Spacecraft Cannot Wait For Earth, Their Authority Must Be Decided Before Launch – Analysis
.jpg)
October 19, 2026
By Burak Oktenli
Key Takeaways:
It distinguishes human-governed autonomy—where crews or teams set purpose, limits, and conditions for local initiative in advance—from uncontrolled machine independence, citing examples such as Perseverance’s AEGIS target selection and AI-planned drives checked in digital twins.
The piece calls for precise mission mandates, state-reconciliation upon reconnection, and shared international evidence requirements under the Outer Space Treaty so that autonomous actions remain auditable and bounded even when contact is lost.
Mars is already showing the difference
NASA has been delegating carefully bounded tasks for years. In 2022, Perseverance’s AEGIS software chose particular rock targets for SuperCam observations under scientific objectives specified by the mission team. It did not invent a new mission. The robot selected among possibilities humans had already authorized.
The division of labor advanced in 2026. NASA announced the first AI-planned Perseverance drives after an Earth-based generative-AI system proposed waypoints that engineers checked in a digital twin before transmitting them to Mars. The trial should not be mistaken for an AI agent independently improvising every decision aboard the rover. Separately, the rover gained Mars Global Localization, allowing it to estimate its position using onboard images and orbital terrain maps without waiting for Earth to supply that estimate.
These are different forms of autonomy, but they support the same institutional idea. The mission team controls the assignment and the acceptance conditions. Onboard navigation or observation logic handles decisions that cannot sensibly await another round trip across interplanetary space. The key is to know where that delegation ends.
Give the machine a mandate, not a blank check
A useful mission authorization should be more precise than “continue unless someone objects.” It should identify the geographic or trajectory envelope, permitted action classes, science priorities, protected resource reserves, conditions for local recovery, and decisions reserved for renewed approval. These are engineering properties that can be checked against onboard state, not aspirations buried in a mission policy document.
Consider a rover that temporarily loses precise localization. If previously authorized checks recover a sufficiently reliable position, resuming its route within the approved corridor is execution of the original mandate. Driving into a region whose hazards have never been evaluated, consuming a protected emergency reserve or undertaking an irreversible operation may require a new authorization. A machine’s ability to recover its bearings is not permission to enlarge its goals.
Reentry makes the opposite failure obvious. A rover may be able to stop driving, preserve thermal protection and wait. A returning capsule cannot safely “pause” atmospheric descent. Its permitted response must be appropriate to its flight phase: maintain required guidance and stabilization, reject invalid inputs, and follow prequalified contingencies rather than wait for a radio call that physics prevents. A safe state is not one universal command. It is a mission-specific condition.
Delegation also has a cost in missed opportunities. A rare geological event may disappear before the next instruction from Earth. If permissions are so narrow that a spacecraft cannot use its instruments for a predictable class of fleeting opportunities, the safeguards defeat the mission. Mission designers should authorize carefully chosen classes of initiative, including their expected resource costs, before the event occurs. The aim is bounded action, not permanent hesitation.
Reconnection is a separate safety event
A surprising danger begins when communications return. A spacecraft may have moved, spent fuel, changed configuration or entered a different flight phase while Earth was silent. The first command waiting in the queue may have been correct when sent and wrong when received.
The IETF’s Bundle Protocol was built for networks with long delays and intermittent connectivity. It provides delivery and expiration mechanisms for stored data. But successful delivery, even before a message’s network lifetime expires, does not prove that the command remains appropriate for the spacecraft’s current state. That is an application-level authority check, not a property of the radio channel.
Reconnection should therefore include a state-reconciliation step before new consequential instructions take effect. The spacecraft and ground system should establish which commands were executed or rejected, which authorizations expired, what configuration is now active, and whether old instructions conflict with newer local actions. The evidence record should connect each autonomous choice to the rule, sensor information, software version and resource state that justified it.
Testing must encompass both sides of the silence. For Mars, introduce an outdated command, partial sensor recovery and an observation opportunity that expires while Earth is unavailable. For reentry, combine an expected blackout with an extended interruption and disagreeing measurements. Measure avoidable damage and missed mission opportunities. NASA’s systems-engineering guidance distinguishes meeting written requirements from demonstrating that the resulting system works in its intended environment. A system can obey its software rules perfectly and still have the wrong rules for the flight it encounters.
Why this is an international governance question
The issue is no longer confined to NASA. On October 12, the European Space Agency introduced NovaMoon as part of its effort to improve lunar positioning, navigation and timing. Its Moonlight program and planned Lunar Pathfinder relay are steps toward communications infrastructure serving future landers, rovers and other operators. Better connectivity will reduce some interruptions and increase the opportunities for coordination. It cannot abolish Mars’s speed-of-light delay, guarantee an uninterrupted service or replace a spacecraft’s need for valid local fallback behavior.
