Automate the routine
Normal low-risk flows can remain fast and deterministic without requiring unnecessary manual approval.
TTAN.IO Robotics / human-first governance
Automation without surrendering authority.
TTAN.IO Robotics allows automation, AI and machine-speed decision support without allowing any model, agent, provider or recovery workflow to silently become the final authority for physical action. Human authority remains explicit where policy, uncertainty or risk requires it.
The model may recommend. The architecture decides. The human remains the escalation authority when required.
Governance ruleAI can assist without inheriting command authority.
Interpretation, correlation, explanation and recommendation can be automated. Physical authority remains bounded by deterministic controls, approved behavior and explicit human decisions where required.
01 · AI is advisory
AI can recommend. It cannot silently release motion.
AI may classify, interpret context, correlate evidence, suggest actions or explain why a condition looks abnormal. None of those capabilities automatically create permission for a robot to move.
TTAN.IO separates model output from security authority. A recommendation must still pass deterministic validation, policy, capability, baseline, readiness and exact-command binding before it can become eligible for execution.
Allowed AI role
Interpret + recommend
Models can summarize telemetry, propose responses, explain anomalies and assist operators with complex context.
Forbidden shortcut
Recommendation ≠ authority
A confident model response, high score or agent plan cannot bypass the security path or become dispatch permission.
Why it matters
AI remains replaceable
Security semantics stay stable even when the model, provider or AI component changes or is absent entirely.
TTAN.IO law:
AI may suggest the work. The architecture governs whether that physical work is admissible now.
02 · HUMAN_REQUIRED
Human escalation is a first-class security outcome.
Some situations should not collapse into a binary ALLOW or DENY. Ambiguous state, high-risk missions, unexpected drift, recovery scenarios or conflicting evidence can require a real human decision before the system continues.
HUMAN_REQUIRED is therefore an explicit decision state, not an informal message or UI suggestion. The workflow stops until the required human authority reviews the exact bounded context.
Trigger
Uncertainty or elevated consequence
Conflicting evidence, unusual mission scope, recovery state or policy thresholds can force human review.
Approval
Bound to the exact operation
Human approval should identify the specific mission, robot, context and constraints rather than grant open-ended future authority.
Protection
No silent continuation
If the required human decision is absent, expired or ambiguous, the system remains stopped or ineligible.
TTAN.IO law:
Human oversight is not decorative. Where policy requires a human, automation cannot silently substitute itself.
03 · No silent self-learning
Observed behavior does not automatically become approved behavior.
A production robot may drift, adapt, receive new parameters or be influenced by AI-generated proposals. TTAN.IO does not treat repeated observation as permission to rewrite the baseline.
Changes to capabilities, limits, tools, zones, programs or expected behavior require controlled provenance, validation, testing and explicit promotion before they become accepted production truth.
Runtime
Observe without auto-promoting
New behavior can be measured and analyzed while remaining outside the approved baseline.
Change
Promotion is controlled
Baseline updates require explicit change lineage, versioning, evidence and the appropriate approval path.
Failure mode avoided
Drift cannot normalize compromise
A malicious or accidental deviation should not become “normal” merely because it was seen repeatedly.
TTAN.IO law:
Production drift is evidence to investigate, not authority to rewrite the security model.
04 · No automatic restart
Uncertainty does not end when software says “recovered.”
After a HOLD, incident, disconnect, failover or recovery event, the real physical cell may no longer match the last trusted logical state. A part may still be held, a robot may have moved, a conveyor may have advanced or another machine may have changed the environment.
TTAN.IO therefore separates recovery from restart. State must be reconciled, eligibility re-established and fresh authority issued before physical work resumes.
Containment
HOLD remains meaningful
A HOLD is not a temporary pause that automation can casually clear when connectivity returns.
Recovery
Physical + logical state are reconciled
Known-good software alone cannot prove that the real robot cell is ready to resume.
Return to service
Fresh authority is required
Recovery restores eligibility. It never resurrects old authorization for the next physical action.
TTAN.IO law:
Recovery restores eligibility. It never resurrects old authority.
Why this matters
Human-first does not mean human-slow.
Escalate the exceptional
Ambiguous, high-consequence or recovery conditions become explicit human decision points instead of hidden automation assumptions.
Keep evidence
The reason for escalation, the human decision, the bounded scope and the later observed outcome remain attributable.