From Formal Authority to Practical Human Control

Setup: cases, records, and selection

The unit of analysis is one bounded machine-mediated decision or action sequence. The study uses a functional system definition: Oko concerns early-warning inference; the Patriot cases concern automated detection, classification, and engagement support. These historical systems differ materially from present learned models.

Screening stopped when each stratum was filled. The unscreened candidates were not rejected, and the selected cases are not a representative sample. The design demonstrates how the procedure behaves under anticipated evidence conditions. Source material under publication review.

Why these three cases?

The selection figure records five screening decisions from a preserved pool of 928 candidates. Three cases filled the predefined strata, two were excluded, and the remaining 923 were left unscreened.

Figure 1 · How to read this figure

Candidate counts describe procedure execution, not prevalence. Unscreened records have no exclusion decision.

For an assurance team, a frozen selection rule makes it possible to inspect why these cases were chosen. Use it to distinguish a method demonstration from evidence about how often a problem occurs.

How the assessment works

Each case packet is assessed against six connected conditions. The sequence makes it possible to ask where a claim of practical control loses support.

Missing evidence is a distinct finding

A missing log does not by itself show that an intervention never occurred. The distinction between unsupported and indeterminate prevents that inference.

Case-level rule: all required stages supported means Pass; any required stage unsupported means Fail; otherwise, partial or indeterminate support means Unresolved. The states have no numeric distance and produce no aggregate control score. Correction, repair, and reform are separate post-event propositions. Source material under publication review.

Was there enough time to intervene?

For AI operations teams, intervention feasibility is a concrete design question. A stop control is useful only if a person can receive the information, interpret it, decide, transmit the instruction, and affect execution before commitment.

The manuscript proposes an intervention margin for prospective systems with complete timestamps:

The first term is the time from information access to irreversible commitment. The second is the total time needed to understand, decide, communicate, and make the intervention take effect. Every duration must use the same unit.

A nonnegative margin is a necessary timing condition under this proposed measure. It is not sufficient to establish the full control chain. Missing inputs leave timing indeterminate. The historical packets do not contain enough timestamps to calculate this margin. Source material under publication review.

Results: authority and practical force diverge

Both Patriot packets support intervention authority, while other required conditions lack support. Oko has partial support across all six stages. Figure 2 shows the proposition-level findings, including the separate post-event propositions below the horizontal rule.

The two Fail results do not erase differences in the evidence. For F/A-18C, unavailable inquiry material, logs, and displays leave several stages indeterminate. Oko’s retrospective sources support a bounded account but do not supply a located contemporaneous command record. Source material under publication review.

Figure 2 · How to read this figure

Oko uses the v0.6.0 reassessment; both Patriot cases preserve their v0.3.0 assessments. Exact state labels and source references appear below.

For technology and operations leaders, the useful distinction is between delegated authority and the conditions needed to exercise it. In a new review, ask for evidence at each stage before relying on the oversight claim.

Where did human judgment enter the sequence?

A stage classification becomes easier to interpret within the event. The reconstructed paths show the order of machine output, human judgment, and institutional action. They also expose where the public evidence stops.

For an investigation team, the practical question is whether records connect each handoff. A narrative that reaches the final outcome can still leave the point of human intervention unresolved.

Figure 3 · How to read this figure

Horizontal position indicates order, not a shared elapsed-time scale. The dotted F/A-18C segment marks missing evidence about timing, displays, source independence, and feasible challenge.

For an incident investigator, the sequence identifies the handoffs that need linked records. It helps frame requests for timestamps, displays, decisions, and execution logs while preserving gaps in the public account.

What does the record support about reliance?

The six control stages are one part of TAE. Separate propositions examine the evidence available for justified reliance. These findings should not be merged into a single score.

A technical leader can separate two questions: did a human have practical control over this action, and what evidence justified reliance on the system? Answering one does not automatically answer the other.

Figure 4 · How to read this figure

Conditional reliability and calibrated uncertainty are unsupported across all three packets; record integrity is indeterminate. This does not rank the systems or establish their general trustworthiness.

For a system owner, control over an action and evidence for reliance are separate questions. This matrix provides a vocabulary for recording what remains unknown before making a stronger reliability claim.

How much of each control chain is supported?

