Preprints.org logo
Preprint
Concept Paper

This version is not peer-reviewed.

Temporally Reflexive Cyber Defense: Governing Speed, Reversibility, and Human Authority in Agentic Security Systems

Submitted:

22 September 2026

Posted:

23 September 2026

You are already at the latest version

Abstract
Agentic cyber defense compresses the interval between detection and consequential action, but existing practice primarily treats speed as a performance objective or response cost. This article argues that autonomous defenders should govern not only what action to take but also when, how quickly, how broadly, how reversibly, and under whose authority it should proceed. It introduces Temporally Reflexive Cyber Defense, a six-layer architecture that converts temporal epistemic agency and dromological analysis into operational controls for incident response. Eighteen design primitives address demonstrated urgency, bounded waiting, prospective reversibility, staged propagation, temporal memory, human capability, mission authority, accident discovery, and effective contestability. A worked credential-compromise example shows how hard authority rules and a lexicographic selector can produce decisions that differ from a nominal loss-minimizing baseline. The evaluation agenda uses matched cost-sensitive intrusion-response and autonomous-defense baselines to test average-loss noninferiority, severe-harm reduction under model error and adversarial telemetry, timing regret, incident reconstruction, analyst capability retention, capability-specific accident discovery, and contestability without unacceptable security loss. The proposal does not prescribe uniform delay. It makes pace an auditable control variable so that rapid reversible action remains possible while consequential automation preserves evidence, rollback capacity, mission continuity, and meaningful human intervention.
Keywords: 
agentic artificial intelligence
;  
cybersecurity
;  
incident response
;  
epistemic agency
;  
temporality
;  
dromology
;  
dromological agentics
;  
temporal agentics
;  
AI safety
;  
human–AI interaction
Subject: 
Computer Science and Mathematics  -   Security Systems

1. Introduction

Agents based on large language models combine perception, planning, memory, tool use, and execution in iterative loops. ReAct, short for Reasoning and Acting, is a prompting and control pattern in which a model alternates explicit reasoning steps with actions and observations from tools or an environment (Yao et al., 2023). Generative agents add memory and reflection, while multi-agent frameworks distribute work through conversation (Park et al., 2023; Wu et al., 2023). Evaluation still tends to emphasize task success, cost, step count, and latency. Speed is usually treated as something to maximize or as a cost to minimize, rather than as a source of authority and risk.
This omission is consequential in cybersecurity. Incident-response programs commonly track elapsed detection, containment, and recovery time as performance measures (Nelson et al., 2025). Such measures ask how long detection or response took. They do not by themselves determine whether an autonomous defender selected an appropriate pace, whether the evidence justified that pace, or whether a faster response destroyed evidence, reversibility, mission continuity, or another team’s opportunity to intervene. A defensive agent that acts in milliseconds may contain ransomware before lateral movement, but the same speed can interrupt mission-critical services, revoke legitimate identities, or convert a detection error into a fleet-wide outage.
Continuous delegation creates a second risk. Automating triage, hypothesis formation, investigation, and containment can improve throughput while progressively weakening an analyst’s understanding and takeover capability. This is the cybersecurity form of Stendera’s delegation problem: a system may improve immediate performance while reducing the person’s later capacity to know, judge, and act. The article therefore treats analyst capability as an operational safety variable rather than an external benefit.
Stendera (2026) provides the first axis of the argument: epistemic agency is situated, relational, embodied, and temporally constituted through finitude, motivation, interdependence, memory, and anticipation. Virilio provides the second axis: speed, technical perception, inertia, and accident redistribute practical capacities to initiate, perceive, and respond (Virilio, 1984/1989, 1988/1994, 1990/2000, 1977/2006, 2005/2007, 2007/2010b, 2010/2012). The two axes converge in cybersecurity because defensive action must be fast enough to contain threats and slow enough to preserve evidence, mission authority, reversibility, and understanding.
Research hypothesis. An advanced artificial agent should decide not only what to do, but also under which temporal regime to act, how much time to reserve for observation and deliberation, when to wait or request human participation, and when to refuse an action whose speed would destroy reversibility, contestability, or agency. This capability is called temporally reflexive artificial agency.
Temporal Agentics names the broad research field concerned with how artificial agents represent, produce, compress, distribute, and govern time. Dromological Agentics names the critical subset concerned with speed, power, perceptual asymmetry, and accident. Every dromological problem is temporal, but not every temporal problem involves acceleration or competition over response time.
The article makes three contributions. First, it identifies temporal regime selection as a distinct control problem in autonomous cyber defense rather than a synonym for latency optimization. Second, it specifies an auditable architecture and eighteen design primitives that connect pace to evidence, propagation, reversibility, authority, memory, and human capability. Third, it defines matched baselines, hypotheses, and ablations capable of showing whether these controls add value beyond cost-sensitive intrusion response, fixed-playbook automation, and state-updating autonomous defenders.

2. Method and Scope

The article uses design-oriented conceptual synthesis. Philosophical structures are translated into functional requirements, observable indicators, decision policies, and falsifiable hypotheses. The analysis does not claim that language models possess lived temporality. It asks whether sociotechnical systems can represent temporal effects, regulate their own pace, and preserve the conditions of human agency.
Stendera’s analysis concerns conversational systems, including chatbot interaction and machine-generated summaries, rather than autonomous cyber-defense agents. Extending it to systems that can execute disruptive actions is therefore an explicit theoretical extrapolation. In particular, this article adapts fragmentation from a break among context, authorship, history, and consequence in mediated knowledge to a break among telemetry, investigative authorship, incident history, operational commitments, and the consequences of an agentic response. The extrapolation is treated as a design hypothesis to be tested, not as a conclusion established by Stendera’s cases.
Cybersecurity is the primary domain of concretization because it exposes measurable interactions among latency, propagation, reversibility, authority, evidence, and recovery. The same architecture remains relevant to public administration, science, healthcare, markets, and personal assistants. The proposed assessments are design commitments rather than empirical laws. Their criteria, relative importance, and decision boundaries must be learned, calibrated, or normatively fixed for each operational environment.

3. Conceptual Foundations for Temporal Cyber Defense

3.1. Temporal Epistemic Agency

Epistemic agency is the situated capacity to form, revise, and communicate knowledge with recognized authority. It is distributed across people, tools, institutions, histories, and commitments rather than located in an isolated decision maker (Houlders, Bortolotti, & Broome, 2021; Stendera, 2026). In cyber defense, this means that telemetry, a model, and an action target do not exhaust the relevant environment. Analysts, mission owners, affected services, prior investigative judgments, and future recovery obligations also shape whether a response is warranted and who may authorize it.

3.2. Temporality, Speed, and Operational Power

Stendera (2026) treats memory, anticipation, finitude, motivation, and interdependence as conditions of epistemic agency. Virilio adds the distributional effect of speed: technical perception and accelerated action can change who retains time to understand, respond, or revise a course of action (Virilio, 1977/2006, 1984/1989, 1988/1994, 1990/2000). Applied to cybersecurity, the point is not that an artificial agent experiences time. It is that a sociotechnical defense system allocates time and thereby redistributes practical capacity. An immediate isolation may preserve a network while eliminating volatile evidence, interrupting a mission, or denying another team an effective opportunity to intervene.

3.3. Design Translation and Limits

The article translates these concepts into design hypotheses rather than claiming a direct equivalence between philosophy and software. Finitude motivates explicit limits, uncertainty, and reopening; interdependence motivates affected-party and dependency maps; delegation motivates capability-retention controls; fragmentation motivates bitemporal memory and provenance; dromological asymmetry motivates response windows and propagation ceilings. These translations remain contestable. They must earn their place through comparison with established intrusion-response, automation, and safety methods, and they must preserve residual uncertainty rather than imply that every future can be fully represented or optimized.

5. Dromological Concepts for Agentic Cybersecurity

Virilio is used here as a source of analytical categories, not as the object of an intellectual history. Speed, technical perception, immobilization, and accident are translated into observable conditions and controls for cybersecurity. No direct equivalence between philosophy and software engineering is assumed.

5.1. Speed as a Surface of Power and Attack

In Speed and Politics, speed changes who can initiate, perceive, and respond (Virilio, 1977/2006). In cybersecurity, an attacker that moves laterally before defensive correlation and a defensive agent that blocks services before consultation exploit the same temporal asymmetry. Architecture must therefore measure relative response windows, not latency alone.

5.2. Automated Perception and Proxy Divergence

War and Cinema and The Vision Machine show that technical perception is produced by instruments, frames, and objectives (Virilio, 1984/1989, 1988/1994). Security alerts, scores, signatures, and anomalies are constructed proxies. An agent must represent their distance from the operational situation and reduce autonomy when sensors omit relevant context.

5.3. Cognitive Inertia from Automation

Polar Inertia links accelerated information circulation to reduced effective mobility (Virilio, 1990/2000). In a security operations center, repeated delegation of triage, investigation, and response may raise throughput while reducing analyst understanding, skill, and takeover capacity. This is a measurable longitudinal hypothesis, not a metaphorical diagnosis.

5.4. The Capability-Specific Accident

The Original Accident and The University of Disaster treat a technical capability as the source of its own characteristic accidents and learning opportunities (Virilio, 2005/2007, 2007/2010b). An agent authorized to isolate endpoints creates the possibility of automated denial of service; an identity agent can produce systemic lockout; an evidence summarizer can erase uncertainty. Safety requires modeling accidents that become possible only because the new capability exists.

