America's Drone Strategy Has a Governance Problem Too

A recent Iron Triangle column in The Cipher Brief described the Drone Dominance Program's supply chain as a structure built on Chinese components and patriotic press releases. The diagnosis is correct as far as it goes. While the Pentagon fixates on the hardware supply chain - neodymium, flight controllers, brushless motors - it is ignoring a dependency just as dangerous, and far less visible: the governance infrastructure for the autonomous systems those drones are becoming. We are not building drones anymore. We are building autonomous decision-making agents. And we have no sovereign infrastructure to prove those agents acted within the authority we gave them.

From Ammunition to Autonomy

The column correctly identifies that reclassifying drones as Class V ammunition represents a philosophical shift from quality to mass. But the deeper shift isn't about quantity - it's about cognition. The same Drone Dominance Program that demands 150,000 airframes by Phase IV also demands Automatic Target Recognition, electronic warfare resilience, and fiber-optic tethering for autonomous operations. These are not features of ammunition. They are features of autonomous agents - systems that perceive, decide, and act with diminishing human involvement at each generation. The Small Wars Journal recently published a maturity framework for disciplined autonomy in sUAS that makes this explicit: by 2035, "humans define intent; AI executes." The OODA loop doesn't just compress - it delegates. And when we delegate lethal authority to machines, the question is no longer "did we build enough drones?" but "can we prove each one acted within the scope of authority a commander assigned?" Right now, the honest answer is no.

The Accountability Gap Is Already Here

International humanitarian law requires distinction, proportionality, and precaution. These principles assume a human making a decision. When an AI system selects and engages a target, current legal frameworks cannot reliably attribute responsibility to any specific person - not the programmer, not the operator, not the commander. The Lieber Institute at West Point calls this the "accountability gap," and over 120 countries have now endorsed negotiations toward an international treaty on autonomous weapons systems precisely because this gap is widening faster than law can follow. But the accountability gap isn't just a legal abstraction. It's an engineering problem. And the engineering community's current answer - audit logs - is dangerously insufficient. Audit logs are mutable, after-the-fact records generated by the system they're supposed to monitor. In adversarial scenarios, they become contested artifacts. Salt Typhoon demonstrated that even tier-one carriers' internal logging infrastructure can be silently compromised for years. If a state-level adversary can live inside our telecommunications systems undetected, what confidence should a commander have that the action logs of an autonomous weapons system weren't tampered with between the moment of engagement and the moment of review? The Pentagon's answer, as of February 2026, is to ask AI vendors to promise they'll behave. The Anthropic-DoD dispute showed exactly how well that works. When the Department of Defense demanded unrestricted "any lawful use" language that could permit lethal targeting without meaningful human authorization, Anthropic walked away. OpenAI rushed to fill the gap in what its own former robotics lead described as a deal where "the policy guardrails were not sufficiently defined." Meanwhile, DoD Directive 3000.09, the governing policy for autonomy in weapons systems, has produced no public evidence of how many autonomous systems have been reviewed under its framework. Contractual guardrails are not governance. A promise from a vendor is not proof of compliance. And an audit log from the system that executed the strike is not evidence that the strike was authorized.

The Missing Infrastructure Layer

NIST recognized this gap in February when it launched the AI Agent Standards Initiative, the most consequential federal action yet on autonomous AI governance. The quiet message beneath the press release is significant: autonomous AI systems present identity, authorization, and security challenges that existing frameworks were not built to handle. NIST is signaling that agent identity, authorization scoping, and activity verification will transition from technical best practices to compliance obligations. But NIST is describing the problem, not building the infrastructure. The actual requirement - and the strategic vulnerability - is a mechanism that produces independent, tamper-evident proof that an autonomous agent acted within its authorized scope at the moment of action. Not a log reviewed after the fact. Not a vendor's contractual promise. Not a periodic audit that says a control was operating over a six-month window. Proof. At the moment of decision. Signed cryptographically. Verifiable by any authorized party without trusting the system that generated it. This is the governance equivalent of what the column calls "picks and shovels." Everybody wants to fund the drone. Nobody wants to fund the evidence infrastructure that makes the drone's actions legally defensible, operationally accountable, and strategically auditable.

A Supply Chain Problem by Another Name

The parallel to the column's hardware argument is almost structural. Just as we cannot manufacture 150,000 NDAA-compliant airframes because we surrendered rare-earth processing to China, we cannot govern 150,000 autonomous agents because we never built the governance infrastructure in the first place. The hardware supply chain is throttled by neodymium bottlenecks and patriotic red tape. The governance supply chain doesn't exist. And just as waiving NDAA compliance on hardware components would fund Chinese manufacturing at the expense of domestic industrial capacity, cutting corners on governance infrastructure would create systems that cannot be audited, cannot be defended in legal proceedings, and cannot produce the evidence that international humanitarian law requires when lethal decisions are delegated to machines. The CNSA 2.0 timeline makes this even more urgent. NSA mandates that all national security systems must support post-quantum cryptographic algorithms by 2027 and complete migration by 2035. Every governance record, every authorization proof, every chain-of-custody artifact for autonomous weapons systems that is signed with classical cryptography today has an expiration date. If we build governance infrastructure now using RSA or ECDSA signatures, adversaries with sufficient quantum computing resources will eventually be able to forge or repudiate those records. The evidentiary foundation of accountability collapses retroactively. Quantum-safe governance infrastructure is not a nice-to-have. It is a precondition for any autonomous system whose actions may be subject to legal review in 2040 or 2050 - which is to say, all of them.

What Needs to Happen

Investors funding the next generation of defense technology should hear this clearly: the opportunity is not in the drone. It is in the evidence layer that makes the drone's autonomy legally and operationally viable. We need sovereign, domestically built governance infrastructure that produces cryptographic proof of authorized action - independent of the system being governed, verifiable by third parties, and resistant to quantum-era cryptanalysis. Congress should codify governance attestation requirements for autonomous weapons systems, not as voluntary guidelines but as statutory mandates tied to acquisition. NIST's AI Agent Standards Initiative should prioritize interoperable governance receipt standards that work across platforms, across vendors, and across classification levels. The Department of Defense should require that every autonomous system fielded under the Drone Dominance Program produce tamper-evident, independently verifiable evidence of authorization - not as a Phase IV afterthought, but as a Phase I requirement. During World War II, Ford didn't just build B-24s at Willow Run. Every aircraft had a paper trail - inspection records, quality certificates, chain-of-custody documentation - that proved it was built to specification. The evidence infrastructure existed alongside the production infrastructure because nobody would put a crew in an unverified bomber. We are now building autonomous systems that will make lethal decisions without a crew onboard. The case for governance infrastructure is not weaker. It is stronger. We should fund it accordingly.