Doctrine · Decision support
Who may say yes
Posture is two independent statements issued together, and authority is a five-rung ladder. A checkbox cannot express either.
Doctrine keeps three questions apart and answers them with three instruments, issued by three different people at three different tempos.
| Question | Instrument |
|---|---|
| How bad is it right now? | Alert state, a rung on a ladder |
| What are we permitted to do? | Control status: HOLD, TIGHT or FREE |
| Who may say yes? | Authority: a gate, and a grant that can lower it |
Why two axes and not one dial
A single four-value dropdown cannot express RED with HOLD, which reads as something is inbound and you are not cleared to fire. That is a common posture and an entirely real one.
The two axes are independent because the people who set them are different. An alert state comes from intelligence. A control status comes from command authority. They move on different clocks and for different reasons.
The ladder is data
Air Defence Warning crossed with Weapons Control Status is how air defence has been commanded for decades. It is the air-domain instance of a pattern that recurs per domain: FPCON for installations, MARSEC for maritime.
So the ladder is declared rather than compiled in. A profile carries its rungs, the matrix is generated from it, and an air defence customer sees WHITE, YELLOW and RED without ever learning there is a generic type underneath.
Four profiles ship: air defence, site protection, maritime and emergency response. Levels order within a profile only. MARSEC 2 is not less than FPCON Delta, and the product will not let you ask.
The gate ladder
Five rungs, replacing a yes-or-no approval flag.
| Gate | Means |
|---|---|
| AUTO | Runs, logged. Human out of the loop. |
| NOTIFY n s | Runs unless stopped inside the window. Human on the loop. |
| CONFIRM | One person clicks. |
| TWO-PERSON | Two distinct people. |
| WITHHELD | Nobody at this echelon may. It has to be raised. |
Two of these are the reason the ladder exists.
NOTIFY is firing in five, stop me. Against a fast inbound at sixty seconds of warning, asking for a click is too slow and not asking removes the human. A boolean cannot say it.
WITHHELD is not "off". Off says we chose not to. Withheld says this authority is not ours to exercise, which is the honest state of kinetic engagement at a commercial site.
Read the matrix
Rows are effects, grouped by rung. Columns are posture cells. Each intersection is the gate in force.
A dot marks a gate that holds only while some condition does. Cells doctrine does not permit are not shown at all, rather than shown and refused.
A posture is a vector, not a slider
Automation is a property of each stage of the loop, not of the system. So a posture cell selects one automation level per stage:
OBSERVE automatic every sensor feeds fusion
ORIENT automatic fusion classifies; identification rules designate
DECIDE automatic the plan is authored without asking
ACT on approval the one human gate left, and it is visible
That is what lets the surface say something specific instead of "auto".
Where a ceiling lowers a stage, the surface records which stage was limited and by what. A surface that silently clamps is how an operator comes to believe the system is doing something it is not.
Rules narrow. Grants widen.
| Rule | Grant | |
|---|---|---|
| May narrow authority | yes | yes |
| May widen authority | never | yes, and that is its purpose |
A grant is a written permission with a serial, an issuer, a co-signature and a required, bounded expiry. This mirrors the structure of supplemental ROE measures, which come in exactly two kinds: those that authorise and those that limit.
One property constrains the whole design: supplemental measures do not limit self-defence. That is why the self-defence rule is locked and exempt from every grant.
Where to go next
- Policy & rules for the grammar and how a rule is authored.
- Constants for the values rules read.