Individual autonomy
An uncrewed vehicle perceives its environment, maintains its own operational understanding, plans and performs tasks within its operating constraints.
PHYSICAL AI · OS FOR SHARED SPACES · BATTLEFIELD
WHEN THE LINK DROPS, WHAT STILL HOLDS THE OPERATION TOGETHER?
An autonomous drone can perceive, reason and act. A swarm can coordinate many drones. Neither guarantees cooperation with other autonomous platforms, human forces and command structures.
The battlefield is becoming an environment of increasingly intelligent participants, each with its own capabilities, observations, models and operating constraints. They must cooperate where information may be deliberately manipulated, connectivity cannot be guaranteed, and decision authority is distributed across people, systems and organisations.
This is the final stress test of the OS for Shared Spaces, following the Cognitive Factory and Cognitive City. It takes the six original design requirements into the most demanding operating conditions of the series.
An illustrative architectural concept, not a product or a report of a real military operation.
01 · FROM NETWORK-CENTRIC TO COGNITIVE
INTEROPERABILITY WAS NEVER JUST CONNECTIVITY.
Military interoperability is not a new challenge.
Network-centric warfare, C2 systems and tactical data links established ways to connect sensors, platforms, operators and commanders. Federated Live, Virtual and Constructive (LVC) simulation tackled technical, semantic, temporal and behavioural interoperability across independently developed systems.
These foundations remain essential.
Physical AI changes what they must support: we are moving from connecting automated platforms to integrating autonomous participants that perceive, reason, plan and initiate actions.
Collective autonomy
A team or swarm coordinates multiple systems through shared objectives, task allocation and cooperative behaviour.
Federated autonomy
Independently developed autonomous systems, swarms, human teams and command structures participate in the same operation.
CITY
Robotaxi → fleet → cooperation across fleets, robots and public services.
BATTLEFIELD
UxV → autonomous team or swarm → federation of autonomous systems, human forces and command structures.
Intelligence within one system does not automatically create operational coherence across systems.
- Technical interoperability
- Can participants exchange information, services and commands across heterogeneous systems, networks and security environments?
- Semantic interoperability
- Do they interpret observations, constraints, intentions, operational states and uncertainty compatibly?
- Operational interoperability
- Can they coordinate tasks, negotiate commitments, manage dependencies and establish whether agreed actions were performed?
- Authority and assurance
- Are participants permitted and sufficiently qualified to act under the applicable conditions? Can responsibilities, permissions and evidence be established across organisations?
These are interacting requirements, not four independent protocol layers. Technical, semantic and operational interoperability have long histories in defence systems engineering. Authority and assurance make explicit the governance conditions for autonomous cooperation.
Exchanging information was never enough. With independent cognitive participants, the consequences of incomplete interoperability become greater.
02 · THE SCENARIO
ONE MEDEVAC. SEVERAL OPERATIONAL REALITIES.
A multinational medical evacuation is under way.
Reconnaissance drones report that a route is usable. An autonomous ground vehicle prepares to support the evacuation. Medical personnel coordinate their activities. Different command elements oversee the operation within their respective responsibilities.
Each participant holds a legitimate but incomplete operational picture.
Then the situation changes.
Another reconnaissance source contradicts the route assessment. A command element introduces a temporary movement restriction. Communications with some autonomous participants deteriorate.
The ground vehicle can still navigate.
A better perception model, more data or a common operational picture cannot answer all these questions.
Shared understanding, coordinated action and legitimate authority are related, but distinct requirements.
03 · THE STRESS TEST
SIX REQUIREMENTS UNDER FOUR CONDITIONS.
The six canonical OS design requirements:
- Preserve local autonomy.
- Establish shared operational context.
- Make authority explicit, scoped and dynamic.
- Coordinate competing intentions.
- Federate across system boundaries.
- Accumulate operational evidence.
Read the original OS design requirements (opens in a new tab)
Federation across system boundaries also includes the organisational, institutional and authority boundaries that determine how those systems may cooperate.
The battlefield does not invalidate these six requirements. It exposes the conditions under which each becomes difficult to satisfy—and where their interactions create additional architectural challenges.
