The Five Laws of Autonomy¶
Where they came from¶
I did not start in AI.
I started with machines that could hurt someone if they got it wrong. Drones, in the pioneering days of small unmanned aircraft. We were building the aircraft and figuring out the tech stack at the same time. I was flying automated waypoint missions before multiple GPS units were standard. Semi-accurate GPS. Open-source flight software. A community inventing the whole thing in the open, before DJI existed. These were machines with real authority to act in the physical world, running on tools that barely existed yet. I watched them progress from automated to autonomous, from running a plan I loaded to making their own calls in the air. I know what changes when a machine crosses that line. When a machine has that authority, one rule becomes obvious fast: you cannot wait for the crash to find out it made a bad decision. Governance has to sit in the loop, before the action, or it is not governance. It is a report.
That is the whole origin of my work. Not a theory I read. A lesson the physical world taught me.
I published five of those lessons as a doctrine. I called it the Five Laws of AI Governance, because AI agents are where the problem is exploding right now. The name was accurate. It was also too small.
The laws were never about AI¶
Here is the doctrine, exactly as published:
- Independent Measure. A system may not produce the measure of its own conduct.
- Binding at Dispatch. A system may not be governed only in retrospect.
- External Witness. A system may not be the custodian of the record of its own conduct.
- Separated Authority. No party may certify itself.
- Revocable Authority. A system may not outlive its off-switch.
Read them again and notice what is missing. None of them mention AI.
They do not have to. A drone cannot certify that its own flight was compliant. A robot cannot be the only witness to what it did. An autonomous vehicle cannot be allowed to outlive the command that says stop. The five laws hold for any system that can decide and act on its own. AI is one such system. It is the loudest one. It is not the only one.
So I am saying the broader thing out loud. The Five Laws of AI Governance are the first domain of a larger doctrine: the Five Laws of Autonomy.
AI governance is the entry point. Autonomy is the territory.
The same law, in two domains¶
The reason I can make that claim is that I have lived both sides of it. I did not read about one domain and imagine the other. I built the governance on both. The drone that answers to an authority outside itself. The AI agent that fails closed the moment that authority is revoked. Same law, two machines.
Here is the same law, read physically and digitally.
| Law | Physical autonomy | Digital autonomy |
|---|---|---|
| Independent Measure | The vehicle cannot certify its own flight was compliant. | The agent cannot grade its own actions. |
| Binding at Dispatch | The command is checked before the actuator moves. | The action is checked before it executes. |
| External Witness | The record lives outside the machine's own software. | The record lives outside the agent's control. |
| Separated Authority | The operator is not the sole authority certifying itself. | The builder is not the sole certifier of itself. |
| Revocable Authority | An external authority can revoke the mission, and the machine obeys. | An external authority can revoke the agent, and it fails closed. |
The spine holds across both. A system is never the judge, witness, owner, or executioner of its own governance. And governance binds before the act, not after.
One thing these laws do not do¶
I want to be precise, because precision is the point.
These laws measure whether a system stayed inside the authority it was granted. They do not decide whether that authority was wise. A system can be perfectly governed into doing something reckless if the grant itself was reckless. The laws are necessary. They are not sufficient. Compliant is not safe. Let me repeat that. Compliant is not safe.
I hold that line in the physical domain too. A perfectly governed drone flying a badly authorized mission is still a badly authorized mission. Governance is the floor. It is not the ceiling.
Why now¶
Agents are getting authority faster than we are governing it. They touch code, money, infrastructure, tools, and increasingly each other. The industry is starting to converge on the same answer I reached from the flight line: the control point has to be at the moment of action, not the audit afterward.
I am glad the field is arriving here. It means the problem is real. It also means the framing matters more, not less. Because the next systems that need this are not chatbots. They are the machines that move in the world.
I have been governing those the whole time.
Reference¶
The canonical doctrine, with both plain and formal registers, is published and citable:
Genece, P. (2026). The Five Laws of AI Governance (v1.0.1). Zenodo. https://doi.org/10.5281/zenodo.21271750
This piece extends that published doctrine into its broader domain. It does not replace it.
Frequently asked¶
What are the Five Laws of Autonomy?
The Five Laws of Autonomy are five invariants that govern any system that can decide and act on its own: Independent Measure (a system may not produce the measure of its own conduct), Binding at Dispatch (a system may not be governed only in retrospect), External Witness (a system may not be the custodian of the record of its own conduct), Separated Authority (no party may certify itself), and Revocable Authority (a system may not outlive its off-switch). They are the broader domain of the published Five Laws of AI Governance. AI governance is the entry point. Autonomy is the territory.
How are the Five Laws of Autonomy different from the Five Laws of AI Governance?
They are the same five laws, read at a broader scope. The Five Laws of AI Governance are the published, citable, DOI-anchored edition, written because AI agents are where the problem is most visible right now. The Five Laws of Autonomy name the fact that the laws were never about AI. The same invariants govern a drone, a robot, an autonomous vehicle, or an industrial controller. The AI-Governance edition is unchanged. The Autonomy framing sits above it.
Do the Five Laws apply to physical autonomous systems like drones?
Yes. That is the origin of the doctrine. A drone cannot certify its own flight was compliant. A robot cannot be the only witness to what it did. An autonomous vehicle cannot be allowed to outlive the command that says stop. The laws were derived from governing physical autonomous systems with real authority to act in the world, then generalized to digital agents. Governing physical autonomy raises the stakes, because an action taken outside authority is a collision or an incursion that cannot be rolled back.
Does compliance with the Five Laws make an autonomous system safe?
No. The laws measure whether a system stayed inside the authority it was granted. They do not decide whether that authority was wise. A system can be perfectly governed into doing something reckless if the grant itself was reckless. Compliant is not safe. Governance is the floor, not the ceiling. The laws are necessary, not sufficient.
Why does governance have to happen before the action instead of after?
Because an autonomous system with authority to act can cause harm that a later review cannot undo. You cannot wait for the crash to find out a machine made a bad decision. Governance that only inspects the record after the fact is not governance. It is a report. The control point has to be at the moment of action, which the doctrine names Binding at Dispatch.
What is AQ Score, and how does it relate to the Five Laws?
AQ Score is the independent measurement layer being built on top of the Five Laws. It measures what an autonomous system was authorized to do, what it actually did, and the distance between the two, against a shared scale that survives the system being measured. The Five Laws define what governed means. AQ Score measures how well a given system met that definition. AQ Score is filed for trademark at the USPTO (intent-to-use, Serial 99850714).