The Right to Stop Is Not a Right to Strand

The Governed Autonomy Doctrine is written, start to finish, as a discipline for preventing unsanctioned action. Law 5 says a human must be able to inspect, interrupt and override at every layer. The proposed conformance layer adds the rule its authors call the most valuable in the revision: an action whose governing criteria cannot be evaluated does not proceed. Make the governing system unreachable, attempt a governed action, confirm it fails closed.

That rule is right. We would not deploy an agent that does anything else. And it is incomplete in a way that matters more in federal health and benefits than anywhere else the doctrine is likely to be applied.

The case the doctrine does not have

An agent is processing a Veteran’s continued-eligibility review. It has retrieved the record, drafted the determination, and is one step from routing it to the adjudicator’s queue when the policy engine stops answering. Fail closed: the action does not proceed. Correct.

Now what? The doctrine’s answer is that a human may intervene. It does not say that the halted review is now someone’s obligation, that the record the agent was holding is in a known state, that the adjudicator’s queue knows an item is missing, or that anyone is measuring how long the Veteran waits. A stop that nobody owns is not a safe state. It is a claim that fell off the conveyor.

OMB M-25-21 already knows this. Its minimum practices for high-impact AI require an appropriate fail-safe that minimizes the risk of significant harm, and its impact assessment has to document potential impacts “of using or not using AI.” The memo’s only hard stop is that a non-compliant high-impact use case must be safely discontinued. Not discontinued. Safely. And the presumed high-impact categories include applying for or adjudicating critical federal benefits, continued-eligibility determinations, patient diagnosis and treatment, and allocation of care. That is VA’s core business, named in the memo as the place where the harm of an interrupted process is a first-class risk.

The doctrine has a right to stop. The memo has an obligation not to strand. Both are needed, and the second one is older.

Fail-closed, fail-safe, fail in known state

NIST SP 800-53 has carried three different controls for this since long before agents. SC-24, Fail in Known State: on failure, the system lands in a defined state that preserves the information needed to recover. SI-17, Fail-Safe Procedures: defined procedures for defined failure conditions, executed by defined people. CP-10, System Recovery and Reconstitution: getting back to a known good state within a stated time.

The doctrine’s fail-closed rule is roughly SC-24 for the single action. What an agentic deployment in a benefits or clinical workflow needs, and what the doctrine does not yet ask for, is the other two applied to the mission the agent was in the middle of.

Concretely, a stop path for a consequential workflow has four parts the doctrine should name.

A commit point. For every consequential action, the point past which the action is done and before which it can be abandoned without effect. The conformance layer’s revocation criterion says a halt is honored before the next commit. It does not define commit for work already dispatched to another system. A referral order sent to a community care vendor has a commit point in that vendor’s system, not in the agent’s.

A known state on halt. What the agent was holding, where it is, and who can see it. In a records environment this is also a privacy question: a halted agent that still holds a Veteran’s record in its context is a disclosure risk that the halt did not remove.

An owner and a clock. Halted work has to appear in a human queue with the same timeliness obligations the work had before the agent touched it. If the agent was inside a process with a statutory or policy deadline, the halt does not pause the deadline. This is the piece the doctrine’s operational vocabulary lacks entirely: it governs what the agent may do, never what the agency still owes.

Containment separated from restoration. Who may stop is not who may restart. A security operations team should be able to halt any agent without asking the mission owner. Only the mission owner, or the authority that accepted the deployment’s risk, should be able to put it back in service, because the decision to resume is a decision about the harm of not acting, and that is theirs. The CISA Logging Reference Architecture makes a version of this a required content of Agency Logging Plans where AI operates on security telemetry: named human review points and documented fallback procedures. The same pair belongs in every mission plan an agent runs under.

Why this is a Law 5 problem and not an implementation detail

It would be easy to file all of this under “implementation profile” and leave the doctrine alone. We do not think that holds. Law 5 asserts a right. A right that can be exercised without any obligation attached to its exercise is, in a benefits or care setting, a mechanism for producing harm with clean hands. The CISA and NSA agentic guidance recommends restricting agents to low-risk, non-sensitive tasks precisely because nobody has yet shown a stop path that is safe for the other kind. An agency that wants to move past that ceiling has to be able to show one.

So the position we take, and the one we will bring to the doctrine’s review process, is that Law 5 needs a symmetric clause: intervention must not itself become the failure. Prevention before commit for irreversible actions, bounded halt latency for running work, a known state on halt, an owner and a clock for what was interrupted, and separate authority to contain and to restore. Each of those is measurable, which is what the Law currently is not.

The VA test

The value test for any of this at VA is not whether an agent can be stopped. It is whether the deployment reduces inappropriate access and unauthorized action while keeping the service to the Veteran dependable. A governance layer that passes the first half by failing the second is not governance. It is an outage with an audit trail.

An agency evaluating agentic deployments against the doctrine should add one question to every assessment, ahead of the conformance questions: when this agent is stopped mid-mission, what happens to the person the mission was for? If the answer is “a human may intervene,” the deployment is not ready. If the answer names a state, an owner, a queue and a clock, it might be.