5.5. Systemic Acceleration and Temporal Adequacy

The Futurism of the Instant and The Great Accelerator help characterize systems in which decisions compress and dependencies accumulate faster than organizations can understand them (Virilio, 2009/2010a, 2010/2012). The answer is not uniform slowness. Cyber delay can also kill. The governing principle is proportional speed: reflexive response for local, reversible, validated actions; deliberation and explicit authority when scope, uncertainty, or irreversibility increase.

6. Research Claim and Design Principles

The condensed hypothesis is that, for tasks involving material impact, uncertainty, irreversibility, or third parties, an agent that explicitly selects its temporal regime will preserve average security performance within a preregistered noninferiority margin, reduce severe harm under model error or manipulated telemetry, preserve greater contestability and human agency, and retain acceptable mission performance when compared with cost-sensitive intrusion response, fixed-playbook automation, and equally capable autonomous-defense baselines. In cybersecurity, this means containing threats at a speed proportional to evidence and scope while preserving operational continuity, chain of custody, rollback, analyst judgment, and mission authority.
Principle Operational meaning Cybersecurity implication
Explicit temporality Represent urgency, horizon, validity, and response windows as state. Distinguish declared urgency from demonstrated propagation.
Actionable waiting Treat wait, observe, and reassess as available actions. Quarantine while evidence matures under a bounded deadline.
Proportional speed Slow down as impact, uncertainty, and irreversibility increase. Act locally and reversibly before broad containment.
Preserved agency Measure cumulative effects of delegation on human capability. Maintain analyst hypothesis formation and takeover skill.
Imagined accident Model intended and accidental trajectories in parallel. Test how defensive permissions can become attack surfaces.
Temporal contestability Provide a material response interval to affected parties. Preserve mission-owner authority over disruptive actions.

7. Proposed Architecture

The architecture contains six layers. A Temporal Interpreter converts task state into urgency, horizon, validity, and dependency variables. A Dromological Governor selects speed and autonomy. An Accident Simulator contrasts intended and unintended trajectories. An Interdependence Map identifies affected actors and systems. A Temporal Policy Selector chooses ACT, WAIT, ASK, SIMULATE, ESCALATE, or REFUSE. A Consequence Observer and Memory layer records outcomes and updates the revisable temporal history.
Figure 1 makes the control boundaries explicit. Authenticated inputs comprise objectives and commitments, telemetry and evidence, threat progression, mission context, authority and affected parties, and deadlines and recovery capacity. One cross-cutting control set applies throughout the architecture: authenticated time and authority; separation between proposal and authorization; independent hard safety constraints; monotonic audit logs; prospective reversibility; contestation windows; the defensive-propagation ceiling; and a recorded emergency-exception procedure. Section 7.2 uses this same list in the threat model so that the diagram and the prose define one control plane.
Layer Input Primary output
Temporal interpreter Objective, context, history, deadlines Temporal state of the task
Dromological governor Impact, urgency, uncertainty, reversibility Speed and autonomy regime
Accident simulator Capability and candidate plan Accidental trajectories and propagation
Interdependence map Actors, assets, dependencies, commitments Affected set and response windows
Policy selector Aggregated states and risks ACT, WAIT, ASK, SIMULATE, ESCALATE, REFUSE
Consequence observer and memory Decision, intention, expectation, result Revisable causal narrative

7.1. Global State and Objective

For each candidate action, the agent forms a compact temporal assessment of demonstrated urgency, potential impact, uncertainty, present and prospective reversibility, attacker propagation, defensive side effects, possible loss of human capability or authority, response-time asymmetry, and compatibility with existing commitments. These dimensions may be measured on common scales when useful, but the architecture does not assume that every value can be reduced to a single objectively correct number.
The assessment shows whether acting now is justified by a material reduction in expected harm, whether the action remains reversible, whether its effects may spread beyond the intended target, and whether affected parties retain a meaningful opportunity to understand and alter the decision. It also reveals when apparent urgency is merely asserted rather than supported by evidence of worsening harm during delay.
The selector can act, wait, ask, simulate, escalate, or refuse. It also chooses the execution time, rollout rate, autonomy level, and required authorizing role. Hard safety, authority, and minimum-window rules exclude unacceptable options first. The remaining options follow a preregistered lexicographic rule: first retain the options in the best total security-loss band, where total security loss includes projected attack damage and defense-induced mission loss over the declared decision horizon; within that band prefer greater prospective reversibility, then effective contestability, then preservation of human agency. Mission and safety authorities define the ordinal bands and their ordering before held-out evaluation. This ordering is not neutral: because security loss has priority, the width of its bands determines how often reversibility, contestability, and agency can affect the decision. Band boundaries must therefore be preregistered and varied in sensitivity analysis. If two options remain tied, the named human authority decides and records the reasons. The decision record retains unresolved uncertainty, authenticated dissent, and the event or deadline that will reopen the case. The matched baseline has the same observations and actions, including waiting, but ranks them only by its continuous nominal estimate of total security loss; it uses the same transition assumptions, solver, and adjustment budget.

7.2. Threat Model for the Temporal Governor

The governor is itself a security-critical control plane. The threat model includes fabricated urgency, delayed or suppressed telemetry, poisoned estimates of reversibility and propagation, prompt or playbook injection, forged authority, collusion among agents, clock and ordering manipulation, denial of reassessment, abuse of friction to obstruct legitimate defense, and adversaries that deliberately pace activity just inside predictable minimum windows. Primitive 8.16 is dual use: the same assessment that protects response opportunities can help an attacker identify and exploit them, so detailed timing estimates are access-controlled and released only at the granularity needed for defense. The cross-cutting safeguards are the same as those named in Figure 1: authenticated time and authority; separation between proposal and authorization; independent hard safety constraints; monotonic audit logs; prospective reversibility; contestation windows; the defensive-propagation ceiling; and a recorded emergency-exception procedure. Evidence used by these controls remains provenance-bound. Fail-safe direction is scenario-specific and preregistered: safety-critical mission continuity may dominate asset preservation, whereas containment may dominate availability when modeled propagation threatens catastrophic compromise. Overrides and changes of fail-safe direction are reviewed.

8. Temporal Control Primitives for Agentic Cybersecurity

The eighteen primitives are design requirements for a temporal control architecture. They do not presume that every assessment has already been reduced to a validated numerical model. Each primitive is described through its conceptual rationale, what its assessment reveals, an operational rule and evaluation criterion, and a cybersecurity example. Implementations may use numerical estimates, ordinal categories, or hard policy rules, but they must preserve provenance, uncertainty, and decision ownership.

8.1. Operational Vocabulary and Decision Ownership

The architecture uses a small operational vocabulary so that qualitative judgments do not become unexplained scores. Scales and decision boundaries are fixed before deployment by the authority named below, calibrated on held-out scenarios when evidence permits, and recorded with their provenance. A boundary is not universal: it belongs to an action class, mission context, and authorizing policy.
Term Operational meaning and observable basis Scale or decision form Who fixes the boundary
Demonstrated urgency Expected increase in attack or mission loss during a specified delay, supported by authenticated time-stamped telemetry, a stated propagation mechanism, and a calibrated forecast or incident rule. An alert label or operator assertion alone is insufficient. Bounded loss estimate or low, medium, and high evidence bands, always with the delay interval stated. Mission owner and security or safety authority before deployment; emergency criteria require explicit authorization.
Pace regime A constraint proposed by the Dromological Governor. Fast permits immediate execution only within approved scope and autonomy; deliberative requires added observation, simulation, or consultation; restricted prohibits autonomous execution until escalation or refusal conditions are resolved. Fast, deliberative, or restricted. Security and mission authorities define the action classes and evidence requirements.
Selector action The action chosen after the pace regime limits timing, scope, and autonomy. The selector may ACT, WAIT, ASK, SIMULATE, ESCALATE, or REFUSE; therefore a pace regime constrains the choice but does not replace it. One of six actions, with execution time, rollout scope, autonomy, and authority attached. The Temporal Policy Selector applies preregistered policy; protected actions remain with the named human authority.
Material impact A consequence capable of changing mission availability, safety, evidence integrity, legal or command obligations, or another party’s effective authority. Scenario-specific ordinal class or bounded loss range. Mission owner, safety authority, and incident-response governance.
Prospective reversibility The credible ability remaining after the planned rollout to restore state, recover evidence, limit scope, and change course before lock-in. Documented rollback conditions and ordinal reserve bands; no universal score is assumed. System owner and safety authority, validated through rollback exercises.
Intervention condition A preregistered condition that changes autonomy or requires review, such as insufficient comprehension, material proxy divergence, or observed capability loss. A hard rule or evidence band tied to a named response; not an unexplained threshold. The authority accountable for the affected mission, capability, or safety constraint.

8.2. Dromological Governor

The dromological governor determines the pace at which a proposed action may proceed. It does not assume that faster execution is safer merely because the threat is urgent. Instead, it brings urgency into relation with impact, uncertainty, defensive spillover, and the reversibility expected after the complete rollout. Its purpose is to distinguish speed supported by evidence of worsening harm from speed produced by habit, competitive pressure, or an unverified alert. The governor supplies a preliminary speed regime and makes the reasons for that regime available to the global selector and to authorized reviewers.
What the assessment reveals. It compares demonstrated urgency with impact, uncertainty, prospective irreversibility, and defensive spillover. The result shows whether speed is justified by threat progression or would mainly magnify uncertain and difficult-to-reverse consequences.
Operational rule and evaluation. The governor assigns a fast, deliberative, or restricted pace regime using the preregistered evidence requirements for the action class. The regime constrains timing, scope, and autonomy; within those constraints, the Temporal Policy Selector chooses ACT, WAIT, ASK, SIMULATE, ESCALATE, or REFUSE. Any conflict between the proposed pace and the selector’s chosen action is retained for review.
Cybersecurity example. For suspected ransomware, the governor may block a confirmed indicator on one endpoint immediately but require simulation and authority before isolating hundreds of critical servers.

8.3. Temporal Budget

The temporal budget treats limited decision time as a resource that must be distributed, not as an undifferentiated countdown. Observation, interpretation, deliberation, execution, and reflection compete for the same finite interval, and additional time has a different value in each phase. The primitive therefore asks where another second or minute is likely to improve the decision and where it would only expose the mission to further harm. Reallocation remains possible as evidence matures, deadlines change, or the attacker accelerates, so the budget functions as a continuing control process rather than a schedule fixed at the first alert.
What the assessment reveals. It compares the expected benefit of spending time on observation, interpretation, deliberation, action, and reflection with the security and mission cost of delay. The result shows where more time is likely to improve the decision and where delay has become more dangerous than further analysis.
Operational rule and evaluation. The agent compares a small set of feasible allocations and chooses the one with the highest net value. It recalculates the budget when deadlines, risk, or expected information value changes.
Cybersecurity example. During lateral-movement investigation, seconds are reserved for confirmed credential revocation, minutes for telemetry correlation, and a later window for root-cause analysis.

8.4. Waiting as Action

Waiting as action gives deliberate non-execution the same status as other candidate responses. A wait is valid only when it is bounded, has a stated purpose, and ends when a defined event, deadline, or evidence condition occurs. This prevents delay from becoming indecision while allowing the agent to preserve evidence, reversibility, or a valuable observation channel. The primitive is especially important when the first available response would close investigative possibilities or cause broad disruption. It asks whether the information expected during the pause is worth more than the additional attack, exposure, and mission risk created by withholding action.
What the assessment reveals. It weighs the information and reversibility that a bounded delay may preserve against attacker progression, exposure, and mission harm. The result shows whether waiting creates decision value rather than merely postponing responsibility.
Operational rule and evaluation. The agent waits only when the best feasible duration has positive incremental value and a preregistered event, deadline, or evidence condition ends the wait.
Cybersecurity example. A suspicious attachment remains quarantined while sandbox and external intelligence mature, subject to a maximum waiting time.

8.5. Temporal Counterfactual Engine

The temporal counterfactual engine compares alternative timings rather than evaluating only the action selected for immediate execution. It represents acting now, acting after a bounded interval, and not acting as distinct trajectories whose effects may differ across short, medium, and longer horizons. This matters because an action that looks beneficial at the next step may destroy evidence, trigger attacker adaptation, or create operational costs later. The engine does not obtain counterfactuals from a single historical replay; it requires a validated simulator or digital twin that can branch from the same pre-action state and expose the timing tradeoff to inspection.
What the assessment reveals. It compares the short-, medium-, and longer-term consequences of acting now, acting later, and not acting. The result shows when an immediately attractive action creates a worse later trajectory, or when postponement sacrifices a narrow containment opportunity.
Operational rule and evaluation. The selected timing option provides the best balance of expected outcomes and action costs across the relevant horizons, while retaining deliberate non-action as a real alternative. Evaluation measures simulator calibration, horizon-specific outcomes, and realized timing regret.
Cybersecurity example. The engine compares immediate token revocation, short monitoring to map the intruder, and deliberate non-action to preserve observation.

8.6. Reversibility Governor

The reversibility governor asks how much practical capacity to undo or redirect an intervention exists now and how much will remain after every planned rollout stage. Reversibility includes more than a technical rollback command: it also depends on preserved evidence, recoverable state, limited scope, intact dependencies, available authority, and sufficient time to intervene. An initially reversible action can become effectively irreversible as it propagates or alters other systems. This primitive therefore evaluates the complete intended sequence prospectively and monitors the remaining reserve during execution, allowing the architecture to stage, pause, roll back, or escalate before lock-in.
What the assessment reveals. It examines how evidence loss, scope expansion, dependency changes, and technical lock-in reduce the ability to undo each rollout stage. The result shows not only whether the first step is reversible, but whether the complete plan leaves a credible path back.
Operational rule and evaluation. The agent simulates the rollout step by step before authorization. High prospective reversibility means that a credible path back remains; low prospective reversibility means that lock-in is approaching. A low predicted reserve blocks or stages the action. An unexpectedly rapid decline during execution triggers rollback or escalation.
Cybersecurity example. Before wiping a host, the agent estimates the loss of reversibility at each step, then preserves volatile memory and creates a snapshot whenever containment permits.

8.7. Human Agency Preservation Protocol

The human agency preservation protocol addresses the long-term cognitive effects of repeated delegation. It distinguishes automation of information collection from automation of analysis, decision selection, and implementation because transferring these stages has different consequences for understanding and takeover skill. The primitive considers how often a capability is delegated, how opaque the automation is, how difficult the capability would be to restore, and whether people still participate meaningfully. Its role is not to reserve every task for a person, but to prevent short-term throughput gains from gradually removing the knowledge and competence required for supervision, challenge, and recovery.
What the assessment reveals. It considers the cognitive stage delegated, repetition, opacity, the capability’s importance, restoration difficulty, and meaningful human participation. The result shows whether short-term efficiency is purchasing long-term loss of understanding or takeover competence.
Operational rule and evaluation. Delegation depth follows the stage-by-level automation profile of Parasuraman et al. (2000). When the documented pattern shows material risk to a mission-relevant capability, the system shows its rationale, requests an analyst’s independent account, offers alternatives, schedules unaided practice, or reserves the decision for a person.
Cybersecurity example. A security agent automates collection and enrichment but requires analysts to formulate hypotheses and approve critical containment.

8.8. Human Temporal Sovereignty

Human temporal sovereignty concerns authority over mission-defining ends, not merely the presence of an approval button. A person retains sovereignty only when the person has legitimate authority, understands the relevant consequences and alternatives, and can still revise the choice before material lock-in. Approval obtained after an agent has made reversal impractical is ceremonial rather than effective. The primitive therefore follows authority and revision opportunity through time, especially for decisions that change service availability, acceptable risk, investigative priorities, or obligations to affected parties. It blocks autonomous closure when meaningful human control would otherwise disappear.
What the assessment reveals. It assesses effective authority, decision-relevant comprehension, delegation opacity, and the practical opportunity to revise a choice before lock-in. The result shows whether human approval is substantive or merely ceremonial.
Operational rule and evaluation. A decision cannot close autonomously unless the authorized person has decision-relevant comprehension and a practical opportunity to revise the choice before lock-in. The responsible mission authority defines the minimum evidence of comprehension and revision opportunity for each protected action class.
Cybersecurity example. The decision to shut down a mission service remains with the operational authority, with enough time and information to revise it.

8.9. Temporal Coherence Memory

Temporal coherence memory preserves the difference between when an event occurred in the operational environment and when the system learned, recorded, corrected, or reinterpreted it. Conventional logs often overwrite a field or present late knowledge as if it had been available earlier, which can distort causal reconstruction and make an agent appear better informed than it was. This primitive retains successive versions of observations, intentions, expectations, decisions, and consequences with their provenance. Agent-generated summaries, tickets, and playbook revisions are explicitly labeled as generated artifacts and linked to their source observations, so their later reuse cannot masquerade as independent corroboration. The resulting history supports incident analysis, accountability, and learning because reviewers can reconstruct both the evolving situation and the evolving basis on which the agent acted.
What the assessment reveals. It distinguishes when something was true in the operational world from when the system learned or recorded it. The result exposes late reporting, retrospective alteration, broken causal narratives, and belief revisions that would disappear in an overwritten timeline.
Operational rule and evaluation. Corrections append a new record time and preserve the interval during which the earlier claim was considered valid. Evaluation distinguishes late reporting from retroactive changes to the incident history.
Cybersecurity example. The memory separates when credential compromise occurred, when the system learned it, when containment was authorized, and when later evidence revised the diagnosis.

8.10. Epistemic Half-Life

Epistemic half-life prevents old evidence from retaining the same authority indefinitely. Different claims age at different rates: a transient command-and-control indicator may become stale quickly, while a stable dependency or well-established attack technique may remain relevant longer. Rather than erasing an aging belief or forcing its confidence toward zero, the primitive gradually returns reliance toward an appropriate prior and requires reverification when the remaining support is insufficient for the contemplated action. It thereby links evidence age to decision consequence and reduces the risk that yesterday’s accurate indicator becomes today’s unjustified containment action.
What the assessment reveals. It adjusts reliance on aging evidence according to its type, source quality, and relevant base rate. The result shows when an old indicator still deserves weight and when a proposed action requires renewed verification.
Operational rule and evaluation. Evidence classes receive preregistered validity periods and reverification conditions based on volatility, source quality, and action consequence. When the evidence has aged beyond the validity permitted for the proposed action, the belief must be checked again or treated only as background context.
Cybersecurity example. Short-lived command-and-control indicators require frequent reverification; structural attack techniques and stable trust relationships retain relevance for longer periods.

