Two bodies orbiting each other do not orbit each other, exactly. They both orbit a point between them, the barycenter, whose location is determined by their masses. The Sun and Jupiter share one that lies just outside the surface of the Sun. The Earth and its Moon share one 4,600 kilometers from the Earth's center. Neither body is still. Neither body is fully in charge. The barycenter is what actually holds the system.
The company is named after this because the runtime we are building is a barycenter. It sits between two things, human authority and machine autonomy, and lets them share governance of a mission without either one collapsing into the other.
The problem, without euphemism
Missions are gaining autonomous components faster than they are gaining ways to govern them. This is not a slogan. It is what happens when the state of the art in perception, planning, and adaptation moves forward, and the mission software that has to integrate all of it moves at the pace of flight qualification. The gap widens every year.
The industry response has been to talk about AI. That is a distraction. The gap is not between missions and better models. It is between missions and the layer that would let many good components, most of them not AI at all, behave as one governed system. That layer has no widely used name inside the agencies, no reference implementation to point to, and no ecosystem of interoperating parts. Every mission rebuilds it, badly, from parts.
We think this is the layer worth building. We think the field will look back and be surprised nobody named it earlier.
Authority is not a UI
When people first hear "autonomy under authority," they picture a human clicking approvals in a dashboard. That is the wrong picture. The interesting authority is not the human in the loop moment by moment. It is the authority the mission designer sets weeks in advance, in the form of intent, prohibitions, and priorities that the software will hold to when Earth is unreachable and no human is available to approve anything.
Authority is upstream. It is the intent that the runtime compiles into formal goals and prohibitions before the mission even leaves the ground. When the runtime later refuses to execute an action, it refuses on the basis of that intent, and it does so hours or days after any human is in a position to reconsider. That is what makes the authority real. It is what a permit is signed against, and it is what remains when the humans are asleep, out of contact, or overloaded.
Autonomy under authority means the humans set the terms of engagement long before the situation arrives, the software enforces them without them, and the record is available for review afterward. It is not the language of dashboards. It is the language of doctrine.
Trust is engineered
The other half of the sentence is autonomy. And the honest fact about autonomy is that trust in it, at the level a serious mission requires, is not promised. It is engineered.
Engineering it looks like this. Every component that acts has its input domain named and its output range constrained. Every component that learns has its operating domain monitored, so it loses trust automatically when it drifts. Every action is proposed through a formal action vocabulary. Every decision to execute is signed by a small, separately verified mechanism against the mission's current intent and belief. Every decision is recorded such that it can be replayed exactly by an accident board.
These are not exotic techniques. They are the discipline that got aviation to the reliability it has, and the discipline that runs safety instrumentation in reactors, and the discipline that separates fire control from navigation on a warship. The novelty is only in applying them, systematically, to autonomy in space missions, where too many programs still ship autonomy as a monolithic black box that was one team's brilliant idea two years ago.
Why now
Three converging pressures. First, missions are getting harder in the direction that autonomy alone cannot help. Longer round-trip light times, larger constellations, more distributed sensing, more compound failure modes. Second, learned components are becoming genuinely useful, which means they are being flown, which means the question of where they sit in the architecture is not theoretical. Third, the agencies have started naming the shortfall, not as "AI" but as trustworthy autonomy, as assurance for autonomy, as the missing systems layer. Their language is more careful than the industry's, and it is more useful.
We are building now because the shape of the answer is legible now. Nothing about this required a breakthrough in machine learning. It required a category, a name for the layer that has been implicit for thirty years, and enough evidence to be specific about the mechanism.
What we will not do
We will not sell a demo. The comparables that shipped autonomy to serious buyers did not lead with demos, and we do not have one to give strangers. We will work with a small number of design partners against real missions, and the runtime will be shaped by that work.
We will not describe machine learning as the trust boundary. Learned components are useful and welcome; they are not what decides what runs.
We will not publish claims we cannot trace. Every essay carries a bibliography drawn from primary sources. Every architectural position is a falsifiable hypothesis. When evidence refutes a position, the position moves.
We will not stage credibility. No logo walls before there are customers. No "trusted by" section before it is true. No compliance badges before the audits are done. Credibility comes from the writing and from the specificity of the mechanisms, or it does not come.
The image we are working toward
A rover, three years into a surface campaign, on a planet where the day is longer than ours and the sky is the wrong color. It is out of contact with Earth for reasons that were expected. It has an intent artifact signed by an operations lead who is asleep. It has a belief about the world that changed six hours ago when a wheel found a rock it did not expect. It proposes an action. Its assurance kernel checks the action against the intent, the belief, and the constraints, and grants a permit. The action executes. A record is written. The next morning, someone on the operations team reads the record over coffee and finds that the rover made the same decision they would have made, for the same reasons, six hours before they could have made it.
That is what we are building. Not a smarter rover; a better relationship between the humans and the vehicle. A shared center of mass. A barycenter.
If you work on planning under uncertainty, runtime assurance, or flight software, and you want to talk, we would like to hear from you. If your mission needs autonomy it can certify, even more so.