The distribution of evidence states shows why these outcomes need different explanations. Partial support records evidence with a material gap. Indeterminate records insufficient evidence to decide.

Figure 6 · How to read this figure

These counts are not a missingness rate, aggregate control score, or reliability estimate. No numeric distance is assigned between states.

For a review lead, the mix of states helps explain why different findings require different follow-up. An indeterminate stage calls for better evidence; an unsupported stage calls for examining the condition the record contradicts.

Why the Oko finding changed

The v0.3.0 assessment classified all six Oko event-level stages as supported. A later adjudication froze a stricter direct-and-contemporaneous evidence rule before reassessment. Applying that rule to the same packet changed each stage to partially supported.

This is a change in evidentiary support, not a discovery that the historical action did not happen. Preserving the earlier result makes the effect of the changed rule inspectable. Source material under publication review.

Figure A4 · How to read this figure

The packet, evidence cutoff, stage questions, and historical sources were unchanged. The table records each missing contemporaneous document or link.

For an institution maintaining an assurance record, preserve the old finding, the new rule, and the reason for the change. That makes a correction understandable without erasing the earlier assessment.

What has been tested about the method?

The repository includes controlled changes to synthetic evidence. Each test asks whether the assessment changes where expected, or stays unchanged when the altered feature should not affect it.

For example, evidence arriving after an action should defeat a pre-action access finding; changing a case title should leave the assessment unchanged. These checks test internal behavior. They do not measure whether independent investigators agree or whether the classifications are accurate in the field.

Hashes and version manifests help reconstruct the artifact path. Preserving bytes cannot establish the truth or completeness of their content. Source material under publication review.

Figure A1 · How to read this figure

The same author designed the fixtures, code, mutations, and expected results. Matching those expectations does not independently reproduce the historical assessments.

For evaluation engineers, these tests illustrate how to check that relevant evidence changes affect the intended output and irrelevant changes leave it stable. Independent judgment and field validity still require separate tests.

Can the analysis be traced and checked?

The artifact path connects a frozen input to an assessment, a derived table, and the figure the reader sees.

A further check asks whether a claim is eligible to support a conclusion. TAE separates traceability, integrity, support, evidence fitness, and dependency closure. A well-linked claim can still lack the kind of evidence needed for a stronger inference.

Figure A2 · How to read this figure

Hashes detect changes to stored files. They cannot establish source truth or completeness.

For an AI operations team, the lineage offers a model for connecting the report people read to the exact inputs and transformations that produced it. Reproducing the artifact path is only one part of validating the conclusion.

Figure A3 · How to read this figure

Passing linkage or integrity checks does not establish independent validity. Later manuscript retrieval checkpoints are explained separately below.

For assurance reviewers, the key question is whether the evidence is fit for the conclusion. An intact citation trail alone cannot authorize a claim about independent validity or deployment readiness.

How was the contribution checked against prior work?

The formal search records what was retrieved and how review proceeded. It bounds the contribution claim to the sources actually reviewed.

Closing a review queue is different from completing all literature coverage. The remaining inaccessible records and authenticated databases constrain claims about originality.

Figure 5 · How to read this figure

The right panel uses a logarithmic count axis. The later manuscript checkpoint records 107 retrieval outcomes from the 1,087-record group, leaving 980 open. It does not replace this historical figure.

For researchers and institutional reviewers, a search record makes the scope of a novelty claim inspectable. Open retrieval and screening work should remain visible when the contribution is described.

Paper, data, and version history

Primary manuscript: Mark Julius Banasihan, From Formal Authority to Practical Human Control: A traceable method for reconstructing human control in automated decisions, preprint v0.17.0.

Source material under publication review

The submission watermark is not presented as a public arXiv identifier or evidence of acceptance. The earlier v0.14.0 DOI is not assigned to this manuscript. The local PDF is an unchanged copy supplied by the author.

Artifact provenance

Source figures are reproduced unchanged from revision 781f7806a626cd4e4fffbe4d453d9d5365b835f9. © 2026 Mark Julius Banasihan. The full publication set includes decision paths, trust-evidence states, selection, search, and integrity figures included in this expanded article.

This page is a web summary of the manuscript and source artifacts. Editorial admission remains provisional; this presentation does not independently validate the historical evidence.