Autonomous-Fleet Decision-Rights Stress-Test Director

The mandate

The operator has documented safety responsibilities, but real incidents expose a narrower unresolved problem: the remote supervisor, on-call executive, safety officer, city liaison and automated fleet controls can each constrain service, while the authority to restore a modified operating domain is unclear. Teams escalate conservatively, then negotiate exceptions in chat channels. The engagement will test executable decision rights at operational speed rather than rewrite the safety-management system.

The primary deliverable is an autonomous-fleet decision-rights architecture covering stop, degrade, geofence, dispatch, passenger recovery, evidence preservation, city notification and service release. Named artefacts include 24 decision cards, a machine-to-human alert classification, a regulatory and contractual boundary map, an escalation clock, three simulation records and a remediation backlog. Algorithm validation, vehicle certification, legal opinion and safety-case authorship are outside the defined work.

Milestone one, at week three, maps current authority from policies, contracts and incident evidence. Milestone two, at week seven, provides draft cards and identifies conflicting veto, recommendation and approval rights. Milestone three, at week twelve, runs three exercises spanning fleet anomaly, remote-operator overload and city-requested restriction. Milestone four, at month four, delivers the accepted architecture, implementation ownership, training scenarios and evidence-retention specification.

Acceptance requires the Chief Operating Officer, Safety Executive and two city operations leads to execute all 24 cards without inventing an approver or bypassing a required veto. Each scenario must produce a time-stamped service state, passenger action, preserved evidence, external notification and release condition within its agreed clock. The board safety committee will accept the work when accountable executives sign the residual conflicts and Internal Audit can reproduce the decision trail.

The client will provide safety policies, operating-domain definitions, system alert taxonomies, incident records, city contracts, on-call rosters, communications logs and controlled access to fleet and remote-operation environments. It will nominate a safety sponsor, operations product owner and eight-person working group, make legal counsel available to confirm boundaries, and ensure three simulations are staffed. Management retains every live service, safety, technical and regulatory decision.

Why this is external work

Existing owners helped design the current controls and naturally interpret ambiguity through their own professional duty. A neutral operator is needed to compare formal authority with behaviour under simultaneous technical and public pressure. The company also needs a facilitator able to challenge both over-cautious paralysis and unsafe commercial override without becoming the safety approver.

What you will own

• Trace stop, constrain, passenger-recovery, notification and release rights from policy and contract into observed operating practice.
• Distinguish machine action, human recommendation, safety veto, executive approval and city instruction for 24 bounded decisions.
• Design decision cards specifying evidence input, service state, clock, owner, consultation, record, escalation and release condition.
• Reconcile conflicts between city obligations, operating-domain rules, remote-assistance capability and internal safety-accountability statements.
• Run three staffed simulations that force decisions under incomplete telemetry, operator overload and visible passenger consequence.
• Record invented approvers, hidden vetoes, unsafe shortcuts, missing evidence and technology changes required for reliable execution.
• Deliver the signed architecture, residual-conflict paper, training scenarios, decision-log specification and sequenced remediation backlog.

Candidate qualifications

• Designed or operated decision rights in autonomous mobility, aviation, rail or another software-intensive safety-critical service.
• Can separate a safety veto, technical assessment, operating choice, regulatory duty and commercial consequence under time pressure.
• Has reconstructed authority from incidents where formal responsibility and actual decision behaviour materially diverged.
• Facilitated realistic executive and control-room simulations without turning them into scripted demonstrations of existing policy.
• Understands evidence preservation, service-state control, passenger recovery and external notification across machine-human operations.
• Delivered implementable governance while leaving safety-case, certification, legal and live operating authority with accountable owners.

Non-negotiables

• Can conduct three controlled operating-domain observations and all staffed simulations during the four-month window.
• Will remain independent of autonomous software, vehicle, telemetry, assurance and implementation vendors under consideration.
• Accepts no live vehicle, fleet, safety, regulatory, city-contract or service-release authority through this scope.
• Brings tested safety-critical decision architecture; generic RACI design or workshop facilitation alone is insufficient.

1. 49 words maximum. Describe a safety-critical decision where the stated approver was not the person exercising authority in practice.
2. 49 words maximum. How would you test a service-release card without influencing a live autonomous operation?
3. 49 words maximum. Which evidence must survive a geofence decision so an independent reviewer can reconstruct it?