How 14 National-Security Bodies Keep Accountability While Accelerating Frontier AI

The new national security memorandum calls for an AI governance policy covering 14 agencies and offices within 90 days. Inside that deadline sits a question the document does not answer, and that question is the argument of this article: what will the unit of AI governance be? The convenient answer is the vendor model, because the model has a contract and a benchmark score. The convenient answer is wrong.

President Trump's memorandum seeks to accelerate adoption of frontier artificial intelligence across the national security enterprise. It calls for an AI governance policy covering 14 agencies and offices within 90 days. Separately, it calls for the Defense Department to rework its autonomous-weapons governance policy, also within 90 days. Ninety days is enough time to choose a unit of accountability once. It is not enough time to choose it twice.

The Model Is The Easiest Thing To Govern And The Least Useful

Under schedule pressure, the model becomes the default unit of governance for understandable reasons. It has a vendor and a price, along with a benchmark and a safety evaluation that someone else already wrote. You can point at it. A finished workflow is harder to write policy around: retrieval over agency data, prompt assembly, tool calls, policy controls, and a human analyst editing the output before it moves to a decision maker. Nobody sells the workflow as a product, so nobody arrives with a certificate for it.

There is also a procurement reflex at work. Contracts know how to buy a model: it has a version number and an invoice line. Policy inherits what procurement can name. The result is a governance document that certifies the one component least likely to be the proximate cause of a failure, while ignoring everything the agency actually assembled around it.

But the workflow is the thing that acts on the mission. The model never queries a watch list by itself and never signs the finished product. Every capability the memorandum wants to accelerate is a chain of handoffs, and a chain is governed at its links or not at all.

A Model-Level Audit Cannot Locate A Workflow Failure

Suppose an AI-assisted product reaches a principal and turns out to be wrong. The failure could sit in seven places: the base model, the retrieval that fetched stale or corrupted context, the prompt that framed the question, a tool call that failed silently, a policy control that stripped the one document that mattered, the human edit that introduced the error, or the handoff between any two of these. A model-level audit distinguishes none of them, because in each case the model did exactly what it does: it produced plausible text from the inputs it was given.

Austria is running this experiment in public right now. Der Standard reported that a federal AI tool rolled out for judges and prosecutors was not connected to databases. Parliament is demanding an explanation. Note where the problem sits: in the first handoff in the workflow, the one a model audit never inspects.

Data poisoning follows the same geometry. Adversaries can compromise defense AI by corrupting the data used to train and operate models, which puts the attack surface in the pipeline rather than in the checkpoint alone. Sen. Jim Banks has urged officials to address insider threats to AI systems and to obtain information from frontier AI companies about their risk-mitigation efforts. If the unit of governance is the vendor's model, the evidence about your own risk sits in someone else's building, released at someone else's discretion.

The Vendor Is A Variable, Not A Foundation

The Pentagon has been using Anthropic's technology as part of a 200 million dollar Defense Department pilot program. Then President Trump ordered the Pentagon and every federal agency to stop using Anthropic's AI tools, with a six-month phaseout at the Defense Department. We take no position here on the merits of that order. The structural lesson stands on its own: every governance artifact anchored to that specific model, from evaluations to accreditation memos, lost its referent in a single directive.

An agency that owned the orchestration layer around that model would have absorbed the order as a component swap. Same logs and the same provenance chain, with a different engine and a measurable before-and-after on end-to-end performance. An agency that governed at the model level starts over. The lesson generalizes beyond any one firm. Models will be deprecated and superseded, and they will be banned and outbid, over the life of every program these 14 bodies run, and a governance regime that cannot survive a model swap is not a regime; it is a dependency. Vendor churn is not an edge case in this market. It is the market.

The Pentagon Already Knows This Move In Cyber

The Pentagon's Cyber Effects-as-a-Service model contracts for specific outcomes rather than specific tools. That is the correct unit, stated plainly in an adjacent domain, and the Army's Project Griffin points the same direction. The Army selected Amazon Web Services and World Wide Technology for the 2.6 million dollar cyber-defense pilot on October 23, 2026. Project Griffin aims to build an autonomous platform that helps Army cyber defenders detect, divert and deceive threat actors faster. The honest test of that pilot is whether defenders get measurably faster end to end, not whether any single component scores well in isolation.

Translated into governance for the 14 covered bodies, outcome-level accountability has four concrete requirements. First, agency-controlled logs for every model call, every retrieval, every tool invocation, every policy control decision, and every human intervention, held by the agency rather than exported as vendor telemetry. Second, testable handoffs, meaning each boundary in the workflow gets its own evaluation so a failure can be localized instead of litigated. Third, the safeguards a recent Eurasia Review analysis recommended for AI near nuclear decision-making apply wherever decisions matter: preserve independent evidence, competing explanations, opportunities for challenge and real decision time, tested in exercises. Fourth, nothing scales until the first three exist.

What Retrofitted Oversight Costs

The United Kingdom is paying the bill for learning this late. An independent audit found that AI promises made to the government by Capita failed to materialize in a civil-service pension project. Minister Sally Jameson said Cabinet Office officials had gained access to the relevant Capita systems and would monitor them every day. Daily human surveillance of a contractor's systems is what accountability looks like when it was not designed in at the start. Separately, a UK government watchdog has been considering an investigation into the Home Office's use of generative AI tools to process asylum applications.

That pattern repeats across jurisdictions: where provenance is absent, oversight arrives afterward, and it arrives external and expensive. The deeper warning in the pension case is about believing capability claims at contract signature instead of verifying outcomes in operation. An after-the-fact audit is the most expensive possible way to learn what a designed-in log would have shown continuously, for free. Logging built in costs engineering hours. Oversight bolted on costs audits and investigations, and it costs trust.

The 14 covered bodies get to choose which invoice they receive.

Own The Platform, Govern The Outcome

There is a generational way to say all of this. Generation 1 adoption is an isolated frontier model, rented and governed as a product, benchmarked on its own. Generation 2 is that same model inside an architecture the agency owns: teams of models that solve and check the work while enforcing safety and compliance, measured by the finished outcome, including the human editing at the end. The unit of governance falls out of the architecture: own the orchestration layer and the logs and handoff tests are yours by construction. Rent only the model and you govern a sealed box that a single directive can remove from under you.

Our team at Kibernan has published six complete, costed engineering programs, and every figure in them carries its maturity label, from modeled and specified to calculated and objective. They are proposals. No Kibernan hardware has been built or fielded, and we say so in writing. We cite this not as a credential but as an existence proof that provenance discipline is practical at program scale: state what you know and label how you know it, attaching the evidence where the claim is made. The 90-day governance policy should demand the same of every AI workflow before it scales.

The memorandum seeks to accelerate frontier AI adoption, and we expect that acceleration to proceed. The open choice is what gets held accountable when it does. Hold the workflow: require agency-controlled logs for every model call, every tool invocation, every control decision, and every human intervention, and evaluate the end-to-end outcome against a stated baseline. Refuse to scale anything that cannot show its chain of custody. A model is a component; accountability belongs to the finished thing.