These are analytical conditions, not necessarily a fixed chronological sequence. Information can remain contested during and after disconnection.
Use the left and right arrow keys to switch conditions. Home and End select the first and last condition.
CONNECTED
Participants can exchange relevant information and coordinate through available communication and mission systems.
Preserve local autonomy.
Local autonomy: Act independently within delegated limits; coordinate with others where the task requires it.
Establish shared operational context.
Shared operational context: Exchange relevant observations, models, mission conditions and operational dependencies.
Make authority explicit, scoped and dynamic.
Explicit authority: Apply established roles, permissions, delegations and operating constraints.
Coordinate competing intentions.
Coordinated intentions: Negotiate dependencies, proposals, acceptance, rejection and commitments.
Federate across system boundaries.
Federation: Discover, authenticate and coordinate participants through selective, authorised information exchange.
Accumulate operational evidence.
Operational evidence: Record relevant observations, decisions, commitments, actions and outcomes.
CONTESTED
Information becomes contradictory, unreliable or potentially manipulated, even while communications remain available.
Preserve local autonomy.
Local autonomy: Limit decisions that depend on information whose reliability cannot be sufficiently established.
Establish shared operational context.
Shared operational context: Preserve conflicting assessments, provenance, freshness and uncertainty instead of forcing premature agreement.
Make authority explicit, scoped and dynamic.
Explicit authority: Verify the provenance, scope and applicability of instructions. Do not treat unverified messages as legitimate authority.
Coordinate competing intentions.
Coordinated intentions: Reassess proposed actions and commitments when their underlying assumptions become uncertain.
Federate across system boundaries.
Federation: Restrict reliance on compromised or untrusted participants and information while preserving legitimate cooperation where possible.
Accumulate operational evidence.
Operational evidence: Preserve contradictory observations, source information and confidence limitations for subsequent analysis.
DISCONNECTED
Communications between some participants or groups become unavailable. The operation may split into separate local groups.
Preserve local autonomy.
Local autonomy: Continue only where previously established permissions and locally verifiable operating conditions allow.
Establish shared operational context.
Shared operational context: Maintain local context while tracking its freshness, missing updates and limitations.
Make authority explicit, scoped and dynamic.
Explicit authority: Respect delegated scopes, expiry conditions, fallback rules and constraints established before disconnection.
Coordinate competing intentions.
Coordinated intentions: Execute only commitments that remain permissible and feasible locally. Do not assume that unconfirmed dependencies still hold.
Federate across system boundaries.
Federation: Support permitted local or subgroup operations without assuming access to a globally consistent federation state.
Accumulate operational evidence.
Operational evidence: Preserve local records of observations, decisions, applicable constraints, actions and execution outcomes.
RECONNECTED
Connectivity returns. Participants exchange relevant information and address divergent operational histories.
Preserve local autonomy.
Local autonomy: Review local decisions against newly available context before resuming shared commitments where required.
Establish shared operational context.
Shared operational context: Compare and reconcile different accounts without concealing unresolved contradictions.
Make authority explicit, scoped and dynamic.
Explicit authority: Establish which instructions were issued, received, applicable and known to each participant at the relevant decision points.
Coordinate competing intentions.
Coordinated intentions: Reconcile outstanding commitments, deviations, exceptions and reported outcomes.
Federate across system boundaries.
Federation: Re-establish participation, verify relevant participant state and selectively synchronise information.
Accumulate operational evidence.
Operational evidence: Correlate divergent histories and establish what can—and cannot—be verified.
What the stress test reveals
Local autonomy is not the opposite of coordination.
Participants need sufficient independence to operate without constant communication, bounded by mission conditions, local constraints and delegated authority.
Shared context does not require agreed truth.
Participants can exchange relevant observations and assessments without adopting identical world models. In contested environments, disagreement itself may be operationally significant.
Authority cannot depend entirely on continuous connectivity.
A restriction that never reaches a disconnected participant cannot be enforced remotely. Permissible disconnected behaviour and escalation conditions must therefore be established in advance.
Intentions, commitments and outcomes are different things.
