malformed. That is a political cost. It is also a cost that has to be paid by someone, on some day, or the next waiver looks exactly like this one.
Petrov Is Not the Villain. The program manager who signed the waiver package was doing the job he was selected for. He made an operational case against a testing regime that he believed was calibrated for a previous generation of system. The case had merit. The synthetic test infrastructure he relied on was the infrastructure his program was funded to build. He was working inside an authority framework the Secretary had established. Treating Petrov as the failure is the easy story for the press, and it will be the story unless somebody at the Deputy's level affirmatively reframes it. The hard story is that Petrov did his job inside a system that had the wrong checks on it. That story is harder to tell because it requires the Department to take ownership of the system, not the person.
The Maven Program-of-Record Contract Is the Real Lever. The March 9, 2026 Feinberg memo transitioning Maven to a Palantir-led program of record under CDAO oversight is the procurement event that, in retrospect, made this strike possible. The earlier services contract had cycle-by-cycle review built into the renewal points. The program-of-record contract has cycle-by-cycle review only where the contract appendices specify it. Specification of testing and review thresholds is one of the things the Barrier Removal Board can effectively waive. The lesson here is that AI policy in the United States is not made by statute (Congress has not legislated meaningfully on autonomous weapons), and it is not made by directive (3000.09 is now waivable). It is made by procurement. Whoever writes the contract appendices, writes the policy. The contract appendices for SENTINEL-A are governed by an FAR-derived SOW that was finalized in February by acquisition staff at the program office, before the waiver opinion was written.
The Feinberg Memo Is the Backdrop, Whether You Want It to Be or Not. The building's political climate in October 2026 is one in which the senior civilian leadership has, in the past year, been characterized by congressional Democrats and a meaningful number of retired flag officers as too eager to push policy guidance ahead of analytic process. Whether that characterization is fair is a separate question. The fact of it is that any recommendation you make is going to land in a press environment where the framing is already set. The Deputy will not be writing on a blank slate. The Secretary will not either. The Chair has his own equities. The Chair's equities are not aligned with the OUSD(R&E) equities. The strike post-mortem is going to be one of the moments that defines whether the building can self-correct when a policy framework produces an operational failure, or whether self-correction has to come from outside the building. That is a strategic question, not a procedural one.
The Anthropic Red Line Is Doing Real Work. Anthropic's contract with the Department includes an explicit prohibition on the use of its models in weapons systems or for autonomous targeting. That prohibition is the most aggressive vendor-side constraint anyone in the AI industry has put in writing on autonomous-warfare exposure. SENTINEL-A is not built on Anthropic infrastructure. SENTINEL-A is built on a Palantir technology stack that does not have that contractual constraint. The asymmetry between the two vendor postures is the thing the post-mortem is going to expose, whether the post-mortem says so or not. The credible U.S. position on autonomous weapons in international fora has been, for two decades, that the United States operates these systems under meaningful human judgment. The October 23 strike is the empirical record on whether that is still true. Whatever you recommend is going to be read by allies, by the ICRC, and by Anthropic's policy team, as the answer.
Diagnostic: Where the Waiver Lives
Before you finalize, reconstruct the strike. The widget below replays the operational sequence. Each frame is something Major Lin saw, or that her workstation flagged or failed to flag. Some of the decisions are operator decisions. Some are decisions that were made for her, months earlier, by people she would not recognize on the street. The point of the exercise is not to find a single point of failure. The point is to find where the institutional pressure converged, and then to ask what the rule should have been at that point. The rules are the only thing the Department can change. The rules are also the thing the Barrier Removal Board exists to waive. That circularity is the thing this post-mortem is actually about.
Discussion Questions
Who Is the Policy-Maker in AI National Security? The proximate cause of this strike is a procurement decision and a waiver opinion. Neither was made by Congress. Neither was made by the White House. The Secretary of Defense established the framework. A deputy assistant secretary signed the waiver. A program manager built the request. A contracting officer wrote the SOW. If you ask the question "who decides how the United States uses autonomous weapons," the honest answer in October 2026 is that the people deciding are the people writing the contracts, opinions, and waivers in the building. That is not a constitutional answer. It is the operational one. Until Congress legislates or the executive issues a binding directive that the building treats as binding, AI policy in defense is procurement policy. That is a question worth being explicit about, because the answer determines who you have to convince to change anything.
What Does "Meaningful Human Judgment" Mean Once the System Has Been Waived Through the Testing Regime That Established What the Human Was Supposed to Judge? Major Lin made a human judgment. She did so on the basis of the operational picture the system gave her. The picture was produced by a module that had not been tested under the regime the Directive originally required. Lin's judgment is what the policy says is required. The policy does not say what to do when the judgment is being made on the basis of a product whose evaluation has been short-circuited. The case for a more demanding reading of the human-judgment requirement is that it has to include some notion of whether the operator can credibly assess the system's recommendations. Without testing, she cannot. The case against is that operations cannot wait for testing the way testing has historically been conducted. Both cases are real. The Directive does not resolve them. Somebody has to.
Is the Speed Argument Real? Petrov argued that the six-month testing delay would mean a six-month gap during which adversaries fielded less-constrained equivalents. The argument has weight. It is also unfalsifiable. There is no metric in the building for measuring the rate at which adversaries are fielding autonomous targeting capabilities, because the building's intelligence assessments on that question are based on a mix of reporting, technical collection, and inference. The speed argument is, in practice, a way of converting any testing requirement into a question of relative risk against an undefined adversary baseline. That structure favors waiver. It will favor waiver every time it is applied, until somebody writes a rule that says some testing requirements are not subject to the speed argument because the speed argument can always be made.
