DECISION ARCHITECTURE | TRUSTED ARCHITECTURE | OPEN CAPABILITY
A consequential AI system should survive provider refusal, outage, deprecation, compromise, policy change, and government action.
By Vincent Sullivan, Founder, Cyber Strategy Institute
Federal AI acquisition still treats the selected model as the center of the system. That is the same mistake organizations once made when they built applications around a single database, cloud service, or proprietary interface. The dependency looks efficient until the provider changes the terms, suffers an outage, withdraws the product, or becomes unacceptable for the mission.
AI models will change more frequently than traditional enterprise platforms. Providers will deprecate versions, alter prices, modify safety policies, discover vulnerabilities, respond to legal orders, and release replacements with different behavior. The government should assume substitution will occur and design for it before the emergency.
Availability is not the only reason
A model may need to be replaced even when it remains online. Differential testing may uncover foreign regulatory embedding. A provider update may increase refusal rates or degrade a critical workflow. A security incident may compromise the serving environment. A model may become noncompliant with new law or policy. Costs or latency may make the mission unsustainable.
Substitution limits the blast radius of each event. It also improves bargaining power, reduces lock-in, and prevents the provider’s roadmap from becoming the government’s architecture.
Operational portability is larger than data portability
Exporting documents is not enough. A substitutable AI system must preserve the control plane:
System instructions and policy manifests.
Identity, delegation, and tool permissions.
Retrieval configuration and source controls.
Memory boundaries and approved state transfer.
Audit formats, event identifiers, and decision evidence.
Human-approval workflows and circuit-breaker logic.
Capability and regression criteria for the mission.
The model may change. The authority boundary must not.
Emergency substitution needs a contractual path
Planned model changes can retain normal notice and approval. Emergency substitution should be allowed when a provider becomes unavailable, insecure, materially altered, deprecated, or noncompliant for reasons outside the operator’s control. The alternate model should come from an updateable pool or an approved emergency process. Required controls must remain active. The contracting officer should receive rapid notice and regression evidence, and the government should retain rollback authority.
This is not a loophole. It is the equivalent of failover, backup restoration, and alternate communications in every other resilient system.
The architecture is already practical
A model-neutral gateway can route among commercial APIs and locally hosted models while keeping tool policy, memory governance, data filtering, logging, and approval outside the model. The AI SAFE² Hermes Sovereign Runtime is one open implementation of this pattern. The policy lesson is broader than the specific software: the model should be replaceable without rebuilding the system’s trust boundary.
Federal policy is moving in this direction
NSPM-11 directs rapid onboarding of advanced models from multiple vendors, adaptation of commercial and open-source technologies, interoperability, and protection against dangerous single-vendor dependence. NIST’s agent initiative similarly emphasizes open protocols and secure interoperability.
The next step is to translate those principles into acquisition requirements. Every consequential AI contract should identify the essential functions, the alternate model or emergency process, the maximum acceptable recovery time, and the evidence required after substitution.
Substitution protects judgment from monoculture
Substitution is also a decision control. When every workflow depends on one model, the organization inherits that model’s framing, omissions, and refusal behavior as a common-mode risk. A second model can expose hidden assumptions, but only if it has genuinely independent data, policies, or accountable reviewers.
Portable evidence, policy manifests, and decision receipts let the mission change engines without losing the rationale, dissent, and audit history behind prior decisions.
Author note: Vincent Sullivan is the founder of Cyber Strategy Institute and a retired U.S. Air Force lieutenant colonel. His work focuses on runtime AI governance, zero-trust architecture, federal acquisition, and operational resilience.
Never build a mission around an engine you cannot replace.
A replaceable model is a component. An irreplaceable model is a single point of failure.