Proposing an action, accepting a task and reporting completion do not establish that the intended physical effect occurred.
Federation must tolerate separation.
Operational dependencies may remain while communications disappear. The objective is bounded local behaviour during separation and accountable reconciliation afterwards.
Evidence must preserve uncertainty.
Reconnecting participants does not automatically make their operational histories consistent.
An OS for Shared Spaces must support coherent participation without a globally consistent picture, continuous connectivity or a single controlling intelligence, while keeping explicit agreement wherever authority or commitments require it.
04 · DEPLOYMENT COMPLEXITY
THREE SPACES. THREE DIFFERENT COMPLEXITY PROFILES.
The six OS design requirements apply to factories, cities and battlefields. What changes are the operating conditions under which they must be satisfied.
Three dimensions help us compare those environments: environmental uncertainty, operational coupling and authority dispersion.
These are qualitative, scenario-dependent profiles—not maturity levels, performance scores or a ranking of which environment is most complex.
ILLUSTRATIVE SCENARIO PROFILES
- Factory
- City
- Battlefield
The City band on operational coupling shows episodic, incident-driven variation. Marker shapes and vertical offsets distinguish the scenarios; only horizontal position relates to the scale.
Environmental uncertainty
Battlefield: Information may be incomplete, contradictory or deliberately deceptive. The architecture must preserve provenance, freshness and uncertainty.
ENGINEERED / BOUNDEDDYNAMIC
Illustrative positions: Factory is nearer the engineered and bounded end. City is towards the dynamic end. Battlefield is beyond City towards higher environmental uncertainty.
- Factory
- Often engineered and bounded.
- City
- Dynamic, open and partially observable.
- Battlefield
- Dynamic, partially observable and deliberately contested.
Operational coupling
Battlefield: Operational dependencies remain even when connectivity is lost. Disconnection does not eliminate interdependence.
ISOLATEDHIGH
Illustrative positions: Factory and this Battlefield medical evacuation have comparable strong coupling. City spans lower coupling through strong incident-driven dependencies.
- Factory
- Typically strong dependencies across production and safety systems.
- City
- Variable coupling that can become strong during emergencies.
- Battlefield
- Strong mission dependencies in the illustrative medical evacuation, even during communications loss.
Authority dispersion
Battlefield: Authority may be well defined institutionally yet difficult to exercise or verify dynamically when autonomous systems are disconnected from command.
CENTRALISEDDISTRIBUTED
Illustrative positions: Battlefield lies between the Factory and City authority-dispersion references, rather than at the maximum.
- Factory
- Often within an overarching organisational authority.
- City
- Independent operators, infrastructure owners and public services.
- Battlefield
- Formal command hierarchies combined with delegated authority, multinational responsibilities and coalition boundaries.
THREE ENVIRONMENTS. DIFFERENT COMBINATIONS OF COMPLEXITY.
The factory combines relatively bounded conditions with strong operational coupling. The city introduces open, dynamic conditions and dispersed institutional authority, with dependencies that can intensify during an incident.
The battlefield adds deliberate contestation, potentially strong mission dependencies and authority exercised through delegation under degraded connectivity.
The differences matter more than any overall ranking. They determine which operating capabilities, interoperability mechanisms and assurance conditions a deployment requires.
Environmental uncertainty
How predictable, observable and stable is the operating environment?
Factories can often be engineered and bounded. Cities introduce dynamic and partially unpredictable conditions. The battlefield introduces deliberate manipulation by an intelligent adversary.
The challenge is determining which observations are trustworthy, relevant and current enough for a particular decision.
Architectural consequence: Cognitive alignment must preserve provenance, freshness, uncertainty and disagreement rather than present an apparently definitive picture.
Operational coupling
How strongly do participants depend on one another’s actions and decisions?
Factory systems depend on shared workspaces, resources and production decisions. City services can become interdependent during an incident. In the battlefield scenario, reconnaissance, transport, medical and command elements depend on one another’s observations, commitments and actions.
Operational coupling and connectivity are not the same thing.
Dependencies can remain even when communications are unavailable.