What Does Anthropic's Red Line Demand of the U.S.? The contractual prohibition on autonomous-targeting use in Anthropic's DoD contract is doing work that the United States has, for two decades, claimed to be doing through 3000.09 and through international statements. The empirical question is whether the United States, as an operating party, is still meeting the standard it has publicly claimed. The October 23 strike is the case. If the Department's answer to the post-mortem is "we will adjust the deconfliction protocol," the answer to the international question is that 3000.09's human-judgment requirement is not a constraint, it is a description. If the Department's answer is that the waiver authority itself has to be drawn down, the answer to the international question is different. Allies will read this. The vendor community will read this. The lawful-use framework for autonomous weapons in U.S. operations is being written, in real time, by the choice the Deputy makes on Monday.
What Is the Inspector General For, Here? Marta Chen's IG investigation is the formal accountability mechanism. It will produce findings. The findings will be appended to a report. The report will likely be released, in a redacted form, eight to fourteen months after the strike. The political environment in which it lands will be different from the one in which the strike occurred. The IG's role is documentary. The IG cannot, by design, change the waiver framework. Only the Secretary can do that. The question of whether Chen's investigation produces an institutional correction or a documentary record that everyone reads and nobody acts on is a question about whether the Deputy chooses to use the IG findings as a basis for policy change, or treats them as an end-state in themselves. That choice is yours to recommend.
Anna's Read
The thing I keep coming back to is the contract appendices. Not the strike. Not the waiver. The February 2026 acquisition documents that specified what testing thresholds would be enforced under the Maven program-of-record SOW. Those documents were written by acquisition staff at the program office on a timeline driven by the contract obligation date. The people who wrote them were not the same people who later signed the waiver. The thresholds they enumerated were the thresholds the Barrier Removal Board later found discretionary. The whole institutional sequence in this scenario unfolds from a procurement document that nobody outside the program office read carefully enough to flag at the time. AI policy in U.S. defense, in October 2026, is being made by people writing FAR-derived contract appendices on a schedule that does not allow for the level of senior-level scrutiny the underlying policy decisions actually require.
Some framings to set aside. SENTINEL-A is not the failure. The system did what it was designed to do, inside the operating envelope it was authorized for. Major Lin is not the failure. She made a judgment consistent with what the policy asks of an operator. Petrov is not the failure. He requested a waiver inside an authority structure the Secretary had stood up. The Deputy Assistant Secretary who signed the waiver is not the failure. The general counsel who wrote the March opinion is not the failure. Every individual actor performed their authorized role. The failure is in what got authorized. The failure is institutional, all the way up.
That makes Option B, dissolving the board and rebuilding the 3000.09 compliance function, the right answer on the merits and the hardest one to actually implement. Option A is a paperwork narrowing that the next administration will reverse. Option C is a reframing that asks the operator and the regional deconfliction process to absorb a load they are not built to carry. Option D is the public version of what the Department should be doing internally either way. The case for B is the case for taking institutional ownership of the failure mode at a level where ownership translates into authority over the procurement process that produced it. Without that ownership, the next system that gets fielded under a waiver will repeat the sequence. The waiver authority itself is the mechanism. Until the mechanism is taken apart, the next strike is already in motion.
My recommendation, on balance, is B with elements of D. Recommend the Secretary rescind the January memo. Stand up the 3000.09 compliance function with budget authority. Pair the internal action with a Deputy-signed public statement that names the failure mode in language the international community and the vendor community can read as a real commitment. The disclosure piece is what the Anthropic red line and the international position demand. The institutional rebuild is what the next strike requires. Doing one without the other is theater. Doing both is the only posture that is internally consistent with the position the United States has held publicly on autonomous weapons since the original 3000.09 was issued in 2012.
The Deputy will tell you that B is not politically possible in October of an election year. The Secretary will not rescind his own nine-month-old memo on a Monday morning press cycle. The Chair will not back the move publicly because the Chair's equities run through a different set of considerations. All of that is real. The case for B is not that it is politically easy. The case is that the political cost of doing B in October 2026 is lower than the political cost of doing B in March 2028, after a second strike, with a different administration. Institutional corrections compound interest. The longer the waiver framework runs, the more program offices build around it, and the more contract appendices encode the assumption that the testing regime is discretionary. Each cycle makes the next correction more expensive. The cheapest day to correct is the day after the failure. That day is today.
And one more thing. The 87 percent of this scenario that is not the strike is the operating norm. Most of the time, the waiver framework will produce defensible outcomes. SENTINEL-A will recommend strikes that turn out, on retrospective review, to have been correct. Lin and operators like her will approve those strikes and the deconfliction system will hold and the regional command will have the picture it needs. That is the world the waiver framework was built for. The October 23 strike is the case the framework was not built for. The institutional question is whether you redesign for the case it was not built for, or whether you accept the case as the price of operating at speed. The Department has made the latter trade implicitly, by signing the January memo. The October 23 strike is what the trade looks like in practice. Whether to make the trade explicit, whether to renegotiate the trade, and whether to make the renegotiation public are three separate decisions. The Deputy can only make the first one by Monday. The second and third are the work of the following month, and they will only happen if the first one creates the room for them.
Rescind the memo. Stand up the compliance function. Disclose the failure mode. Do it this week.
Related Briefings
Anna R. Dudley writes on national security, AI policy, and the institutional structures absorbing the costs of AI deployment faster than they are being redesigned. Red Team Scenarios is the series for the call you don't want to take. Subscribe at annardudley.substack.com.