The design review that never happened
Here is the shape of this whole story, and it's a shape every engineer has seen before.
A company sold a product to a customer. To deliver it, the company was integrated deep into the customer's infrastructure — it became the pipeline other vendors rode in on. Then the customer and the company disagreed about a policy rule. And the customer discovered that the same integration that granted access was the mechanism to revoke it.
That happened to Anthropic this year. We'll get there. But it's the last chapter, not the first, and the reason it's worth an hour of your life is that it is the same failure as the one that put eighty million people's home addresses on an ICE agent's phone. Different layer. Same missing component.
We're going to do this as an architecture review.
Everyone else does defense tech as a morality play — are the tech guys good or bad, pick a team. You already know your answer and the argument is boring. But underneath the manifestos and the valuations, somebody built a distributed system. It has ingest. It has a schema. It has joins across services with wildly different authorization models. It has write-back. It has a deletion story that isn't true. And it has exactly one enforcement point, which is a federal judge in San Francisco, operating asynchronously, months after the reads already happened.
Every engineer listening has sat in the meeting where somebody raises a hand and says "wait — who's the policy decision point here?" and everything stops for twenty minutes.
That meeting never happened. Let's have it now.
Start with what Palantir actually sells, because most people get this wrong, including people who work in tech.
Palantir is not an analytics company. Its core product is an ontology — a shared object model layered over a customer's disconnected databases that declares: this record in the benefits system and this record in the law-enforcement system are the same person. That's an entity-resolution decision, and it is the most consequential schema decision in American civic life right now.
But here's the part almost nobody covers, and it's in Palantir's own public documentation. The Ontology is not a read model. Palantir splits it into semantic elements — objects, properties, links — and what the docs literally call the "kinetics" of the organization, expressed as action types and functions. Action types, per Palantir, let you capture data from operators or "orchestrate decision-making processes that connect to your existing systems."
Go one level down and it gets more concrete. Palantir ships a documented feature called side effects, which exist to "send data out of Foundry to integrate with existing organizational processes." Their webhook side effects page names the pattern outright: "sending a request to an external system, such as Salesforce, SAP, or any configured HTTP server, typically to modify data in that external system."
Read that as an engineer. A user clicks a button in a UI, an object mutates, and an HTTP call fires into a system of record somewhere else. The join has a side effect. This is not a dashboard. It's a control plane with write-back — and there's a real failure-mode subtlety in the docs worth naming: side-effect webhooks are best-effort and fire after the object write commits, so if the external call fails, the internal change already happened and there is no rollback.
Now hold that thought and look at ELITE.
ELITE — Enhanced Leads Identification and Targeting for Enforcement — is the Palantir tool ICE uses. 404 Media, which obtained the user guide, describes it as software that "populates a map with potential deportation targets, brings up a dossier on each person, and provides a 'confidence score' on the person's current address." EFF's January 2026 report documents that the data feeding it includes HHS records, Medicaid among them.
An address dossier with a confidence score, surfaced on a map, in a system whose object layer supports write-back and external tasking. That is not a search engine. That is a work-queue orchestrator. The output of the query is an assignment.
You shipped a classifier to production, in the highest-stakes deployment imaginable, and you never published the confusion matrix.
Because one number does not exist anywhere: nobody has ever published ELITE's false-match rate. Not 404 Media, not EFF, not Palantir's own rebuttal. A system that assigns confidence scores which precipitate armed visits to physical addresses has never released a precision or recall figure.
The product isn't surveillance. The product is the join — and the join is wired to an actuator.
Here's where I have to correct the version of this story you've probably heard — including a version I believed a week ago.
The lazy claim is that Palantir's platform has no purpose limitation. That's false, and it's checkable. I said it in draft one. I was wrong.
Palantir ships a documented capability called Purpose-Based Access Controls. It inverts the request unit: instead of applying for a dataset, a user applies for a Purpose, and — Palantir's words — "the Purpose is set by data governance teams to contain data specifically scoped to help the user meet their goal, no more, no less." Two separate approvals are required, each with a written rationale, so an auditor can reconstruct not just who accessed what but why. Data lineage is a first-class product surface with its own docs tree, and it spans past raw datasets into the Ontology itself.
So the controls are real. Which makes the actual story much worse, and much more familiar.
