In the Doctrine
Stopping Is Not Always Safe.
So Safety Is Designed Per Task.
Most safety doctrine ends the same way: leave the rules, reach a
minimum-risk condition, call a human. For a system working under threat, that is not
always true — stopping in the open and waiting can itself put a person in harm's way.
Defender's rule set does not treat “stop” as one answer for every task.
Each task in the Defender rule set carries its own defined safe state, designed in
advance rather than chosen in the moment: withdraw along the tether, ground the implement
and hold, or complete to a defined stop line. Which one applies is set by the task, not
improvised after the fact — because the moment authority is withdrawn or a limit is
crossed is exactly the wrong moment to be deciding what “safe” means for the
first time.
The rules themselves ship sealed — signed rule sets and firmware, a hardware root of
trust that runs nothing unsigned, no debug access on any shipped unit, and tamper
detection that ends in a safe stop and a retained log, with keys held in Canada. None of
that is claimed to make tampering impossible; it is built to make it expensive, slow,
obvious and self-defeating. Authorization itself is a lease, not a sale — issued and
withdrawable by Canadian Shield, delivered by wire or at the dock, never by radio, and a
unit that leaves its authorized hands simply stops being useful. The physical stop and the
RED MANUAL RELEASE on every actuator are never part of that lease: the lock is on the
logic, and it is never on safety.
Ownership follows the same split as authorization: the customer owns the machine and
the hardware; the configuration and application that turn it into Defender are Canadian
Shield's, licensed and revocable.
The Doctrine Line
AI plans. Rules govern.
Humans authorize. Safety has veto.
Four short sentences carry the whole architecture: what the rule set is allowed to
plan, that the rules — not the moment — govern what happens next, that a human
authorizes anything that matters, and that safety can always veto, no matter which
authority mode is selected.
