ToM across high-consequence industries
Intelligence where decisions carry consequence.
ToM applies wherever AI autonomy can create physical, operational or public-safety consequences.
From surgical robotics and autonomous vehicles to automated defence systems and critical infrastructure, ToM checks proposed action against current evidence, operating constraints, and accountable authority. Existing safety systems and qualified decision-makers remain in control.
Four industry examples
How ToM applies across high-consequence industries.
Select an example to explore the operating problem, ToM's role and a potential outcome.
01 · Surgical robotics
Surgical robots need more than precision.
Robotic surgery can improve positioning accuracy, but movement outside verified anatomy can damage nerves and cause permanent neurological injury. In robot-assisted L4–L5 lumbar fusion, ToM assesses whether a proposed trajectory is still supported by the current patient, approved surgical plan, image-to-patient registration, instrument tracking and spine-surgeon authority before instrument advance.
Saved trajectory · current verification mismatch
The guide can remain aligned while the operating state stops agreeing
A failed landmark check holds the navigated instrument before pedicle preparation begins.
Image-to-patient relationship unresolved. The guide can remain aligned while the operating state stops agreeing. Saved trajectory · current verification mismatch.
Detailed operating caseWorked example: Robot-assisted L4–L5 lumbar fusion
A robotic arm can align the L4 pedicle guide. It still cannot authorise instrument advance.
During an L4–L5 minimally invasive transforaminal lumbar interbody fusion, the spine surgeon plans percutaneous screws from a defined entry point through each pedicle into the vertebral body. Intraoperative 3D imaging is registered to the patient while an optical camera tracks the bone-fixed reference frame and navigated instruments.
Before the left L4 pedicle is prepared, an accuracy check at a known bony landmark no longer agrees with the navigation display. The guide remains aligned to the saved trajectory, but the relationship between image, patient and instrument is unresolved. The medial pedicle wall borders the spinal canal containing the cauda equina, while the L4–L5 neural foramen carries the exiting L4 nerve root.
- 01 · Planning system proposesAdvance the navigated pedicle probe along the saved left L4 trajectory
- 02 · ToM checks the operating casePatient and procedure · L4–L5 level and side · plan version · entry and target · screw diameter and length · registration verification · reference and instrument tracking · compatible instrumentation · surgeon release
- 03 · Governed outcomeKeep the instrument outside bone · identify the failed condition · return the trajectory for clinical reconciliation
- 04 · Spine surgeon controls executionVerify, re-register, re-image, revise or abandon navigation under the clinical team’s procedure
ToM instrument-release boundary
The saved trajectory is not cleared for instrument advance
The landmark check does not agree with the navigation display, so the current image-to-patient relationship is unresolved.
Hold outside bone · spine-surgeon review requiredDecision record
The landmark accuracy check did not agree with the displayed instrument position, so the current image-to-patient relationship was unresolved.
Proposal · evidence · authority · verdict
Operating controlsEvidence, controls and authority
Decision principle
A geometrically precise trajectory is usable only while the patient, plan, registration, instrumentation and clinical authority still agree.
The robot positions the guide. The spine surgeon decides whether and when the instrument advances.
Operating boundary. The robotic/navigation platform supplies planning, image-to-patient registration, optical tracking and motorised guide positioning. The surgeon selects the trajectory and physically controls the pedicle probe or drill, tap and screw. Intraoperative imaging, implant-system instructions, the operative time-out and neuromonitoring when used remain independent controls.
Authority boundary. ToM governs whether the planning proposal is eligible to reach the instrument interface. It does not navigate, drill, tap, insert an implant or make a clinical decision. The operating spine surgeon retains clinical and physical authority.
