On Earned Autonomy - Delegating Network-Lethal Authority to Machines

Autonomous defensive capabilities exist - EDR/XDR platforms, SOAR systems, and cloud security services already block known threats without human intervention. The gap is not capability but legitimacy: no framework exists for delegating authority to machines for novel threats that fall outside existing signatures and playbooks.

This paper introduces earned autonomy, a governance framework for delegating defensive authority to machines. Authority is granted not by vendor assertion or blind trust, but through demonstrated competence on real traffic, under real conditions, with continuous validation. We present IBSR (Inline Block Simulation Report) and Guard as a reference implementation: IBSR produces judgment through rehearsal on live traffic, Guard executes blocking at kernel level, and the separation ensures autonomous action is never taken without prior evidence of competence.