DECISION ARCHITECTURE | TRUSTED ARCHITECTURE | OPEN CAPABILITY
A system can remain technically available while its capacity to compare evidence and make a sound decision is exhausted.
By Vincent Sullivan, Founder, Cyber Strategy Institute
Cybersecurity professionals understand denial of service. An attacker does not need to corrupt the target system if it can exhaust the system’s ability to process legitimate work. Generative AI creates a cognitive equivalent: denial of deliberation.
From denial of service to denial of deliberation
The target receives more plausible reports, alerts, summaries, comments, narratives, and recommendations than its people can evaluate. Each item may be individually reasonable. Together they consume the scarce resources that matter: attention, verification time, subject-matter expertise, and the willingness to reopen a decision.
A denial-of-deliberation condition can be accidental. It can emerge from enthusiastic adoption and fragmented workflows. It can also be exploited. Flood the decision environment, establish urgency, repeat a preferred frame across apparently separate artifacts, and the organization may choose the first acceptable path simply to survive the queue.
Why AI-generated volume is different
Traditional information operations were constrained by production cost. Generative systems make variation, personalization, and repetition inexpensive. The same core narrative can be rewritten for executives, engineers, lawyers, regulators, voters, and procurement officials in minutes.
The output also arrives with a powerful surface feature: fluency. Weak and strong claims can be expressed with the same confident grammar. A reader under time pressure may mistake coherence for validation. If several generated products repeat the same framing, repetition can be mistaken for independent consensus.
This is especially dangerous in government and regulated markets. A policy office may receive thousands of comments. A contracting team may face hundreds of pages of vendor claims. A small business may confront multiple conflicting compliance regimes. The first complete answer can become the default even when it came from the party with the greatest production capacity, not the best evidence.
Security controls for the decision environment
The answer is not to block generation. It is to harden the decision path. Organizations should declare the decision before reviewing AI output, set source and evidence requirements, and separate primary evidence from generated interpretation.
High-consequence decisions should require at least one independent challenge, a record of alternatives, and a statement of what evidence would reverse the recommendation. Repeated claims should be deduplicated by source and assumption so synthetic consensus does not masquerade as independent support.
Tempo matters. AI should compress the intelligence phase by finding and organizing information. It should not automatically compress the commitment phase. Irreversible actions need cooling-off, quorum, escalation, or human sign-off rules proportionate to consequence.
A new national-resilience requirement
Decision capacity is part of critical infrastructure. A government unable to distinguish volume from evidence can be steered without breaching a network. A business unable to challenge the first AI-generated strategy can be captured without changing ownership. A citizen unable to compare alternatives can lose agency while believing they received more information.
The AI era requires a new security objective: maintain the ability to deliberate under machine-scale information pressure. That means protecting provenance, diversity, dissent, time, authority, and reversibility as deliberately as we protect credentials and networks.
Sources and further reading
[1] NIST AI RMF, Appendix C: AI Risk Management and Human-AI Interaction.
[2] U.S. GAO, GAO-25-107653.
[3] Generative AI and Organizational Decision-Making, Procedia Computer Science 280 (2026).
[4] Cristofaro, Giardino, and Augier, Generative AI and Cognitive Biases in Strategic Decision-Making (2026).
Author note: Vincent Sullivan is the founder of Cyber Strategy Institute and a retired U.S. Air Force lieutenant colonel. His work focuses on engineered security, runtime governance, federal acquisition, and AI decision sovereignty.
The system is not down. Deliberation is.
