Autonomous Weapons Treaties Should Verify Permission, Not Intelligence – OpEd

Key Takeaways:

• Geneva’s CCW experts close a three-year mandate this week; the November Review Conference can open talks on a binding treaty, extend debate, or let momentum fade. Many states and the ICRC call the June rolling text a sufficient basis; the U.S. and Russia opposed the latest UNGA resolution.
• The author argues the wrong object is being regulated. Model weights are secret, changeable and unread by inspectors. Successful arms control (New START, CWC, INF) verified hardware, facilities and activities—not software “intent.”
• Regulate the permission layer instead: what a system may target, where, when, and whether it needs fresh human authorization; revocation; tamper-evident logs. Declare and attest that envelope without revealing weights. Human control becomes inspectable; models stay secret. November should pick this verification object and mandate annexes later.

Geneva has spent a decade debating what military AI can decide. A workable treaty should ask a more verifiable question: what is a fielded weapon technically permitted to do without fresh human authorization?

An inspector cannot ask a neural network what it intended to do. That does not make autonomous weapons unverifiable. It means diplomats may be trying to inspect the wrong thing.

That distinction matters now. In Geneva this week, the Convention on Certain Conventional Weapons’ Group of Governmental Experts on lethal autonomous weapons systems is holding the final session of its three-year mandate. Its chair, Ambassador Robert in den Bosch of the Netherlands, opened the meeting by reminding delegates that their report is due at the Seventh Review Conference on November 16–20. That conference could authorize negotiations on a legally binding instrument, prolong the discussion under another mandate, or allow the present momentum to dissipate.

There is real movement. On August 31, the African Group said the June rolling text was a sufficient foundation for negotiations. A Brazil-led group of 39 CCW contracting parties, joined by Nigeria and Thailand as observers, likewise called it a sufficient basis for the next stage. The International Committee of the Red Cross has described the text as a strong and sufficient basis and urged states to begin negotiating a binding instrument in 2027. The political divide nevertheless remains: the latest UN General Assembly resolution on autonomous weapons passed by 164 votes to six, with seven abstentions, while the United States and Russia were among the states voting against it.

The stalemate is usually described as a clash of interests. States seeking prohibitions emphasize humanitarian and legal risk; major military powers emphasize operational flexibility and strategic competition. That account is partly right. But Geneva also faces a clash over the object to be regulated.

For years, the debate has revolved around questions such as whether a weapon is “autonomous,” how much human control is meaningful, and what an artificial intelligence is capable of deciding. Those questions matter normatively. They are poor objects for verification. Model weights can be copied, replaced or retrained between inspections. A version can be cryptographically identified, but no inspector can infer every battlefield behavior by reading its weights. The same model can serve as an adviser in one installation and initiate an engagement in another, depending on the interfaces around it.

A treaty built primarily around the intelligence of an algorithm therefore reaches toward the component that is most secret, most changeable and least legible. It asks states to expose what they will be least willing to reveal, while still failing to establish what a fielded system is actually permitted to do.

Successful arms control has generally chosen a different object. New START relied on data exchanges, notifications and on-site inspections involving strategic offensive arms; it did not ask what a missile’s guidance software “intended.” The Chemical Weapons Convention verifies declared facilities, scheduled chemicals and relevant activities, and it provides for challenge inspections. The INF Treaty defined covered missile classes by observable characteristics such as range and verified elimination through declared hardware and on-site procedures. These regimes were not blind to purpose, but their verification systems centered on observable objects, configurations and activities rather than inaccessible cognition.

The corresponding object for AI-enabled weapons already exists. It is the permission architecture: the technical layer that determines what a fielded system may do even when its model recommends more.

Can the system select and engage a target without a fresh human authorization? Which limits on geography, time, target class and munition are enforced outside the model? Does its authority contract when sensors fail, disagree or move beyond validated conditions? Can an authorized person revoke its ability to act, and how quickly? Are authorization events and engagements recorded in a tamper-evident form? These are not questions about how intelligent the model is. They are questions about how authority is wired.

A future instrument could require that this layer be small enough to test, separable enough to inspect and independent enough to constrain the model it governs. Its configuration could be declared. The approved configuration could be verified through remote attestation, a technical pattern used to provide evidence about a device’s operational state. Inspectors could compare the attested configuration with a treaty-approved reference, conduct challenge inspections, and review signed logs after an incident.

Attestation is not magic. It depends on trustworthy hardware, secure keys, disciplined supply chains and access rules that states would have to negotiate. It should therefore be one part of a layered regime, combined with declarations, sampling, physical inspection, event logging and consequences for detected violations. Arms control has never relied on a single sensor or a single promise.

The crucial asymmetry is that a state can update a model behind an apparently unchanged interface unless provenance and deployment are governed. By contrast, an independently enforced permission layer can be designed so that altering it changes a measurable configuration and produces a signed record. The model may remain opaque. The grant of authority need not.

This also answers the strongest secrecy objection. States will not disclose the weights, training data or operational methods of their most capable targeting systems, and a workable treaty should not demand that they do so. Permission verification asks a narrower question. A state demonstrates that a system cannot perform the prohibited act or cannot perform it without the specified human authorization without explaining how the system performs lawful tasks. The secret stays secret; the constraint becomes visible.

There is a useful precedent in nuclear use control. In 1960, Sandia developed the permissive action link, a coded electromechanical lock intended to prevent unauthorized use of a United States nuclear weapon. A PAL was not itself an international inspection regime, and the analogy should not be stretched that far. Its importance is architectural: a policy decision was converted into a constraint enforced at the point of action. Possession of the weapon was not enough; valid authorization was also required.

Autonomous weapons need a functional equivalent not a single universal lock, but an authorization gate whose rules can be declared and whose state can be verified. That would convert “human control” from a diplomatic aspiration into an inspectable property of a deployed system.

For Geneva, the payoff is immediate. The rolling text follows a two-tier structure: some systems would be prohibited, while others would be regulated through restrictions and other safeguards. This week’s debate has focused increasingly on the operational content of human judgment and control. On September 2, delegates were still contesting language on testing, predictability, reliability, traceability, explainability and human involvement across the system life cycle. Those concepts are important, but they become enforceable only when translated into technical limits that survive contact with the fielded weapon.

A permission-based protocol could give the regulated tier that content. For each covered system, states would declare the outer authority envelope: the permitted mission, location, duration, target class and munition; the conditions requiring renewed human authorization; the triggers that contract or suspend authority; the approved revocation path; and the records that must be retained. Treaty parties could then agree which elements require continuous attestation, which are subject to routine inspection, and which may be tested through a challenge procedure.

This approach also cuts through the definitional war that has consumed years. Instead of asking only whether a system is autonomous, an instrument can ask whether it is technically permitted to engage a target without the human authorization the treaty requires. The first question invites disputes about intelligence, learning and degrees of independence. The second can be answered yes or no for a particular configuration in a particular mission.

The obvious objection is that a state could pass an inspection and reconfigure the system afterward. That is a compliance problem, not a unique defect of this proposal. Every verification regime confronts the possibility of concealment, breakout or an undeclared parallel capability. The standard response is to raise the probability and cost of detection through declarations, notifications, tamper indicators, inspections and national technical means. Permission architecture is unusually suitable for that discipline because a treaty can require changes to be authenticated and logged.

Nor would this framework force militaries to accept one operational model. A requirement for human authorization need not mean a person approving every defensive interception under every condition. The treaty can distinguish target classes, mission types and bounded defensive uses. What matters is that the relevant authorization rule be specified in advance, enforced outside the learning system and verifiable afterward. Flexibility should exist inside a declared envelope, not in the power to redraw the envelope invisibly during use.

That is also why major military powers should take the proposal seriously. It protects their most sensitive models while testing claims they already make in national policy. The United States’ Directive 3000.09, for example, requires autonomous and semi-autonomous weapon systems to permit appropriate levels of human judgment, operate within specified temporal, geographic and operational constraints, and terminate an engagement or seek additional operator input when they cannot do so. Permission verification would not demand the surrender of those systems’ crown jewels. It would ask states to make selected constraints provable rather than rhetorical.

The November Review Conference does not need to settle every cryptographic standard. It needs to choose the correct verification object and give negotiators a mandate to develop it. The technical annexes can follow, as they did in earlier arms-control regimes. The political decision comes first: regulate the authority a weapon receives, then verify the architecture that enforces it.

Geneva has spent more than a decade asking what a weapon can think. The more answerable question is what a state has allowed it to do. Treaties have never needed to know what a weapon thinks. They have needed to know what it was allowed to do, and who could stop it.