An open security standard for robots, vehicles and other autonomous systems that act around people. Each policy compiles into a runtime guard, is checked on every action, and leaves a signed record mapped to the frameworks your auditors and regulators already use.
5
Autonomy tiers
9
Control domains
49
Enforced controls
6
Frameworks mapped
Rules are written in a versioned policy language, peer-reviewed like source code and signed before release to the fleet.
A command verifier and an independent safety controller check every action against policy before it reaches an actuator.
Every decision, block and override is written to a hash-chained recorder and exported as audit evidence by framework clause.
01
Every rule has a runtime mechanism. A written policy without an enforcement point is incomplete.
02
Physical limits live in independent controllers that the AI planner cannot change or override.
03
On fault, compromise or uncertainty the system stops or degrades to a minimal-risk condition.
04
A person can always stop the system, and every deployment has a named accountable owner.
05
Each decision leaves a verifiable record for engineers, auditors and regulators.
Every system is certified at one tier. Higher tiers add controls; none remove them. Select a tier to see what it permits.
The system acts on its own inside a fixed envelope of speed, force, payload and geofence. Leaving the envelope triggers a stop and an escalation.
Only authenticated devices, operators and software may issue or execute commands.
| ID | Control | Enforced by | From |
|---|---|---|---|
| IAM-01 | Hardware-rooted device identity Each unit holds a unique key in a secure element. Unregistered devices cannot join the fleet. | Mutual TLS at the fleet gateway | T0 |
| IAM-02 | Signed firmware and models Boot refuses unsigned firmware, policy bundles or model weights. | Secure boot chain | T0 |
| IAM-03 | Signed commands only Actuator commands are rejected unless signed by an identity authorized for that scope. Stop commands are exempt (see HWS-08). | On-device command verifier | T1 |
| IAM-04 | Short-lived operator sessions Remote operator access requires MFA and expires within one hour. | Identity provider policy | T1 |
| IAM-05 | Anti-rollback Secure boot enforces a minimum version counter held in fuses or the secure element, so older signed but vulnerable builds are refused. | Secure boot chain + monotonic counter | T0 |
| IAM-06 | Replay protection Signed commands carry a nonce or sequence number and a short validity window, and are bound to one device. Stale or repeated commands are rejected. | On-device command verifier | T1 |
| IAM-07 | Key protection and revocation Signing keys live in an HSM and releases need multi-party signatures. Lost or stolen units are revoked fleet-wide, and a documented procedure rotates keys if a signing key leaks. | HSM + fleet revocation list | T1 |
| IAM-08 | Local and maintenance access JTAG and UART are locked or fused off in production. Service tools authenticate, USB data is disabled by default, and every local session is logged. | Debug lock + service tool authentication | T0 |
Dimmed rows are not yet required at T2.
243 policies, standards, threats and protections, from organizational policy down to silicon. One set applied across software, firmware, hardware and network.
Recorder exports are tagged by clause, so the same logs answer an ISO audit, a SOC 2 examination and an EU AI Act conformity assessment.
| Domain | NIST AI RMF | ISO/IEC 42001 | ISO 27001 | SOC 2 | EU AI Act | OWASP LLM |
|---|---|---|---|---|---|---|
| Identity & access | GOVERN, MANAGE | A.6 | A.5.15–A.5.18, A.8.5 | CC6.1–CC6.3 | Art. 15 | LLM03, LLM06 |
| Permission tiers | MAP | A.5 | A.5.9 | CC3.2 | Art. 9 | LLM06 |
| Data handling | MAP, MEASURE | A.7 | A.5.12, A.8.11, A.8.24 | C1.1, CC6.7 | Art. 10 | LLM01, LLM02, LLM04 |
| Human-in-the-loop | GOVERN, MANAGE | A.9 | — | CC5.2 | Art. 14 | LLM06 |
| Hardware stop | MANAGE | A.9 | A.7.11 | A1.2 | Art. 14(4)(e), Art. 15 | — |
| Fleet release & command | GOVERN, MANAGE | A.6 | A.5.3, A.8.32 | CC8.1 | Art. 15 | LLM03 |
| Monitoring & audit | MEASURE | Cl. 9, A.6 | A.8.15, A.8.16 | CC7.2 | Art. 12, Art. 72 | LLM10 |
| Positioning & tracking | MAP, MEASURE | A.6 | A.7.8, A.8.16, A.8.24 | CC6.7, CC7.1 | Art. 15 | — |
| Chemical sensing | MAP, MEASURE | A.6, A.9 | A.8.16 | CC7.1 | Art. 14, Art. 15 | LLM04 |
| Incident response | MANAGE | Cl. 10, A.8 | A.5.24–A.5.28 | CC7.3–CC7.5 | Art. 73 | — |
Mapping is indicative and will be verified against each framework’s current text before publication.
We are collecting comments from engineering, security and regulatory reviewers before version 1.0. For comments, questions or the full draft standard, contact us at: