A spacecraft cannot phone home before every decision, the speed of light makes the round trip too slow. When an anomaly happens and ground control is minutes or hours away, the vehicle must decide for itself. AUTHREX-SPACECYBER governs what a spacecraft is allowed to do on its own, at what authority tier, and when it must hold and wait for a ground uplink instead of acting on uncertain data.
In space, the human is structurally out of the loop. A satellite in low Earth orbit may have only minutes of contact per pass; a deep-space probe is light-minutes from any operator. When a fault or a threat appears between contacts, waiting for a human is not an option, and acting blindly on possibly-stale data can put the vehicle into a worse state, a bad maneuver, a wasted burn, a tumble.
AUTHREX-SPACECYBER runs the governance pipeline onboard. When an anomaly is detected, the pipeline first asks whether the triggering data is fresh and trusted (SATA): a conjunction warning based on stale ephemeris is not acted upon as if it were current. It then sets the authority tier for the proposed response by its consequence (HMAA), and asks whether there is time to wait for a ground uplink before committing (FLAME). A low-consequence, well-supported action within the vehicle's authorized envelope executes onboard. A high-consequence action, or one based on uncertain data, triggers a governed safe-hold: the vehicle enters a safe state and waits for ground rather than gambling. If communications never arrive, CARA keeps it in that safe state indefinitely rather than defaulting to action.
The teaching point is that distance forces governed autonomy. The further the human is, the more the vehicle must be trusted to act, and the more important it is that its authority is bounded, evidence-checked, and reversible by design.
Operators of LEO constellations get vehicles that can handle anomalies between contacts without either freezing (and risking the asset) or acting recklessly on stale data. The vehicle knows the difference between "act now" and "safe-hold for ground."
Designers of autonomous spacecraft get a bounded authority model they can reason about: every onboard action has a tier, a freshness check, and a recovery path, so autonomy is auditable rather than a black box.
Civil-space programs pursuing autonomous onboard health management get a governance reference that matches the capability NASA is soliciting, with safety bounded by construction rather than by hope.
Autonomous onboard capability is something NASA is actively soliciting, and space-system safety is a directive-level government concern.
NASA SBIR 2026 BAA subtopic EXPAND.3.S26B seeks autonomous onboard health management for small spacecraft and distributed systems. SPACECYBER is a governance reference for exactly that: onboard autonomy that is bounded, evidence-checked, and reversible.
Space Policy Directive 5 addresses cybersecurity principles for space systems. A governed onboard authority model, where the vehicle will safe-hold rather than act on untrusted data, is a concrete safety control aligned with that direction.
Space assets are expensive, scarce, and strategically vital. A governance layer that prevents a satellite from acting on a spoofed or stale signal protects national assets from both faults and manipulation.
SPACECYBER is the AUTHREX pipeline instantiated for orbit, the same governance core used across the other domains. One validated pattern serving space reduces the cost of trusting autonomy in a high-stakes environment.
An anomaly is detected onboard. Set how far the ground station is (the signal delay) and pick the situation, then run it. The vehicle decides whether to act onboard within its authority, or to enter a governed safe-hold and wait for ground. Illustrative simulation of the onboard authority logic, not operational validation.
Every AUTHREX application shares one verified core. The HMAA authority state machine is specified in TLA+ and exhaustively model-checked: 48,751 reachable states verified, with 8 of 9 safety properties holding (no skip-ahead, monotonic downgrade, no zombie tier, among them). The ninth, the MAIVA CriticalSafe invariant, is flagged as a known violation in the issue register rather than hidden, which is the honest state of the work. The model checker also caught a real S5 view-change regression during development, evidence the method finds defects rather than rubber-stamping them.
Federal anchors: NASA SBIR 2026 BAA subtopic EXPAND.3.S26B (autonomous onboard health management for small spacecraft); Space Policy Directive 5.