Architectural consequence: Action coherence must address dependencies, commitments, locally permissible execution and subsequent reconciliation.
Authority dispersion
How are responsibilities, permissions and decisions distributed across participants and organisations?
Factories operate within organisational authority; city systems are independently governed. Military hierarchies combine with delegation, multinational responsibilities and different information-sharing permissions.
The battlefield does not necessarily have greater authority dispersion than a city.
Its distinctive problem is that established authority can become difficult to exercise or verify dynamically during disconnection.
Architectural consequence: Operational federation must preserve institutional responsibilities and authority boundaries while supporting bounded autonomy.
Open framework questions
These are open questions:
- If adversariality is a cross-cutting stressor, how should it be assessed for a given deployment?
- Should operational coupling distinguish dependency strength from the availability of coordination mechanisms?
- Should authority dispersion distinguish where authority resides from whether it can be exercised and verified at a particular moment?
- Should operational criticality and consequences of failure be treated as separate risk and assurance modifiers?
05 · THE FUNCTIONAL RESPONSE
THREE CAPABILITIES. NO UNIVERSAL CONTROLLER.
An OS for Shared Spaces is a proposed set of operating capabilities and contracts through which independently developed cognitive systems can cooperate.
It does not require a new centralised command platform.
Its functions may be distributed across existing C2 systems, mission platforms, autonomy middleware, Operational Twins and edge infrastructure.
Cognitive alignment
Making different operational understandings usable together.
Establishes the relevant shared context while preserving provenance, uncertainty, conflicting assessments and independent local world models.
Participants need sufficient compatible understanding to interpret the information, constraints and dependencies relevant to cooperation, not identical representations or universal agreement.
A verified source identity does not prove an observation is correct. A prediction is not an established fact.
Operational federation
Enabling independently governed systems to participate together.
Establishes which participants and capabilities can cooperate, under which technical, organisational, national and institutional boundaries.
Supports discovery, identification, selective exchange, temporary participation and periods of disconnected operation.
Federation shares the minimum sufficient operational information required for cooperation, not every participant’s complete internal state.
Action coherence
Connecting intentions, commitments, execution and outcomes.
Enables participants to express intentions, negotiate commitments, coordinate dependencies and account for execution.
Distinguishes proposed actions from accepted obligations, reported execution from verified effects, and technical capability from permission to act.
During disconnection, actions remain bounded by previously established operating conditions. On reconnection, divergent commitments and outcomes must be reconciled.
None of these three capabilities is sufficient independently. Their value emerges from how they operate together.
CONCEPTUAL REFERENCE ARCHITECTURE
COGNITIVE BATTLEFIELD
FUNCTIONAL ARCHITECTURE
FEDERATED OPERATING LAYER · OS FOR SHARED SPACES
Cognitive alignmentMake different understandings usable together
Operational federationEnable independently governed participation
Action coherenceConnect intentions, commitments and outcomes
FOUR SERVICES SUPPORT ALL THREE CAPABILITIES
Operational TwinTask-relevant spatial, temporal and operational context, models, history and prediction.
Governance & authorityInstitutional responsibilities, delegated permissions, applicable constraints and accountability.
Human participation — across all three capabilitiesMeaningful supervision, interpretation, intervention and coordination between people and autonomous systems.
Operational evidenceTraceable observations, decisions, commitments, actions and outcomes, including context needed to assess reliability and applicability.
HUMAN PARTICIPATION CUTS ACROSS ALL THREE
SCOPED CONTEXT · CONSTRAINTS · INTENTIONS · COMMITMENTS · OUTCOMES
AUTONOMOUS SYSTEMS & SWARMSRECONNAISSANCE & TRANSPORTMEDICAL & HUMAN TEAMSCOMMAND STRUCTURES
CONCEPTUAL BOUNDARIES
Operational Twin, OS and C2 are not interchangeable.
Operational Twin
The Operational Twin grounds a bounded operation in its relevant physical and operational context, connecting observations, models, relationships and history.
Shared-space OS
The shared-space OS provides the operating capabilities and contracts through which independently operated systems participate, coordinate and act within that context.
C2
C2 establishes and supports legitimate military command, mission direction and operational accountability.