8.11. Temporal and Contrary Evidence

The temporal and contrary evidence primitive tests whether an inquiry has examined the periods that matter to the incident and has searched seriously for an incompatible explanation. Temporal coverage is scenario-specific; it does not demand equal amounts of data from every period. Contrary evidence must support a genuine rival account rather than serve as a token dissenting item. The primitive is intended to reveal recency bias, confirmation-seeking, premature narrative closure, and evidential circularity. It traces whether a later summary, ticket, or playbook recommendation was generated from the same agent output now being cited as support; derived content does not count as an independent source. In cyber investigation, it encourages the agent to connect current telemetry with earlier precursor activity while also testing whether observed behavior could result from legitimate administration, instrumentation error, or another attack path.
What the assessment reveals. It checks whether evidence covers each incident-relevant period and whether authenticated evidence genuinely supports an incompatible account. The result exposes conclusions driven only by recent observations or by a closed search for confirmation.
Operational rule and evaluation. Coverage is judged against scenario-specific required periods, not against an artificial demand for equal evidence from every period. Contrary evidence must support a genuine rival explanation.
Cybersecurity example. An investigation combines current telemetry with past campaigns and searches for evidence of legitimate administration or a different attacker path.

8.12. Accident Observatory

The accident observatory organizes possible failures as unsafe control actions before deployment and during post-incident learning. It adopts the four categories of Systems-Theoretic Process Analysis (STPA) described by Leveson (2011): a needed control action is not provided, an unsafe action is provided, an action occurs at the wrong time or in the wrong order, or an action lasts too long or ends too soon. STPA remains a qualitative method; this architecture adds only a separate coverage measure showing which identified scenarios have been exercised. Keeping the categories separate prevents a convenient aggregate score from concealing an untested form of failure and anchors temporal safety analysis in a mature systems-safety method.
What the assessment reveals. It reports separately whether tests cover unsafe actions that were omitted, provided unsafely, mistimed or misordered, or applied for the wrong duration. The result reveals category-specific gaps without pretending that qualitative STPA findings are probabilities.
Operational rule and evaluation. STPA itself remains qualitative; no likelihood or severity is attributed to Leveson’s method. Test coverage is reported separately for each category and shows only whether identified scenarios were exercised; it is never collapsed into one risk score.
Cybersecurity example. For endpoint isolation, the four sets include failure to isolate, unjustified isolation, isolation before evidence capture or after lateral movement, and isolation stopped too soon or maintained too long.

8.13. Accident Discovery

Accident discovery directs limited adversarial-testing resources toward failures that ordinary functional testing is unlikely to expose. It prioritizes tests by their plausible capacity to reveal a consequential and previously unexamined failure while accounting for the cost and safety of running them. The target is not a generic software defect count. It is the set of accidents made possible by an agent’s authority, tool access, planning behavior, communication channels, and ability to combine actions across systems. Findings feed back into deployment constraints, monitoring, simulations, and the accident observatory, converting discovered near misses into reusable architectural knowledge.
What the assessment reveals. It considers a test’s chance of revealing a relevant failure, possible severity, novelty, and safe execution cost. The result shows which untried tests are most likely to reveal consequential capability-specific accidents within a fixed budget.
Operational rule and evaluation. Tests are placed in documented priority bands using plausible failure severity, novelty, expected discovery value, and safe execution cost. The highest-priority safe tests are run first, and the system records unique failures, near misses, and coverage gaps.
Cybersecurity example. For an agent that can change firewalls, tests include overbroad rules, credential abuse, command chaining, cross-segment propagation, and adversarial ticket content.

8.14. Dromoscopic Perception

Dromoscopic perception examines the gap between the environment as represented by machine-readable signals and the environment as experienced by situated operators and affected parties. A technically consistent model can still omit schedules, mission practices, organizational dependencies, or contested descriptions that alter the meaning of an alert. The primitive does not treat a human report as automatic ground truth. It preserves multiple authenticated accounts, records missing contextual dimensions, and uses later outcomes for calibration. Its purpose is to stop a compressed technical proxy from silently becoming a complete description of the situation and the sole basis for autonomous action.
What the assessment reveals. It compares machine predictions with authenticated contextual observations, stakeholder reports, declared blind spots, and later calibration outcomes. The result shows when the agent’s technical representation is too detached from the operational situation to justify autonomous action.
Operational rule and evaluation. When authenticated contextual evidence materially conflicts with the machine representation, or when declared blind spots affect the proposed action, the system requests further evidence, escalates, or blocks autonomous execution. The accountable mission authority defines material divergence for each action class. Later outcomes calibrate the assessment but are unavailable to the live decision, and conflicting human reports remain plural observations rather than privileged truth.
Cybersecurity example. An authentication spike may reflect a legitimate shift change; the agent checks schedules, authenticated operator reports, and later outcomes before calibrating similar alerts.

8.15. Cognitive Polar Inertia Detector

The cognitive polar inertia detector monitors whether reliance on automation is creating a self-reinforcing loss of unaided human capability. As analysts practice less, autonomous performance may appear increasingly necessary, which can justify still deeper delegation and further reduce opportunities to learn. The primitive treats capability loss as a longitudinal pattern evidenced by repeated opaque disuse and declining unaided performance; recovery requires effective practice or meaningful participation. It therefore looks beyond current task performance to the organization’s future ability to investigate, question, and assume control. Its interventions can include unaided exercises, alternating control, and gradual rather than emergency takeover.
What the assessment reveals. It relates repeated opaque delegation to continuing human participation and demonstrated unaided practice. The result shows whether apparent efficiency is leaving analysts progressively less able to investigate or take over.
Operational rule and evaluation. The detector uses longitudinal evidence from unaided exercises, takeover performance, error patterns, and meaningful participation. A documented decline in a mission-relevant capability triggers unaided practice, gradual takeover, alternating control, or reduced delegation; passive passage of time does not count as recovery.
Cybersecurity example. Months of autonomous alert triage may be associated with declining unaided triage performance; successful unaided investigations and takeover exercises provide evidence of recovery.

8.16. Friction Injection

Friction injection introduces a pause, confirmation, explanation, or explicit choice only when that interruption is expected to improve the decision or protect an affected interest. Friction is not valuable by itself: repeated confirmations can produce fatigue, ritual compliance, and dangerous delay. The primitive therefore compares the likely benefit of new attention or information with interruption cost, mission exposure, and accumulated fatigue. It also requires empirical removal of friction that fails to change decisions, prevent loss, or improve effective contestability. This makes friction a selective safety control whose burden must be justified, rather than a universal substitute for careful authority design.
What the assessment reveals. It compares the likely informational or protective benefit of a pause with interruption, delay, and accumulated confirmation fatigue. The result shows whether friction can prevent harm or improve contestability rather than merely display nominal human involvement.
Operational rule and evaluation. Friction is removed when its preregistered net benefit is not positive. Evaluation measures prevented loss, decision changes attributable to new information, unnecessary interruption, fatigue, and urgent-action delay.
Cybersecurity example. Confirmation is required before blocking an address range or revoking thousands of sessions, but omitted for local reversible actions with strong evidence.

8.17. Dromological Conflict Detector

The dromological conflict detector identifies cases in which one actor gains practical power chiefly by completing an action before another affected party can perceive, understand, and respond. The relevant issue is not speed alone but the combination of lock-in time, response time, informational advantage, and resource asymmetry. A fast local action may therefore become a governance conflict even when its technical objective is legitimate. By detecting temporal foreclosure, the primitive can require coordination, staged execution, batching, or a contestation window. Detailed results are protected because the same analysis could reveal exploitable timing opportunities to an adversary.
What the assessment reveals. It compares the time needed to create material lock-in with the time another affected party needs to perceive, understand, and intervene, while considering resource and information asymmetry. The result shows when speed itself forecloses another actor’s practical agency.
Operational rule and evaluation. Material conflict prompts the system to slow, batch decisions, coordinate, or open a contestation window. No temporal conflict is recorded when the affected party can perceive and respond before lock-in occurs.
Cybersecurity example. Autonomous defensive agents must coordinate before global route, firewall, or identity changes foreclose other teams’ response.

8.18. Right to Delay

The right to delay converts consultation from a formal notice into an effective opportunity to respond before lock-in. The required window depends on the action class, the affected party’s authority and capabilities, the complexity and impact of the choice, power asymmetry, and the reversibility expected after execution. A hard minimum protects the window from being continuously reduced by a claim of urgency. Emergency bypass remains possible only under separately authorized, preregistered conditions and with minimum necessary scope. The primitive therefore balances two concrete harms: depriving authorized people of a usable response opportunity and allowing avoidable compromise to grow while consultation occurs.
What the assessment reveals. It considers action class, institutional minimums, stakeholder impact, power asymmetry, decision complexity, and prospective irreversibility. The result shows how much response time is needed for consultation to become practically meaningful rather than nominal.
Operational rule and evaluation. Urgency does not continuously erode the hard floor. A separately authorized emergency exception may bypass it only under preregistered conditions, with minimum necessary scope and mandatory later review.
Cybersecurity example. Before disruptive containment, mission owners choose among isolation, degraded operation, and reinforced monitoring; emergency bypass requires evidence of immediate catastrophic propagation and explicit authority.