Every engineer listening knows this model. It's AWS. It's GCP. It's the model under which every S3 bucket that ever leaked was, technically, correctly configured by the vendor.
The purpose taxonomy is customer-defined. Palantir ships the mechanism; the government writes the contents. Which means the question "was this data used for the purpose it was collected for" has no answer in the platform. It has an answer in a policy file, and the policy file is owned by the party that wanted the join.
The control plane had a purpose field. Somebody had to fill it in — and the somebody was the customer.
Now the specific failure — and I'm going to attribute this carefully, because most of what we know comes from a court filing, and a filing is an allegation.
First, the lawful baseline, because the violation is only legible against it. On November 25, 2025, CMS published a Federal Register notice announcing Medicaid information sharing with DHS — 90 FR 53324 — reversing its prior assurance that enrollee data wouldn't be used for immigration enforcement. Then on December 29, 2025, in California v. HHS, Judge Vince Chhabria ruled that CMS could share basic biographical, location and contact information, while keeping an injunction on sensitive health data and on data about citizens and lawful permanent residents.
So there was an authorized channel, with a schema constraint on it. Note what the constraint actually is: a row-level filter on citizenship status.
The AGs' sharpest line is an engineering argument: "ICE's inability to identify Medicaid records in its possession undercuts any claim that the agency should be entitled to more access to that data."
Then the deletion. ICE's own declarant — Alberto Briseno, a section chief at Homeland Security Investigations — stated that after the file was supposedly deleted, "half a dozen users still had a copy of the Jan. 7 dataset." He also stated ICE deleted it once discovered, that it wasn't used for law enforcement purposes, and that ICE would "continue to make good faith efforts to delete any copies that may be found in the future."
Palantir's position is on the record and you should hear it. In its published response to EFF, the company says it "is not working on any master database project to unify databases across federal agencies," describes ELITE as surfacing likely addresses for specific individuals with removal orders or serious criminal charges, says the HHS sharing is "pursuant to lawful authority," and argues that "all platform interactions, from data ingest onwards, are subject to detailed logging" through an indelible audit log — that centralization is better for accountability than decentralized systems with no audit trail at all.
That argument deserves a serious answer, so here it is: an audit log is a detective control, not a preventive one. It tells you the Jan 7 dataset moved. It does not stop it from moving, and it did not stop six copies from persisting through a deletion. Palantir's own defense is that the platform faithfully recorded a violation it was not architected to reject.
Nobody had to be evil for this to happen. Somebody had to be fast — in a system where the only component that can say no is a court, running asynchronously, months later.
The counterargument is that civil analytics and military targeting are separate products in separate deployments. Foundry over here, Gotham over there.
The precise version: Foundry is the commercial and civil data platform — it runs NHS England's Federated Data Platform under a £330 million contract touching 56 million patients. Gotham is the intelligence and targeting platform. UK health-policy analysts at Medact describe "drag and drop" transfer between them.
State the mechanism correctly, because the overstated version is easy to knock down: this is a supported path within a single customer's enrollment. Nobody is claiming there's a pipe from the NHS to the Pentagon. What exists is a first-class, no-code UI affordance for moving objects between two environments with radically different threat models, legal bases for processing, and clearance requirements — when one organization holds both.
A marking tells you how sensitive a thing is. It does not tell you what it was collected for.
And here's the sharper point, the one that generalizes: the access-control model in this world is fundamentally classification-based, and classification is orthogonal to purpose. "Given to a nurse in order to pay for care" is not a classification level. There is no clearance you can hold that makes that fact true again once the row leaves.
It is often claimed — including in my own first draft — that a Palantir executive confirmed the company would hand over NHS data for immigration enforcement. What Alex Karp actually told the BBC was the opposite: "I don't have access to your data... That data belongs to the government of the United Kingdom."
Which is consistent with everything in Chapter 2. He's right. He's a processor, not a controller. That's the point. The technical capability is complete, and the only remaining control is whoever owns the policy file.
Meanwhile the second-order effect is already measurable: migrants are avoiding NHS care over data-sharing fears, including pregnant women skipping prenatal care and people avoiding substance-abuse treatment.
You built a system where seeking medical care is a surveillance vulnerability. The users noticed before the architects did. They're routing around the outage.
So who reviews any of this? Conflict rules, recusals, cooling-off periods — somebody's holding the reviewer role, right?