As government missions, commercial providers and international partners increasingly share lunar services, authorization and auditability become questions of responsibility as well as software engineering. Article VI of the Outer Space Treaty places international responsibility on states for their national space activities and requires authorization and continuing supervision of nongovernmental activities. It does not prescribe a particular autonomy design, and it does not demand continuous joystick control from Earth. It strengthens the case for explaining how meaningful supervision can persist across predictable communication gaps.
Space agencies and national licensing authorities could start with a modest common evidence requirement for consequential autonomous functions. Before launch, a mission would declare which decisions may be taken locally, how the permission expires or contracts when its factual basis fails, how exceptions are tested, and what record the vehicle will return. After a communication gap, operators should be able to reconcile the action history rather than simply celebrate the restoration of a signal. Such a requirement would not force different nations or companies to adopt the same control software or surrender their mission authority.
Human-governed autonomy is not a promise that someone on Earth will always be available to press “no.” It is a design in which humans have already defined the meaningful choices, the evidence that permits local initiative, and the process for reconsidering what happened. The farther exploration moves from Earth, the less credible a governance system becomes if it depends on a timely answer from home.
If a spacecraft can act only when Earth replies, its human-control plan fails at the moment it is needed most. The answer is to send human judgment with the spacecraft, in the form of tested authority that survives the silence.
About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →
.jpg)
October 19, 2026
By Burak Oktenli
Key Takeaways:
The article argues that ground-based, real-time human supervision is physically impossible during certain mission phases, such as lunar occultation, reentry plasma blackout, or Mars’s multi-minute light-time delays, requiring pre-authorized onboard autonomy rather than waiting for Earth.
It distinguishes human-governed autonomy—where crews or teams set purpose, limits, and conditions for local initiative in advance—from uncontrolled machine independence, citing examples such as Perseverance’s AEGIS target selection and AI-planned drives checked in digital twins.
The piece calls for precise mission mandates, state-reconciliation upon reconnection, and shared international evidence requirements under the Outer Space Treaty so that autonomous actions remain auditable and bounded even when contact is lost.
Artemis II lost contact behind the Moon and during reentry. Mars missions confront unavoidable signal delays. Human control in space must be designed into permissions, tests and recovery, rather than assumed to arrive over a radio link.
On April 6, 2026, NASA’s Orion spacecraft passed behind the Moon and lost contact with Earth for roughly 40 minutes. Four days later, during its return through the atmosphere, plasma surrounding the capsule interrupted communications again. NASA restored the link as Orion continued toward splashdown. In both cases, the spacecraft had to keep functioning while Houston could not talk to it.
Those silences had different causes: the Moon blocked the radio path, while atmospheric plasma interfered with the link during reentry. A Mars mission confronts a third limit. Depending on the planets’ positions, a signal from Earth takes roughly four to 24 minutes to arrive. A request for a new instruction and its reply can therefore consume nearly 50 minutes before any communication outage is added.
Artemis II carried astronauts and relied on established flight-control systems; it was not a demonstration of AI taking command. That distinction matters. The common lesson is more basic: ground-based, instantaneous human supervision is not always physically available. A mission designed on the premise that Earth will approve every consequential next step has a weakness no faster computer can fix.
The alternative is not uncontrolled machine independence. It is human-governed autonomy: people establish the purpose, operating limits and conditions of local initiative before contact is lost, while onboard systems carry out that authorization under testable rules. When the link returns, the mission must be able to show what happened and which permissions remain valid.
On April 6, 2026, NASA’s Orion spacecraft passed behind the Moon and lost contact with Earth for roughly 40 minutes. Four days later, during its return through the atmosphere, plasma surrounding the capsule interrupted communications again. NASA restored the link as Orion continued toward splashdown. In both cases, the spacecraft had to keep functioning while Houston could not talk to it.
Those silences had different causes: the Moon blocked the radio path, while atmospheric plasma interfered with the link during reentry. A Mars mission confronts a third limit. Depending on the planets’ positions, a signal from Earth takes roughly four to 24 minutes to arrive. A request for a new instruction and its reply can therefore consume nearly 50 minutes before any communication outage is added.
Artemis II carried astronauts and relied on established flight-control systems; it was not a demonstration of AI taking command. That distinction matters. The common lesson is more basic: ground-based, instantaneous human supervision is not always physically available. A mission designed on the premise that Earth will approve every consequential next step has a weakness no faster computer can fix.
The alternative is not uncontrolled machine independence. It is human-governed autonomy: people establish the purpose, operating limits and conditions of local initiative before contact is lost, while onboard systems carry out that authorization under testable rules. When the link returns, the mission must be able to show what happened and which permissions remain valid.
Mars is already showing the difference
NASA has been delegating carefully bounded tasks for years. In 2022, Perseverance’s AEGIS software chose particular rock targets for SuperCam observations under scientific objectives specified by the mission team. It did not invent a new mission. The robot selected among possibilities humans had already authorized.
The division of labor advanced in 2026. NASA announced the first AI-planned Perseverance drives after an Earth-based generative-AI system proposed waypoints that engineers checked in a digital twin before transmitting them to Mars. The trial should not be mistaken for an AI agent independently improvising every decision aboard the rover. Separately, the rover gained Mars Global Localization, allowing it to estimate its position using onboard images and orbital terrain maps without waiting for Earth to supply that estimate.
These are different forms of autonomy, but they support the same institutional idea. The mission team controls the assignment and the acceptance conditions. Onboard navigation or observation logic handles decisions that cannot sensibly await another round trip across interplanetary space. The key is to know where that delegation ends.
Give the machine a mandate, not a blank check
A useful mission authorization should be more precise than “continue unless someone objects.” It should identify the geographic or trajectory envelope, permitted action classes, science priorities, protected resource reserves, conditions for local recovery, and decisions reserved for renewed approval. These are engineering properties that can be checked against onboard state, not aspirations buried in a mission policy document.
Consider a rover that temporarily loses precise localization. If previously authorized checks recover a sufficiently reliable position, resuming its route within the approved corridor is execution of the original mandate. Driving into a region whose hazards have never been evaluated, consuming a protected emergency reserve or undertaking an irreversible operation may require a new authorization. A machine’s ability to recover its bearings is not permission to enlarge its goals.
Reentry makes the opposite failure obvious. A rover may be able to stop driving, preserve thermal protection and wait. A returning capsule cannot safely “pause” atmospheric descent. Its permitted response must be appropriate to its flight phase: maintain required guidance and stabilization, reject invalid inputs, and follow prequalified contingencies rather than wait for a radio call that physics prevents. A safe state is not one universal command. It is a mission-specific condition.
Delegation also has a cost in missed opportunities. A rare geological event may disappear before the next instruction from Earth. If permissions are so narrow that a spacecraft cannot use its instruments for a predictable class of fleeting opportunities, the safeguards defeat the mission. Mission designers should authorize carefully chosen classes of initiative, including their expected resource costs, before the event occurs. The aim is bounded action, not permanent hesitation.
Reconnection is a separate safety event
A surprising danger begins when communications return. A spacecraft may have moved, spent fuel, changed configuration or entered a different flight phase while Earth was silent. The first command waiting in the queue may have been correct when sent and wrong when received.
The IETF’s Bundle Protocol was built for networks with long delays and intermittent connectivity. It provides delivery and expiration mechanisms for stored data. But successful delivery, even before a message’s network lifetime expires, does not prove that the command remains appropriate for the spacecraft’s current state. That is an application-level authority check, not a property of the radio channel.
Reconnection should therefore include a state-reconciliation step before new consequential instructions take effect. The spacecraft and ground system should establish which commands were executed or rejected, which authorizations expired, what configuration is now active, and whether old instructions conflict with newer local actions. The evidence record should connect each autonomous choice to the rule, sensor information, software version and resource state that justified it.
Testing must encompass both sides of the silence. For Mars, introduce an outdated command, partial sensor recovery and an observation opportunity that expires while Earth is unavailable. For reentry, combine an expected blackout with an extended interruption and disagreeing measurements. Measure avoidable damage and missed mission opportunities. NASA’s systems-engineering guidance distinguishes meeting written requirements from demonstrating that the resulting system works in its intended environment. A system can obey its software rules perfectly and still have the wrong rules for the flight it encounters.
Why this is an international governance question
The issue is no longer confined to NASA. On October 12, the European Space Agency introduced NovaMoon as part of its effort to improve lunar positioning, navigation and timing. Its Moonlight program and planned Lunar Pathfinder relay are steps toward communications infrastructure serving future landers, rovers and other operators. Better connectivity will reduce some interruptions and increase the opportunities for coordination. It cannot abolish Mars’s speed-of-light delay, guarantee an uninterrupted service or replace a spacecraft’s need for valid local fallback behavior.
As government missions, commercial providers and international partners increasingly share lunar services, authorization and auditability become questions of responsibility as well as software engineering. Article VI of the Outer Space Treaty places international responsibility on states for their national space activities and requires authorization and continuing supervision of nongovernmental activities. It does not prescribe a particular autonomy design, and it does not demand continuous joystick control from Earth. It strengthens the case for explaining how meaningful supervision can persist across predictable communication gaps.
Space agencies and national licensing authorities could start with a modest common evidence requirement for consequential autonomous functions. Before launch, a mission would declare which decisions may be taken locally, how the permission expires or contracts when its factual basis fails, how exceptions are tested, and what record the vehicle will return. After a communication gap, operators should be able to reconcile the action history rather than simply celebrate the restoration of a signal. Such a requirement would not force different nations or companies to adopt the same control software or surrender their mission authority.
Human-governed autonomy is not a promise that someone on Earth will always be available to press “no.” It is a design in which humans have already defined the meaningful choices, the evidence that permits local initiative, and the process for reconsidering what happened. The farther exploration moves from Earth, the less credible a governance system becomes if it depends on a timely answer from home.
If a spacecraft can act only when Earth replies, its human-control plan fails at the moment it is needed most. The answer is to send human judgment with the spacecraft, in the form of tested authority that survives the silence.
About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →
No comments:
Post a Comment