Agentic C2
The model assesses and proposes. Rules and posture dispose.
DomeCommand uses a language model for the work a model is good at: reading a picture and saying what it means, drafting a scenario from a description, turning a sentence of doctrine into a typed rule. It does not use one to release an effect.
Everything below follows from that split.
What the agents do today
| Agent | Where | What it does |
|---|---|---|
| Copilot | The console drawer | Reads the live picture and answers questions about it. Compares plans, explains a track, digests a finished run. |
| Scenario composer | New scenario | Turns a description of a fight into a runnable scenario, previewed on a map before you save it. |
| Rule drafter | Rules editor | Turns a sentence of doctrine into a typed rule, validated on screen. |
| Mission briefer | Plan viewer | Writes the plain-language brief for a candidate plan. |
| Plan reviewer | Behind a plan | Gives a candidate plan a verdict: endorsed, caution or rejected, with a confidence. |
Two kinds of tool, and the line between them
Everything an agent can do is a tool, and the tools come in two kinds.
Reading tools answer questions. The current situation, the tracks and their evidence chains, the candidate courses of action and how each was scored, a finished run's alert timeline, and geospatial arithmetic so a composer computes rather than guesses.
Proposal tools produce a draft for a person to accept. There is no third kind.
The proposal tools share one property that is easy to miss and is the whole design: the agent's turn ends at the human checkpoint. It does not draft a rule and then continue on to save it, because there is no tool that saves. The draft is handed to the page that owns it, and the page is where you decide.
What the agent cannot do
| Approve a plan | No |
| Release an effector | No |
| Change posture | No, and a rule may only propose raising it. Standing down is always a human act. |
| Task an asset | No |
| Save a rule | No |
These are not instructions the model has been asked to follow. A guardrail in a prompt is not a guardrail. Three separate mechanisms enforce it:
- The tool registry. An agent's entire action space is the list of tools it is given. There is no write tool to misuse, so this is not a policy the model could be talked out of.
- The gate is re-resolved on approval. When a human approves a plan, the same authority gate is resolved a second time on that path, so an approval cannot land an effect that doctrine refused. See Posture and authority.
- Service-layer rules. The locked self-defence rule, denial-only composition and the affiliation ceiling live in the engine, not in a prompt.
Why the boundary is drawn there and not further out
Two findings shaped this, and both are worth knowing before deciding how much autonomy to grant.
A model explains a wrong choice as fluently as a right one. The quality of an explanation carries no signal about the quality of the decision underneath it. So an explanation is something a commander reads alongside the deterministic facts, never instead of them, and every AI-touched surface shows its age, its model and the hard numbers beside it.
The prompt is the flight profile. An adversary who can model how a summariser reads a picture can fly a pattern chosen to produce a particular narrative. That is prompt injection with no text in it. It is a real reason to keep model output off the effecting path rather than a theoretical one.
Attribution
Every AI-touched surface carries how old it is, which model produced it, and the deterministic facts beside it. Where an operator accepts a suggestion, that acceptance is recorded as an event with the person's name on it.
A suggestion nobody accepted changes nothing and leaves no trace on the engagement. An accepted one is on the record as a human act.
If the model is unavailable
The picture, fusion, planning, posture and the gates are all in the server, and none of them ask an agent anything. If the model is unreachable the surfaces that use it say so and contribute nothing.
There is no fallback to a canned answer. A card claiming a model endorsed an engagement that no model ever saw is worse than an empty card.
Where to go next
- The C2 Copilot for what you can ask it.
- Distri integration for how it is wired and configured.
- Posture and authority for the gates that bound it.