Their implementations may overlap. An Operational Twin can incorporate coordination capabilities. An existing C2 platform can provide OS functions. Autonomous platforms may maintain their own local representations.
The distinction is functional, not necessarily technological or organisational.
06 · HUMAN PARTICIPATION
THE OS DOES NOT REPLACE COMMAND.
Autonomous cognitive systems do not remove military command authority.
They add participants able to interpret conditions, generate plans and act at machine speed.
The challenge is preserving meaningful human command and accountability without teleoperating every permissible action.
Participation requires intelligible context.
Machines require structured context, machine-readable constraints and coordination mechanisms.
Human operators require intelligible information about intentions, observations, uncertainty, commitments and completed actions.
XR, simulation and spatial interfaces can provide powerful human views, but visualisation does not replace trustworthy evidence or legitimate command authority.
The OS supports the participation of cognitive systems in an operation. It creates no military command authority of its own.
07 · OPERATIONAL EXPERIENCE
LEARNING IS NOT AUTHORISATION.
The existing operational experience flywheel is:
Operate → Observe → Learn → Validate → Update
The battlefield introduces an explicit authorisation gate:
- Operate
- Observe
- Learn
- Validate
- Update
Authorisation here applies to introducing a validated capability, model, configuration or procedure into a defined operating envelope.
It is distinct from permission to execute an individual operational action.
Learning from an event does not automatically qualify a new model or authorise new behaviour.
Successful execution in one situation does not prove that the capability remains valid in another.
Operational learning creates opportunities for improvement. Assurance and authorisation determine which improvements may enter operational service.
08 · FROM DEMONSTRATION TO CAPABILITY
SHOULD EVERY NEW SYSTEM BE INTEGRATED FROM SCRATCH?
Defence organisations may acquire autonomous platforms faster than they can integrate, qualify and sustain them as operational capabilities.
Each new system must fit into existing C2, communications, data models, mission procedures, security arrangements, command relationships and qualification processes.
When integration remains bespoke, engineering, qualification and coordination costs can grow disproportionately as new autonomous systems and organisations join.
Software reuse
Reusable services, models, connectors, autonomous capabilities and mission applications.
Integration reuse
Stable interfaces, shared semantics, operating contracts and federation mechanisms.
Assurance reuse
Evidence structures, test procedures, scenarios and qualification artefacts whose applicability can be established for subsequent deployments.
Reusing a robotic skill does not automatically qualify it for another mission.
Reusing an adapter does not guarantee operational coordination.
Reusing an architecture does not guarantee that another organisation has the processes, skills and governance required to deploy it.
The long-term opportunity is to reduce the cost and complexity of turning autonomous systems into repeatable, trusted operational capabilities.
That requires technical architecture and organisational capacity to evolve together.
09 · FACTORY · CITY · BATTLEFIELD
THE STRESS TEST CLOSES. THE ARCHITECTURAL QUESTION STAYS OPEN.
The Cognitive Factory
Shows how tightly coupled industrial operations challenge the scalability of independently developed autonomous systems.
The Cognitive City
Shows how independent organisations, fleets, infrastructure operators and public authorities must coordinate without a single operational owner.
The Cognitive Battlefield
Shows how those same principles behave when information is contested, communications are disrupted and authority must operate through delegation and institutional boundaries.
You are hereNone of the three scenarios proves every shared space needs a new central platform.
Together they establish the growing importance of interoperability across independently developed cognitive participants.
What is the minimum shared operating capability that independently developed cognitive systems need to cooperate coherently, within legitimate authority and assurance boundaries, while preserving local autonomy?
COHERENCE WITHOUT CONTINUOUS CONTROL.
Intelligence stays with the participants. Authority stays with legitimate command.
The shared operating layer enables independent systems to coordinate when connected, remain within established boundaries when separated, and reconcile their actions when they reconnect.
Not one battlefield brain. A way for many intelligences to act together.
This analysis draws on experience with military C2, distributed simulation and LVC federations, alongside current Physical AI research. The battlefield scenario is a conceptual architectural stress test, not a report of a real military operation.