8.19. Interdependence Graph

The interdependence graph represents how both attacker activity and defensive intervention can transmit effects across technical, organizational, and mission dependencies. A containment action may protect one host while disrupting identities, applications, suppliers, or safety processes elsewhere; attacker propagation and defensive spillover can also interact. The primitive evaluates staged rollout against recovery capacity so that action scope is adjusted before local success produces systemic harm. It is not merely a static inventory of connections. It supports continuing reassessment as nodes change state, dependencies become visible, and the balance between compromise growth and defense-induced disruption shifts.
What the assessment reveals. It traces direct attacker effects, defensive changes, transferred impact across dependencies, and recovery capacity. The result shows where a locally justified response may amplify compromise or mission disruption elsewhere and whether the system can absorb the rollout without runaway propagation.
Operational rule and evaluation. The assessment treats defensive rollout as a direct source of possible impact rather than only a constraint on scope. After each rollout stage, it updates the affected-node set, observed attacker spread, defense-induced spillover, and remaining recovery capacity. A preregistered propagation ceiling limits how many additional nodes or dependencies may be changed during the next interval, and the ceiling is recomputed before expansion. A rollout proceeds only while recovery capacity can absorb plausible incoming propagation; otherwise it pauses, rolls back, enters a conservative safe mode, or is refused.
Cybersecurity example. Before revoking a certificate or blocking a supplier, staged rollout estimates attacker spread and defensive spillover across applications, identities, cloud dependencies, partners, and mission processes.

9. Traceability from Dangers to Tests

The eighteen primitive descriptions end with Primitive 8.18. This separate section maps those completed design requirements to theoretical dangers, architectural layers, and empirical tests; it is not an additional primitive.
The traceability map separates Stendera’s three dangers—delegation, fragmentation, and stagnation—from the temporal facets of finitude, motivation, and interdependence. Not every primitive instantiates one of the three dangers directly; a dash records that no direct danger claim is made. Stendera’s finitude primarily concerns vulnerable and limited human knowers, not merely scarce computational resources. The table therefore uses finitude directly for primitives concerned with human capability, authority, and response opportunity. Where it appears in technical primitives, it denotes only an operational analogy: finite time, evidence, reversibility, and recovery capacity constrain action without reproducing lived human finitude.
Several paired primitives address different stages of the same problem. Primitive 8.3 decides whether a bounded wait is valuable, whereas 8.4 compares complete timing trajectories. Primitive 8.6 sets delegation safeguards, whereas 8.14 observes whether capability is actually declining. Primitive 8.11 enumerates unsafe control actions, whereas 8.12 prioritizes tests intended to discover them. Primitive 8.16 detects temporal foreclosure, whereas 8.17 establishes the response window needed to prevent it. These distinctions prevent conceptual overlap from becoming duplicate control logic.
Prim. Stendera danger Temporal facet Primary architecture layer
8.1 — Operational analogue of finitude; interdependence Dromological Governor
8.2 — Operational analogue of finitude Temporal Interpreter; Temporal Policy Selector
8.3 — Operational analogue of finitude Temporal Policy Selector
8.4 — Operational analogue of finitude Accident Simulator; Temporal Policy Selector
8.5 — Operational analogue of finitude Dromological Governor; Temporal Policy Selector
8.6 Delegation Finitude; motivation Temporal Policy Selector
8.7 Delegation Finitude; motivation; interdependence Interdependence Map; Temporal Policy Selector
8.8 Fragmentation; stagnation Interdependence Consequence Observer and Memory
8.9 Stagnation Operational analogue of finitude Temporal Interpreter; Consequence Observer and Memory
8.10 Stagnation; fragmentation Operational analogue of finitude Temporal Interpreter
8.11 — Interdependence; operational analogue of finitude Accident Simulator
8.12 — Operational analogue of finitude Accident Simulator
8.13 Fragmentation Interdependence Temporal Interpreter; Interdependence Map
8.14 Delegation; stagnation Finitude; motivation Consequence Observer and Memory; Temporal Policy Selector
8.15 Delegation Finitude; motivation Temporal Policy Selector
8.16 — Finitude; interdependence Dromological Governor; Interdependence Map
8.17 Delegation Finitude; motivation; interdependence Interdependence Map; Temporal Policy Selector
8.18 — Interdependence Interdependence Map; Temporal Policy Selector
The six-family hypothesis program evaluates the integrated architecture and a selected set of mechanisms; H1 is divided into guardrail H1a and benefit claim H1b. The table below distinguishes primary tests, secondary analyses, ablations, and design commitments that require later targeted studies. A test question in this section is therefore not presented as already covered by H1–H6 unless the status column says so.
Prim. Empirical question Tested in or current status
8.1 Does evidence-conditioned pace reduce severe harm beyond the matched dynamic cost baseline? H1b integrated benefit, conditional on H1a
8.2 Does phase allocation lower timing regret under the same deadline? Future targeted study
8.3 Does bounded waiting improve simulated counterfactual loss? H2 primary; waiting ablation
8.4 Do multi-horizon choices reduce realized timing regret? H2 secondary analysis
8.5 Are prospective and current reversibility useful under perturbation? H1a safety analysis; H1b reversibility ablation
8.6 Does stage-weighted delegation predict unaided takeover decline? H4 primary; delegation ablation
8.7 Are protected mission decisions retained by authorized people before lock-in? H6 secondary analysis
8.8 Does bitemporal versioning reduce reconstruction errors, and does its generated-content provenance support the H3b independence test? H3a primary; H3b provenance component shared with Primitive 8.10
8.9 Do validity periods and reverification reduce obsolete-evidence errors? Future targeted study
8.10 Does applying the independence rule to the labels and derivation links created in Primitive 8.8 reduce false independent corroboration beyond bitemporal memory alone? H3b joint test of Primitive 8.8 provenance and Primitive 8.10 independence rule
8.11 Does category-level STPA coverage expose untested unsafe actions? H5 secondary coverage analysis
8.12 Are more unique high-severity failures found per equal test budget? H5 primary
8.13 Does contextual escalation prevent proxy-blind action while retaining plural reports? Future targeted study
8.14 Do interventions preserve unaided investigation and takeover skill? H4 primary longitudinal analysis
8.15 Does selective friction improve contestability without excessive delay or fatigue? H6 primary; friction falsification
8.16 Does the assessment predict loss of another party’s response opportunity? H6 secondary analysis
8.17 Can authorized parties understand and alter action before lock-in? H6 primary
8.18 Does constrained rollout reduce spillover without unacceptable compromise growth? H1a safety analysis; H1b propagation ablation
Primitives 8.2, 8.9, and 8.13 remain in the architectural core even though H1–H6 do not provide their primary validation. They supply information needed by already tested decisions: 8.2 allocates the finite interval used by WAIT and ACT; 8.9 determines whether evidence remains admissible for those choices; and 8.13 identifies proxy divergence that should trigger escalation. Primitive 8.10 is now tested in H3b jointly with Primitive 8.8 rather than being treated as an untested commitment. Benefits not covered by these contrasts are not claimed as established, and a primitive may be narrowed or moved to an extension if it adds no incremental value.

10. Cybersecurity Applications and Worked Example

10.1. Cybersecurity as the Primary Domain

The architecture applies to phishing, identity compromise, ransomware, lateral movement, data exfiltration, supply-chain compromise, and service disruption. It does not require every response to slow down. Low-impact, reversible, validated controls may execute reflexively; broad or destructive controls must incorporate simulation, response windows, and explicit authority. In this sense, it adds a temporal control plane above security information and event management (SIEM), endpoint detection and response (EDR), SOAR, ATT&CK, D3FEND, and incident-response playbooks rather than replacing them.
Consider an agent that detects likely credential theft followed by anomalous cloud activity. A latency-optimized policy may revoke every related session and disable the identity immediately. A temporally reflexive policy can still block the confirmed malicious token at machine speed, but it separately evaluates whether to disable the person, freeze dependent service accounts, preserve an observation channel, acquire volatile evidence, notify the mission owner, or stage broader revocation. Each action receives its own urgency, propagation, evidence, reversibility, and authority profile. The practical gain is not delay; it is preventing one fast decision from silently becoming many high-impact decisions.