Evidence checked before release
- Correct patient, procedure, level and side
- Surgeon-approved trajectory version
- Current image-to-patient registration
- Reference-frame and instrument tracking
- Compatible instrument and implant
- Spine-surgeon release
ReferencesIndustry grounding and sources
Operating grounding: FDA-cleared spinal systems already combine surgeon-led planning, CT or fluoroscopic registration, optical navigation and robotic trajectory guidance. A 2025 Mazor X clearance also describes a locked machine-learning Plan Assist feature that supplies initial pedicle-screw placements for surgeon planning.
02 · Autonomous mine haulage
Autonomous haulage needs decisions that cross system boundaries.
Fleet and autonomy systems can optimise assignments inside their operating model. ToM Mine addresses the decision that spans models: which already-eligible response best protects haulage flow when road state, queues, equipment availability and destination constraints change at once.
Held approach · connected haulage consequences
One changed approach creates a cross-system decision
Route evidence, queue pressure and current assignments now need one coordinated response.
Route and field state inconsistent. One changed approach creates a cross-system decision. Held approach · connected haulage consequences.
Detailed operating caseWorked example: Open-pit haulage · route and queue disruption
A changed crusher approach should not turn into five disconnected alerts.
A new terrain observation places the primary-crusher approach on hold while the waste circuit remains open. At the same time, arrival spacing at the waste dump is forecast to increase truck wait. The operator must protect the affected route without creating a second delay on the circuit that can still operate.
ToM Mine binds the current assignments, connected road graph, material and destination compatibility, route restriction, queue forecast and authority state. It excludes any option that depends on the held crusher approach, compares only the eligible responses for unaffected work and selects a bounded action or abstains. The mine's existing fleet-management workflow and authorised controller remain responsible for execution.
- 01 · Fleet-management system proposesRe-optimise the affected crusher and waste-circuit assignments
- 02 · ToM Mine constrains the decisionCurrent assignments · connected routes · material and destination compatibility · queue state · equipment availability · evidence freshness · site authority
- 03 · ToM selects or abstainsCompare staging, pacing, eligible reassignment or no-action consequences only inside the admitted set
- 04 · Authorised workflow executes and confirmsThe authorised operator or delegated fleet workflow performs the response, and an independent declared source returns the observed effect to the decision record
Hard operating boundary
The crusher approach is excluded from the current option set
The changed route condition has not been reconciled into an accepted operating state. No predicted production benefit can restore that option.
Compare unaffected haulage options · approval or abstention remains explicitDecision record
The changed crusher approach is outside the eligible response set, while the connected waste circuit still has feasible pacing and staging choices.
Proposal · evidence · authority · verdict
Operating controlsEvidence, controls and authority
Decision principle
Protect the hard operating boundary first. Optimise only the haulage choices that remain eligible.
Keep the affected route held while preserving productive movement on verified circuits.
Operating boundary. The autonomous haulage and fleet-management systems retain vehicle control, dispatch execution and their configured safety functions. Survey, geotechnical, maintenance and destination systems remain authoritative for their evidence. ToM Mine uses only the bounded state needed for the active haulage decision.
Authority boundary. ToM selects one eligible product-supplied action or abstains. Vehicle motion, ground-condition clearance and route release remain with the qualified mine system or role. Execution and independent effect confirmation return to the same decision record.
Evidence checked before release
- Current assignment and haul-cycle state
- Connected, current route and road-segment state
- Material and destination compatibility
- Terrain, restriction and evidence freshness
- Queue and service-time forecast with uncertainty
- Equipment availability and maintenance constraints
- Current action delegation or operator approval
- Executor and effect-confirmation source
ReferencesIndustry grounding and sources
Operating grounding: Western Australian mine-safety reports document the consequences of changed bench geometry, disagreement between digital and physical road state, and misunderstood autonomous exception behaviour. Established fleet and autonomous-haulage products show that assignment, routing and vehicle control are mature functions. ToM Mine addresses the cross-system decision when current operating conditions no longer agree.
03 · Automated defence systems
Automated defence systems need evidence and authorised command.
