WARRANT: AI Autonomy Authorisation Gate
Purpose: A meta-framework, a binary, all-or-nothing governance gate that must be satisfied before any AI or automated system is granted execution authority over a production environment, at any level of autonomy.
Core principle: Autonomous authority is prohibited by default. A full WARRANT lifts that prohibition. A WARRANT must be earned, not assumed.
Not a maturity model. No partial credit. All seven conditions must pass; failure of any single condition voids the WARRANT entirely.
| Condition | Derived From | Core Question | Historical Failure If Absent |
|---|---|---|---|
| W — Warning Integrity | SIGNAL / Sampoong 1995 | Are warnings active and decay-resistant? | 502 dead |
| A — Accountability Assigned | TRACE / Challenger-Boisjoly 1986 | Is a named human accountable? | 7 dead |
| R — Redundancy Verified | HARDENED / Therac-25 1985–87 | Is independent verification genuinely independent? | Multiple deaths |
| R — Rigour Demonstrated | Compliance ≠ Competence principle | Does the team know how this system fails, specifically? | Regulatory pass, operational collapse |
| A — Authority Matched | Controls Parity principle | Do deployed controls equal or exceed the autonomy level requested? | Governance gap, undetected failures |
| N — Non-closure Confirmed | STRUCT / Kilminster Point | Are escalation paths open to real, independent authority? | Engineers silenced, disaster proceeds |
| T — Transparency Baseline | Observability-first principle | Can every action be seen, traced, and audited before authority is granted? | Blind governance, uncatchable errors |
Pass criteria detail per condition:
- Warning Integrity: no alert suppressed/overridden in 90 days without documented justification; alert history shows no unacted pattern; 90 days of data reviewed by a named human
- Accountability Assigned: named individual + role signed off, using TRACE’s 5-field structure; no team/committee/role-title acceptances
- Redundancy Verified: HARDENED’s 4-criterion test applied in full
- Rigour Demonstrated: engineers can describe 3+ specific failure modes in their own context without reference materials; a post-incident review has happened in the past 12 months; circuit breakers have been deliberately tested
- Authority Matched: controls deployed ≥ controls required, both documented, binary, no waivers, no “we’ll close the gap later”
- Non-closure Confirmed: STRUCT’s 6-step audit applied, chain reaches an independent node with halt authority
- Transparency Baseline: every authorised action category is logged with timestamp/actor/target/outcome; logging system independent of the monitored system; alert thresholds pre-defined; a named human confirms detection SLA (typically <24hrs for regulated environments); a kill-switch exists from the observability interface alone
How it differs from published maturity models (NIST AI RMF, ISO 42001, EU AI Act):
- Binary, not graded: the output is yes/no, not a spectrum position
- Every condition is derived from a named catastrophe, not assembled from vendor best-practice
- It’s a gate, not a model: determines whether you may proceed today, not where you’re heading
Relationship to other standards: Not a replacement for an autonomy-level model (e.g. NIST AI RMF designates the target level) WARRANT is the pre-authorisation gate that must be passed before that designated level may actually operate. Not a compliance checklist. Passing WARRANT ≠ FCA/ISO 42001 compliance, though there’s overlap. Not permanent. Revalidation required at max 90-day intervals or on trigger events (personnel change, controls gap, alert fatigue).
Meta-principle: The failure modes that will destroy your AI deployment are already documented. They happened in Seoul, in Cape Canaveral, in the radiation oncology ward. The only question is whether you’ve built the specific guardrails those specific failures required. Before your system runs, not after your incident review.