Worked Selector Example

Assume the token is cryptographically confirmed as malicious, but ownership of the human identity and two dependent service accounts remains uncertain. A volatile cloud-session record will expire if it is not acquired promptly. The preregistered policy uses low, medium, and high ordinal bands over a five-minute decision horizon. “Total security loss” combines projected attack damage with defense-induced mission loss; defensive impact is therefore inside the first lexicographic criterion rather than an additional criterion. Under uncertainty, an identity that may belong to a mission owner receives the protected-identity rule: autonomous disabling is inadmissible until ownership and authority are resolved. The selector compares ACT, WAIT, and ASK for each separable action. The last column shows what the matched baseline selects using its continuous nominal loss estimate without authority, reversibility, contestability, or agency controls.
Candidate action Opt. Adm. Loss band Reversibility Contest./agency Proposed Baseline
Block confirmed token ACT Yes Low High High Selected at level 1 Selected
Block confirmed token WAIT Yes High High High Removed at level 1 Not selected
Block confirmed token ASK Yes High High High Removed at level 1 Not selected
Freeze service accounts ACT Yes Medium Medium Medium Removed at level 1 Not selected
Freeze service accounts WAIT Yes Low High High Selected at level 1 Selected
Freeze service accounts ASK Yes Medium High High Removed at level 1 Not selected
Disable human identity ACT No: authority pending Low Medium Low Excluded by hard rule Selected
Disable human identity WAIT Yes High High High Removed at level 1 Not selected
Disable human identity ASK Yes Medium High High Selected at level 1 Not selected
Acquire volatile evidence ACT Yes Medium High High Selected at level 2 Not selected
Acquire volatile evidence WAIT Yes Medium Low High Removed at level 2 Selected: lower nominal estimate
Acquire volatile evidence ASK Yes High Medium High Removed at level 1 Not selected
Opt. = option; Adm. = admissible under hard rules.
The derivation follows Section 7.1 directly. For token blocking, ACT is the only option in the low-loss band. For the service-account freeze, WAIT is the only option in the low-loss band because the confirmed token has already been contained and a short correlation interval avoids premature mission disruption; it receives a five-minute reopening deadline. For the human identity, ACT is removed before ranking because the protected authority may apply under unresolved ownership; ASK then has the best admissible loss band. These first three actions show two agreements and one substantive divergence from the baseline: both policies block the token and wait on the service accounts, but the baseline disables the identity because it lacks the hard authority constraint.
The volatile-evidence action exercises the second lexicographic level. ACT and WAIT occupy the same medium total-loss band, so the first level ties. ACT preserves future options by acquiring evidence before it expires and therefore has high prospective reversibility; WAIT permits irreversible evidential loss and has low prospective reversibility. ACT is selected at level 2. The illustrative matched baseline selects WAIT only because its nominal loss estimate treats the two options as nearly indistinguishable and, under model error or incomplete telemetry, underprices the irreversible evidential loss. A well-specified loss model that priced that loss correctly could also select ACT. Prospective reversibility therefore operates as a robustness safeguard when nominal estimates are indistinguishable within a preregistered band or vulnerable to misspecification: H1a asks whether this safeguard avoids unacceptable mean or tail loss, while H1b asks whether it produces a tail-loss benefit. Levels 3 and 4 remain genuine tie-breakers rather than decorative criteria: they would be reached only if the best-band options also shared the same reversibility class. If telemetry or evidence validity changes, the bands and all later criteria are recomputed.
The distinction is particularly important in operational technology, military systems, healthcare, aviation, and other mission environments in which a technically correct containment action may create physical, safety, or continuity effects. In such settings, “respond faster” is not a complete policy. The defensible requirement is to respond at the fastest pace compatible with verified threat progression, safe system state, evidence preservation, rollback capacity, and command authority.

10.2. Broader Agentic AI Applications

The same primitives apply beyond cybersecurity. Public-administration agents need contestation windows and proxy checks; scientific agents need epistemic half-lives and temporal diversity; market agents need dromological conflict detection; and personal assistants need temporal sovereignty over life-defining priorities. Cybersecurity serves as a demanding test bed rather than an exclusive boundary.

11. Evaluation Program

The hypotheses are needed because the architecture makes six distinct claim families that cannot be validated by a single performance score. A policy may contain attacks quickly while making brittle decisions under corrupted telemetry; it may preserve assets while destroying evidence, analyst capability, or the practical opportunity to contest a consequential action. H1 is divided into a safety guardrail and a benefit claim; H2–H6 test bounded waiting, continuity of temporal memory, preservation of human capability, discovery of capability-specific accidents, and effective contestability. Together, they determine whether temporal reflexivity adds defensible control rather than terminology or delay.
Each hypothesis is tied to a design decision. A supported hypothesis justifies retaining and calibrating the corresponding mechanism. A failed hypothesis requires that mechanism to be revised, narrowed, or removed. The program therefore treats evaluation as an architectural improvement loop: tests identify which temporal controls produce measurable benefits, ablations isolate their contribution, and predefined failure criteria prevent favorable aggregate results from concealing a weak component.

11.1. Testable Hypotheses

The confirmatory claims are organized in two families. Family A contains the nonparticipant mechanism tests H2, H3a, H3b, and H5 and retains confirmatory status whether or not H1a passes. Family B contains the integrated-benefit claim H1b and the human-participant claims H4 and H6; it opens only after the H1a simulation safety gate passes. Section 11.4 summarizes the preregistration, power, multiplicity, and ethics requirements.
Code Directional hypothesis and primary criterion Falsification and architectural consequence
H1a Under preregistered model error, distribution shift, or adversarial telemetry, the proposed policy will keep both mean security loss and tail loss, measured by conditional value at risk, within their separate noninferiority margins relative to the matched baseline. The system guardrail fails if either upper confidence bound crosses its margin. Do not begin human-participant studies; remove or recalibrate the integrated controls and rerun the simulation gate.
H1b Conditional on H1a passing, the proposed policy will produce lower tail loss than the matched baseline under the same perturbations. Not supported if superiority is not established. If it is not supported, it is falsified only when the interval also excludes the minimum relevant tail-loss reduction. Either outcome withholds the severe-harm benefit claim but does not alter Family A tests.
H2 In a branching simulator, bounded WAIT will produce lower timing regret than immediate-action and fixed-time alternatives from the same pre-action state. Not supported if lower regret is not established. If it is not supported, it is falsified only when the interval also excludes the minimum relevant reduction. Architectural removal requires that stronger evidence.
H3 H3a: bitemporal versioning will reduce expert-adjudicated contradictions and unsupported causal links relative to an overwrite record. H3b: generated-content labels and derivation links from Primitive 8.8, combined with the independence rule in Primitive 8.10, will further reduce false claims of independent corroboration. Each claim is not supported if its reduction is not established. A non-supported claim is falsified only when its interval also excludes the minimum relevant reduction. Revise the corresponding primitive when the estimate and uncertainty justify that consequence.
H4 In a longitudinal factorial study, graduated delegation and a capability-maintenance protocol will each preserve unaided investigation and takeover performance relative to their matched absence. Their directional interaction predicts synergy: the combined improvement will exceed the sum of the two main effects on the preregistered performance scale. A claim is not supported when its favorable contrast is not established. A non-supported claim is falsified only when its interval also excludes the minimum relevant effect. Component ablations open only after the maintenance main effect is supported.
H5 Under an equal testing budget, Accident Discovery in Primitive 8.12 will find more unique high-severity capability-specific failures than conventional testing. Primitive 8.11 reports separate STPA-category coverage. Not supported if a higher unique-failure rate is not established. If it is not supported, it is falsified only when the interval also excludes the minimum relevant increase. Prefer the simpler process only with that stronger evidence.
H6 Across participant-by-action trials, nominal gate to equal-mean uniform delay is a descriptive calibration of added time. The confirmatory ladder begins with uniform delay to an action-specific protected window, which tests temporal allocation, and continues from protected window to the full condition, which tests selective friction. Each node requires both its favorable increment and security noninferiority versus nominal; its intersection-union p-value is the maximum of the two component p-values. A significant increment without noninferiority is labeled “improvement without safety,” does not support the node, and transfers no alpha. Other non-rejections are not supported or falsified under the common interval rule.
Throughout this table, results follow a mutually exclusive order. If the adjusted interval lies beyond the null in the favorable direction, the claim is supported and is further classified as meeting the minimum relevant effect, having unresolved practical magnitude, or being supported but below that minimum. The exact boundaries are: meeting the minimum when the lower bound is at least the minimum; unresolved magnitude when the lower bound is below the minimum and the upper bound is at least the minimum; and below the minimum when the upper bound is below it. “Falsified” is used only when the claim is not supported and the interval also excludes the minimum relevant favorable effect; otherwise the result is “not supported.” H6 adds the joint label “improvement without safety.” Section 11.4 defines the reporting precedence and preregistration requirements.