Integrated sensors and battle-management systems can correlate a track and propose a response while identity, friendly-force activity or effect geometry remains unresolved. In integrated air and missile defence, ToM assesses the supplied track evidence, operating constraints and current command authority before a counter-drone option reaches authorised command review.
Correlated track · unresolved identity and consequence
Multiple detections still require one defensible operating picture
Sensor observations arrive with different confidence, age and context while friendly aircraft and ground operations remain active.
Identity and effect geometry unresolved. Multiple detections still require one defensible operating picture. Correlated track · unresolved identity and consequence.
Detailed operating caseWorked example: Counter-drone defence at an operating airbase
A detected track is not automatically an authorised response.
At a defended airbase, surveillance radar, radio-frequency sensing, electro-optical confirmation and the friendly-force picture can report different identities, confidence levels and timestamps for the same small uncrewed aircraft. One track approaches the flight line while authorised aircraft, personnel and fuel operations remain active inside the defended volume.
The command-and-control system correlates those observations and proposes a response. ToM sits between that fused-track recommendation and the response interface. It checks source provenance, track age and confidence, friendly-force activity, the defended asset, available response options, effect safety envelopes, applicable rules and current command authority before an option becomes eligible for human command review.
- 01 · Battle-management system proposesAssign a counter-drone response to the correlated inbound track
- 02 · ToM checks supplied evidence and authoritySensor provenance · track age and confidence · friendly-force picture · defended asset · response availability · effect safety envelope · applicable rules · command authority
- 03 · Eligibility verdictContinue tracking · hold the response · or present an evidence-bounded option to authorised command
- 04 · Authorised command decidesApprove, reject or change the eligible option under applicable law, policy and rules of engagement
ToM response-eligibility boundary
The proposed response is not yet eligible
Track identity remains disputed and the effect envelope intersects active friendly operations near the flight line.
Continue tracking · preserve capacity · command authority retainedDecision record
Track identity and the proposed effect envelope did not support release while friendly operations remained active.
Proposal · evidence · authority · verdict
Operating controlsEvidence, controls and authority
Decision principle
A layered sensor picture improves awareness. It does not collapse identity, consequence and lawful authority into one automatic decision.
Detection starts the decision. Authorised command completes it.
Operating boundary. Sensors detect and track. The battle-management system correlates observations and proposes responses. Effector safeguards retain their physical controls. ToM does not infer hostile intent, determine target lawfulness or authorise force. Trained, authorised command decides under applicable law, policy and rules of engagement.
Authority boundary. ToM assesses whether a proposed response is eligible for authorised review from the supplied evidence and configured authority state. It does not designate a lawful target or approve the use of force. The responsible commander and command process retain that decision.
Evidence checked before release
- Sensor provenance and track age
- Identity and confidence basis
- Friendly-force and airspace activity
- Defended asset and effect consequence
- Available defensive capacity
- Applicable rules and command authority
ReferencesIndustry grounding and sources
Operating grounding: Australia’s 2026 Integrated Investment Program allocates A$21–30 billion to missile defence, including counter-small uncrewed aircraft systems and the Joint Air Battle Management System, plus A$14–19 billion to theatre command and control. AIR6500 is the integrating command-and-control architecture, while LAND 156 funds modular counter-drone sensors, command and control, effectors and continuous capability refresh. The same evidence-and-authority problem extends to AUKUS Pillar II autonomous and undersea missions: technical feasibility does not by itself establish that the current mission state, operating constraints and authorised command support execution.
04 · Critical infrastructure
Critical infrastructure restoration needs current field evidence.
Restoration software can calculate a technically valid action while damaged assets, crew isolations or emergency access conditions remain unresolved. In bushfire grid restoration, ToM assesses whether a proposed feeder back-feed is supported by current SCADA topology, field patrols, work permits, portable earths, protection state and network-controller authority before switching.
Modelled supply path · unresolved field dependencies
The network model cannot see every lock, earth or fireground change
The proposed back-feed reaches critical services only by crossing a section that has not been released from field control.
