When Manual Control Disappears, Authority Must Move Upstream

An inquiry into a vehicle without conventional controls

On 4 September 2026, the US National Highway Traffic Safety Administration announced an Audit Query into Tesla's certification of Cybercab following commercial deployment in Austin, Texas.

The official investigation record says deployment began with a small number of vehicles on 3 September. It also records that Cybercab lacks permanently attached conventional controls such as a steering wheel, brake pedal and accelerator pedal.

NHTSA will examine the technical data and processes supporting Tesla's self-certification against applicable Federal Motor Vehicle Safety Standards, including whether the certification depended on determinations that some requirements are inapplicable to Cybercab.

This is an inquiry, not a finding that Tesla or Cybercab is non-compliant. Its wider significance lies in the architectural question it brings into view: when a human cannot take conventional manual control, where does operational authority reside?

Oversight cannot depend on an imaginary handover

Human oversight is often presented as the final safeguard for autonomous systems. That assumption becomes more complicated when a machine must make time-sensitive decisions and no person can immediately take physical control.

Some situations may permit escalation to an authorised operator. Others require the system to remain inside predefined operating limits, modify its proposed action or enter an appropriate safe state.

The important work therefore happens before consequence. The organisation needs to know what action is being proposed, whether it remains permitted in the current location and operating context, whether the relevant authority is still current, whether essential evidence is available and what should happen when those conditions are no longer satisfied.

Authority must follow the effective action

An autonomous system's authority should not be treated as a general entitlement to act.

Permission for one route, movement or operating condition should not automatically authorise a materially different action. If the target, context or expected effect changes, the governing authority may need to be evaluated again.

That principle extends beyond vehicles. It applies to drones, robots, industrial systems and AI-enabled cyber operations—anywhere software can create physical or operational consequences.

Evidence must survive the decision

Regulatory scrutiny also demonstrates why evidence cannot end with a system's assertion that it was permitted to act.

An organisation may need to reconstruct what the system proposed, what operating context was available, which authority applied, what decision was returned, what action became effective and what outcome was subsequently reported.

This evidence does not prove that every decision was correct. It gives operators, investigators and assurance teams material they can inspect when evaluating what happened and why.

The PF Systems position

PF Systems separates the relevant responsibilities within PF OS: PF Memory knows. PF Core proves. PF Kernel decides.

PF Memory supplies governed knowledge and context. PF Kernel applies the authority boundary to a proposed action. PF Core preserves linked evidence and lineage so that the governed evaluation can later be examined.

PF Systems does not drive an autonomous vehicle or replace its safety systems. It does not certify regulatory compliance, guarantee safety or make probabilistic AI deterministic.

It addresses a narrower architectural problem: establishing a governed boundary around whether a proposed consequential action is authorised to proceed, with linked evidence that can later be examined.

As conventional manual controls disappear, authority cannot disappear with them. It must move upstream—into the governed path between autonomous intelligence and action.