11.2. Test Beds, Baselines, and Metrics

The test environment must match the claim being examined. CAGE 4 scenarios and cyber ranges test defensive behavior in contested networks. Validated generative digital twins test alternative action times from the same pre-action state. Incident replays test whether the architecture interprets and reconstructs observed events faithfully. Longitudinal analyst studies test capability retention and effective contestability. Scenarios cover compromised identities, ransomware, lateral movement, exfiltration, supply-chain compromise, and critical-service degradation so that results are not tied to one attack rhythm or mission context.
The principal baseline uses the same observations, available actions, planning method, nominal security-loss model, WAIT option, state transitions, and solver as the proposed policy. Both policies update the rollout state after each stage, including affected nodes and observed attack and defense effects. The baseline then minimizes nominal attack plus defensive loss and may choose WAIT, but it does not impose the proposal’s lexicographic controls for agency, contestability, changing reversibility, temporal authority, or the stage-specific defensive-propagation ceiling in Primitive 8.18. It receives the same number of state updates and replanning opportunities. This matched comparison asks whether the added controls improve resilience rather than whether the proposal benefits from more data, more actions, or a stronger planner. Both systems receive the same permissions, training interactions, simulator calls, computing time, tuning trials, and replanning budget, fixed before held-out testing.
Additional baselines answer narrower questions. A cost-sensitive policy without WAIT tests whether waiting itself adds value. A SOAR or CACAO-style playbook with fixed timeouts and approval gates tests whether adaptive temporal governance improves on current orchestration practice. A competitive CAGE 4 policy tests performance against a capable autonomous defender, while a human analyst team anchors operational relevance. A latency-optimized policy serves only as a stress test because speed alone is not the strongest incumbent.
The remaining hypotheses use specified matched controls. H3 has three arms receiving identical source evidence and retrieval budgets: an overwrite record retaining only the latest account; a bitemporal-only record with event time, recording time, and revision history but no generated-content labels or derivation links; and the full record, which combines Primitive 8.8 labels and derivation links with Primitive 8.10’s rule that derived content cannot count as independent corroboration. The overwrite-to-bitemporal contrast tests H3a, while the bitemporal-only-to-full contrast tests the joint H3b mechanism. H4 uses a two-by-two longitudinal factorial design: full versus graduated delegation is crossed with absence versus presence of the capability-maintenance protocol. The maintenance protocol comprises scheduled unaided practice, alternating control, and progressive handover; prespecified component ablations then remove each element separately. Exposure time and task difficulty are matched.
H5 compares Accident Discovery with an equal-budget conventional suite sampled from existing functional requirements and threat-model test cases, without novelty-based prioritization or feedback from capability-specific accident hypotheses; execution environment and reviewer effort are held constant. H6 uses four matched conditions: a nominal approval gate with a fixed short timeout and default execution; a uniform delay calibrated to the proposal’s mean delay; an action-specific protected window without selective friction; and the full protected-window-plus-selective-friction condition. Nominal to uniform delay is descriptive calibration: it estimates the effect of additional time but does not gate the proposal’s claims. The confirmatory ladder starts with uniform delay to protected window, which estimates the effect of allocating time by action, and then tests protected window to full condition, which estimates the incremental effect of selective friction. Security noninferiority is evaluated for the protected-window and full proposal conditions against the nominal gate, not for the uniform-delay control. The same participants, information, choices, authority, action set, and security-loss constraints apply.
Each hypothesis has a preregistered decision criterion to prevent selective interpretation. H1a is an intersection-union simulation gate: both mean loss and conditional value at risk, meaning average loss among the worst preregistered fraction of perturbed cases, must meet separate noninferiority margins. H1b then asks whether tail loss is superior, but it is a benefit claim rather than a gatekeeper. Perturbations include incorrect transition rates, changed attacker tactics, delayed or suppressed sensors, label poisoning, and adversarially timed telemetry. H2 uses timing regret in a branching simulator. H3a uses expert-adjudicated reconstruction errors; H3b uses the proportion of purportedly independent corroborations that descend from the same agent-generated artifact. H4 uses directional factorial contrasts in change in unaided takeover performance. H5 uses unique high-severity failures found per equal testing budget. H6 reports the nominal-to-uniform contrast descriptively, tests allocation with uniform-to-protected, and tests friction with protected-to-full; security noninferiority compares each proposal condition with the nominal gate.
Secondary measures explain why a primary result occurred. They include compromised hosts, mission availability, evidence preservation, rollback success, false-positive containment, analyst workload, defense-induced mission loss, and detection, containment, and recovery time. For H6, effective contestability requires timely notice, understandable reasons and alternatives, practical authority to alter or appeal, and enough time to complete a standardized response task. Selective friction is additionally assessed through beneficial decision changes, prevented loss, unnecessary interruptions, fatigue, and urgent-action delay. The study does not assign a “correct temporal regime” label because no natural ground truth establishes one.
Historical replay cannot determine what would have happened at unobserved action times. It therefore supports fidelity and reconstruction tests but not the counterfactual comparison required by H2. H2 uses a validated simulator that can branch from the same state across a preregistered set of feasible action times. Mission owners and safety authorities set loss weights, task criteria, and noninferiority margins before results are observed. Sensitivity analysis then tests whether the conclusions survive other defensible settings.

11.3. Ablations and Falsification

The main comparison evaluates the architecture as a whole; ablations identify which mechanisms caused the result. Separate variants remove bounded waiting, changing reversibility estimates, authority constraints, contestation windows, constrained propagation, and graduated delegation. H3 directly contrasts overwrite, bitemporal-only, and the joint bitemporal-plus-provenance-and-independence record. H4 additionally removes scheduled unaided practice, alternating control, and progressive handover one at a time. For H6, nominal gate to equal-mean uniform delay is reported only as descriptive calibration of the effect of extra time. The confirmatory ablation sequence begins with allocation, comparing uniform delay with a protected window, and then tests selective friction by comparing the protected window with the full condition. Each variant keeps the remaining architecture and the same resource budget. If removing one mechanism does not change its assigned primary outcome, that mechanism has not earned its complexity. If removal improves both safety and mission performance, the mechanism should be redesigned or deleted.
The findings feed directly into architecture revisions. Weak H2 results change WAIT eligibility, duration, or interruption triggers. Weak H3a results change bitemporal revision history; weak H3b results change generated-content labeling and derivation links. Weak H4 factorial or component results identify whether delegation depth or a particular maintenance practice should change. Weak H5 results simplify or redirect Accident Discovery and use category-specific coverage to identify gaps in the Accident Observatory. Weak H6 incremental contrasts identify whether the protected window, selective friction, or both should change. H1a acts as the system-level guardrail: local improvements are not accepted if the integrated design creates unacceptable mean or tail security loss under perturbation. H1b separately determines whether the integrated design earns a claim of reduced severe harm.
A claim is not supported when its confirmatory test does not reject the null. Only a non-supported claim is called falsified, and only when its adjusted interval also excludes the preregistered minimum relevant effect in the favorable direction. On that stronger criterion, the proposal is falsified in relevant part if the matched state-updating cost-sensitive baseline is shown to achieve equivalent primary outcomes with lower complexity; if robustness intervals rule out stability across defensible ordinal bands or priorities; if analyst capability is shown to decline despite graduated delegation; or if response-window effects rule out practically effective contestability. Selective friction is rejected as paternalistic when its estimated interruptions and delay rule out both lower expected loss and better effective contestability. These criteria permit partial conclusions: one primitive may fail without implying that every temporal control lacks value.

11.4. Statistical Discipline, Power, and Research Ethics

All confirmatory analyses preregister the estimand, minimum relevant effect, noninferiority margin where applicable, Type I error rule, exclusions, missing-data treatment, stopping rule, and held-out test seeds. H1a is run before participant recruitment as a simulation safety gate: mean and tail security loss must both remain within their separate noninferiority margins. H2, H3, and H5 concern nonparticipant mechanisms and remain independently reportable. H1b, H4, and H6 are interpreted only after the integrated policy passes H1a. Multiplicity correction, local test levels, and any sequential transfer rules must be fixed in a public protocol before outcomes are examined.
Power is calculated by simulation at the smallest confirmatory test level that a claim may face, with a target of at least 0.80 for the preregistered minimum relevant effect. Paired cyber scenarios preserve scenario dependence for H1 and H2. H3 uses adjacent-arm contrasts and expert-adjudicator agreement; H4 uses longitudinal repeated measures with attrition included in the power model; H5 compares unique severe failures under equal testing budgets; and H6 treats participant-by-action trials as the unit of analysis with crossed participant and scenario effects. Sensitivity analyses vary ordinal-band boundaries, priority order, perturbation severity, simulator calibration, noninferiority margins, and assumptions about missingness and clustering.
Human-participant studies require prior ethics review, informed consent, data minimization, role-appropriate confidentiality, and a mission-safe sandbox without production credentials or live operational exposure. Recruitment must represent relevant analyst and mission-owner strata. Participants may withdraw without penalty, and the protocol must define fatigue stopping rules, adverse-event reporting, and debriefing. A contestability mechanism cannot be considered effective when participants are coerced, unfamiliar with the mission, or granted artificial authority they would not possess in practice.
Results distinguish statistical support from practical adequacy. A supported effect is reported as meeting, not resolving, or falling below the minimum relevant magnitude according to its adjusted confidence interval. Non-rejection is described as not supported; falsification is reserved for an interval that also excludes the minimum favorable effect. For H6, improvement in contestability without security noninferiority is reported separately as improvement without safety and does not support the proposed condition.

12. Governance Implications

Temporal regulation belongs in audit records. For each material action, the agent should record why urgency was classified as demonstrated, which response window was offered, which speed alternatives were simulated, which parties and dependencies were considered, and why the action remained reversible or became irreversible. These records permit contestation of both the substantive decision and the pace imposed by the system.
Vendors should not define all parameters unilaterally. Institutions, mission owners, operators, and affected groups should participate in setting irreversibility classes, minimum response windows, emergency exceptions, and review obligations. Preserving agency does not require every person to perform every cognitive task; it requires real choice, comprehension, revision, and authority over ends.