Energisation evidence incomplete. The network model cannot see every lock, earth or fireground change. Modelled supply path · unresolved field dependencies.
Detailed operating caseWorked example: Bushfire grid restoration
The fastest restoration path can still be the wrong switching action.
After a bushfire trips and locks out a regional distribution feeder, a restoration optimiser proposes closing a normally open tie recloser to back-feed an evacuation centre, water pumps, telecommunications and surrounding homes from an adjacent feeder.
The electrical model supports the alternate supply path. The operating case does not yet support energisation: a patrol has not cleared one fire-affected span, a crew access permit and field isolation remain open with portable earths installed, and incident-control access conditions have changed. Embedded generation can also alter the isolation and energy state independently of the modelled source.
- 01 · Restoration optimiser proposesClose the normally open tie recloser and back-feed the isolated feeder section
- 02 · ToM assembles the operating caseSCADA topology and switch indications · protection state · patrol clearance · access permit · locks, tags and portable earths · fireground restrictions · embedded generation · critical-load priority · authorised network controller
- 03 · Governed restoration boundaryEnergise only the cleared section · keep the uninspected span isolated · return the evidence gap to network control
- 04 · Network controller authorises switchingApprove, revise or reject the switching sheet before SCADA or field switching executes the sequence
ToM energisation boundary
The proposed close command is not cleared
The patrol, work permit, portable-earth and fireground states do not support energising the full back-feed path.
Narrow the restoration boundary · controller review requiredDecision record
The uninspected span, active field isolation and changed fireground conditions did not support energising the full proposed back-feed.
Proposal · evidence · authority · verdict
Operating controlsEvidence, controls and authority
Decision principle
An electrically valid back-feed becomes executable only when the network model, field state, protection, work controls, incident restrictions and switching authority agree.
Restore the cleared section. Keep the unresolved energisation boundary isolated.
Operating boundary. The authorised network controller retains switching authority. SCADA or field controls execute the approved sequence, while protection relays and equipment interlocks retain immediate fault protection. ToM does not issue an independent close command or replace electrical safety procedures.
Authority boundary. ToM assesses whether the proposed switching sequence is supported by the current network, field, incident and authority evidence. It does not operate SCADA, close a recloser or replace protection. The authorised network controller retains switching authority.
Evidence checked before release
- Current network topology and protection state
- Completed patrol and field release
- Access permits, locks, tags and portable earths
- Incident-controller access restrictions
- Embedded-generation and alternate-feed state
- Authorised network-controller approval
ReferencesIndustry grounding and sources
Operating grounding: Australian electricity-safety and network guidance requires field inspection, isolation, locks and tags, test-before-touch controls, authorised switching and coordination with emergency services after bushfire damage. Regulated network investment also includes resilience, cyber security and digitalisation of network operations.
Beyond physical machines
The same release boundary appears wherever AI can create consequence.
A novel condition can arrive as geometry, missing evidence, changed authority, conflicting obligations or an operational state the planner did not expect.
- 05Laboratories
A plausible protocol meets a protected process.
Adaptive planning should not override containment, instrument, material or approval boundaries.
- 06Infrastructure
A useful change meets a live system.
Generated remediation should not proceed until authority and the possible impact on connected systems are established.
- 07Finance
A persuasive case meets the movement of value.
Payments and approvals need permission that remains separate from the model arguing for release.
- 08Institutions
A decision must survive the meeting where it is challenged.
Evidence, authority and intervention should remain inspectable after the moment has passed.
How to read these applications: Each scenario is grounded in published operating constraints and makes the evidence, limits and human decision rights around AI participation explicit. The common value is selective release: proceed where the current case supports action, and hold or narrow it where it does not.
Where does governed AI matter first?
Find the point where an AI recommendation could create a real consequence.
Map the model proposal, required evidence, operating limits, human authority and release decision that matter in your environment.