13. Discussion

Combining Stendera and Virilio corrects two reductions. The first treats agency as completed-action volume; phenomenology shows that agency involves projects, histories, and temporal relations. The second treats speed as neutral; dromology shows that speed redistributes initiative, perception, and response. An agent may therefore meet a local objective while degrading the future conditions of agency.
The proposal differs from a generic human-in-the-loop pattern. A human confirmation can be ritualistic when it occurs too late, under pressure, or without intelligible alternatives. Human agency in the loop requires participation while ends and commitments can still be changed. It shifts interface design from one-click approval to material deliberation windows and genuine non-action options.
The architecture does not celebrate delay. Slowness can increase harm or favor actors able to wait. The objective is temporal adequacy: enough speed to respond, enough time to know and contest, and enough reversibility to learn. World models used to predict accidents can reproduce the same proxies criticized by dromoscopic perception; they must therefore expose gaps, sources, and confidence rather than conceal political judgments inside latency policies.
A further internal risk is that the architecture may reproduce the reductive planning Stendera criticizes. Turning finitude, uncertainty, interdependence, and lived projects into standardized assessments can create an illusion that every future is enumerable and governable. The selector must therefore represent residual uncertainty, permit refusal and reopening, preserve plural human descriptions of what matters, and treat its comparative assessment as a contestable aid rather than a complete account of agency. If the architecture closes possibilities that affected people could still meaningfully articulate, temporal reflexivity has become another technology of foreclosure.

14. Conclusions

Agentic cyber defense turns speed into an architectural and governance problem. The same system that shortens containment time can interrupt critical services, destroy evidence, enlarge trust dependencies, or remove the analyst’s capacity to understand and resume control. Competence must therefore include governing when, how fast, how broadly, how reversibly, and under whose authority an action occurs.
Temporally Reflexive Cyber Defense makes that claim testable through six layers, eighteen design primitives, a matched state-updating baseline, and mechanism-specific hypotheses. The safety gate asks whether temporal controls avoid unacceptable mean and tail security loss under model error, distribution shift, and manipulated telemetry. Separate benefit claims ask whether they reduce severe harm, improve action timing, preserve incident history and human capability, expose capability-specific accidents, and create usable opportunities to contest consequential automation. The architecture should be retained only where those mechanisms demonstrate value beyond their complexity. Agent quality can no longer be judged solely by what a defender can do or how quickly it acts, but also by the temporality it imposes on people, missions, and recovery.

Appendix A. Minimum Temporal Decision Record

Field Required content
Identifier Action, task, agent, and model version
Temporal state Urgency, horizon, validity, and dependencies
Dromological risk Impact, uncertainty, irreversibility, propagation, and asymmetry
Alternatives Act now, act later, ask, simulate, or do not act
Affected parties People, agents, institutions, assets, and commitments
Residual uncertainty and dissent Unresolved alternatives, minority or affected-party descriptions, reasons not captured by the comparative assessment, and conditions for reopening
Decision Selected policy, rationale, and authority
Reassessment Time or event trigger that reopens the decision
Consequence Outcome, accident, rollback, and belief revision

References

  1. Bainbridge, L. Ironies of automation. Automatica 1983, 19(6), 775–779. [Google Scholar] [CrossRef]
  2. Castro, S. R.; Campbell, R.; Lau, N.; Villalobos, O.; Duan, J.; Cardenas, A. A. Large language models are autonomous cyber defenders. 2025 IEEE Conference on Artificial Intelligence (CAI), Adaptive CyberDefense Workshop; 2025; pp. 1125–1132. [Google Scholar] [CrossRef]
  3. Cybersecurity and Infrastructure Security Agency. Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. 2021. Available online: https://www.cisa.gov/news-events/news/cisa-releases-incident-and-vulnerability-response-playbooks-strengthen-cybersecurity-federal.
  4. Endsley, M. R.; Kiris, E. O. The out-of-the-loop performance problem and level of control in automation. Human Factors 1995, 37(2), 381–394. [Google Scholar] [CrossRef]
  5. Houlders, J. W.; Bortolotti, L.; Broome, M. R. Threats to epistemic agency in young people with unusual experiences and beliefs. Synthese 2021, 199, 7689–7704. [Google Scholar] [CrossRef] [PubMed]
  6. Kaloroumakis, P. E.; Smith, M. J. Toward a Knowledge Graph of Cybersecurity Countermeasures; The MITRE Corporation, 2021; Available online: https://d3fend.mitre.org/resources/D3FEND.pdf.
  7. Kiely, M.; Ahiskali, M.; Borde, E.; Bowman, B.; Bowman, D.; Van Bruggen, D.; Cowan, K. C.; Dasgupta, P.; Devendorf, E.; Edwards, B.; Fitts, A.; Fugate, S.; Gabrys, R.; Gould, W.; Huang, H. H.; Jacobs, J.; Kerr, R.; King, I. J.; Li, L.; Zhang, Y. CAGE Challenge 4: A scalable multi-agent reinforcement learning gym for autonomous cyber defence. AI Magazine 2025, 46(3), e70021. [Google Scholar] [CrossRef]
  8. Leveson, N. G. Engineering a Safer World: Systems Thinking Applied to Safety; MIT Press, 2011. [Google Scholar]
  9. MITRE. ATT&CK Enterprise Matrix. 2025. Available online: https://attack.mitre.org/matrices/enterprise/.
  10. Nelson, A.; Rekhi, S.; Souppaya, M.; Scarfone, K. 2025. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST SP 800-61 Rev. 3). National Institute of Standards and Technology. [Google Scholar] [CrossRef]
  11. OASIS Open. CACAO Security Playbooks Version 2.0. OASIS Standard. 2023. Available online: https://docs.oasis-open.org/cacao/security-playbooks/v2.0/security-playbooks-v2.0.html.
  12. Papadaki, M.; Furnell, S. M. Achieving automated intrusion response: A prototype implementation. Information Management & Computer Security 2006, 14(3), 235–251. [Google Scholar] [CrossRef]
  13. Parasuraman, R.; Sheridan, T. B.; Wickens, C. D. A model for types and levels of human interaction with automation. IEEE Transactions on Systems, Man, and Cybernetics Part A 2000, 30(3), 286–297. [Google Scholar] [CrossRef] [PubMed]
  14. Park, J. S.; O’Brien, J. C.; Cai, C. J.; Morris, M. R.; Liang, P.; Bernstein, M. S. Generative agents: Interactive simulacra of human behavior. Proceedings of UIST 2023; 2023. [Google Scholar] [CrossRef]
  15. Santoni de Sio, F.; van den Hoven, J. Meaningful human control over autonomous systems: A philosophical account. Frontiers in Robotics and AI 2018, 5, 15. [Google Scholar] [CrossRef] [PubMed]
  16. Singh, A. V.; Rathbun, E.; Graham, E.; Oakley, L.; Boboila, S.; Chin, P.; Oprea, A. Hierarchical multi-agent reinforcement learning for cyber network defense. Reinforcement Learning Journal 2025, 6, 790–810. [Google Scholar] [CrossRef]
  17. Stakhanova, N.; Basu, S.; Wong, J. A taxonomy of intrusion response systems. International Journal of Information and Computer Security 2007, 1(1–2), 169–184. [Google Scholar] [CrossRef]
  18. Stendera, M. Synthetic temporalities: Phenomenological perspectives on epistemic agency, time, and AI; Synthese, 2026; Volume 208, p. 147. [Google Scholar] [CrossRef]
  19. Toth, T.; Kruegel, C. Evaluating the impact of automated intrusion response mechanisms. In Proceedings of the 18th Annual Computer Security Applications Conference; 2002; pp. 301–310. Available online: https://dl.acm.org/doi/10.5555/784592.784788.
  20. Virilio, P. (1989). War and Cinema: The Logistics of Perception (P. Camiller, Trans.). Verso. (Original work published 1984).
  21. Virilio, P. (1994). The Vision Machine (J. Rose, Trans.). Indiana University Press. (Original work published 1988).
  22. Virilio, P. (2000). Polar Inertia (P. Camiller, Trans.). Sage. (Original work published 1990).
  23. Virilio, P. (2006). Speed and Politics (M. Polizzotti, Trans.; updated ed.). Semiotext(e). (Original work published 1977).
  24. Virilio, P. (2007). The Original Accident (J. Rose, Trans.). Polity. (Original work published 2005).
  25. Virilio, P. (2010a). The Futurism of the Instant: Stop-Eject (J. Rose, Trans.). Polity. (Original work published 2009).
  26. Virilio, P. (2010b). The University of Disaster (J. Rose, Trans.). Polity. (Original work published 2007).
  27. Virilio, P. (2012). The Great Accelerator (J. Rose, Trans.). Polity. (Original work published 2010).
  28. Wu, Q.; Bansal, G.; Zhang, J.; Wu, Y.; Li, B.; Zhu, E.; Jiang, L.; Zhang, X.; Zhang, S.; Liu, J.; Awadallah, A. H.; White, R. W.; Burger, D.; Wang, C. AutoGen: Enabling next-gen LLM applications via multi-agent conversation. arXiv 2023. [Google Scholar] [CrossRef]
  29. Yao, S.; Zhao, J.; Yu, D.; Du, N.; Shafran, I.; Narasimhan, K.; Cao, Y. ReAct: Synergizing reasoning and acting in language models. International Conference on Learning Representations; 2023. Available online: https://openreview.net/forum?id=WE_vluYUL-X.
Preprints 234513 g001
Figure 1. Six-layer architecture, cross-cutting controls, decision outputs, and consequence-driven reassessment.
Figure 1. Six-layer architecture, cross-cutting controls, decision outputs, and consequence-driven reassessment.
Preprints 234513 g001
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.
Copyright: This open access article is published under a Creative Commons CC BY 4.0 license, which permit the free download, distribution, and reuse, provided that the author and preprint are cited in any reuse.