Follow it, and every answer is exogenous and asynchronous. Not a component in the system. A thing that happens to the system, later.
Detachment 201. In June 2025 the Army directly commissioned four tech executives as Lieutenant Colonels — Shyam Sankar (CTO, Palantir), Andrew Bosworth (CTO, Meta), Kevin Weil (CPO, OpenAI), and Bob McGrew (advisor at Thinking Machines Lab, formerly OpenAI's Chief Research Officer). O-5 normally takes 16 to 22 years.
Be precise about the conflict question, because the headlines got it wrong. Military.com did not report that the executives refused to recuse. Its body reports an absence of mechanism: officials insisted none would be involved in contract decisions, "yet there is virtually no systemic oversight on that potential conflict of interest." Army spokesman Steve Warren: "It's not in our interest to show any favoritism to a company — that would be the exact opposite of what we're trying to do, right?"
And then — credit where due, this is a real then/now beat — by the second cohort in June 2026, an Army spokesperson says "Recusal from any matter affecting the financial interests of members of Detachment 201 is mandatory," with financial disclosure, ethics training, legal review of tasks, and functional separation barring vendor selection. The control got built. It got built after deployment, in response to external pressure — including a July 2025 Democracy Defenders Fund referral to the DoD Inspector General. Which is exactly the pattern: the enforcement point is outside the system.
BOND. In February 2026 Secretary Hegseth announced Business Operators for National Defense, led by Deputy Secretary Steve Feinberg, embedding private-sector executives directly into the Pentagon's acquisition enterprise — 100+ industry experts including 72 former CEOs, COOs and CIOs, targeting 250. Senator Warren opened a probe of the program on July 29, 2026 — yesterday, as we record.
I had a version of this segment sourced to a single outlet claiming a DOJ Office of Legal Counsel opinion blessed defense-company employees working inside the Pentagon while holding company stock. I could not corroborate that opinion exists. Not in the legal analyses, not in mainstream reporting, not anywhere I could check. So I'm not asserting it.
What I can say, and it's documented: the separate OPM-run US Tech Force — directed by former a16z first-employee Scott Kupor — allows candidates to serve on leaves of absence without divesting their stock. Two different programs. I'd conflated them.
Section 1045 isn't the rollback — it's the McCain-era post-government cooling-off provision itself, from the FY2018 NDAA. What's happening is that DoD has asked Congress to weaken it in this year's bill: narrowing the two-year window to apply only to an official's specific former office rather than the whole department, and stripping restrictions on "preparation and planning activities, research and other background work," per Responsible Statecraft, with Cato arguing for a four-year period instead. I could not confirm the change was adopted into enacted text. So: the Pentagon asked. That's the claim.
Marc Andreessen sits on the Defense Policy Board, which advises the Secretary and has no disclosure rules, while a16z holds Anduril, Shield AI, Saronic and Skydio.
Eric Schmidt is the case people cite as hidden — and it isn't, which is itself instructive. He chaired the National Security Commission on AI, which concluded the U.S. must buy more military AI, and the Defense Innovation Board, which shaped contracting policy. He then advocated publicly for cheap attack drones while running a stealth drone company: White Stork, which Forbes broke in January 2024 and caught testing in a Silicon Valley suburb months later. It's now Swift Beat, a named public supplier to Ukraine. It was reported, twice, by a major outlet — and the requirements-writer still became the vendor. The failure wasn't secrecy. The failure was that disclosure has no enforcement point either.
Thiel built the companies. Andreessen placed the bets. Schmidt wrote the requirements doc.
In every one of these, the policy decision point is a court, an inspector general, a Senate letter, an NDAA section — always outside, always after. A system whose only enforcement point is exogenous does not have an enforcement point. It has a postmortem process.
We make this show with Claude. Claude is made by Anthropic. I have an obvious interest here. So this chapter is more heavily sourced than any other one, everything is linked, and I want you to go read the filings yourself.
The content of the refusal gets misreported constantly — including by me in draft one. There were two carve-outs:
We support the use of AI for lawful foreign intelligence and counterintelligence missions. But using these systems for mass domestic surveillance is incompatible with democratic values.Anthropic, February 26, 2026
And fully autonomous weapons — those "that take humans out of the loop entirely and automate selecting and engaging targets" — with the stated objection being reliability, not principle: "today, frontier AI systems are simply not reliable enough."
The three-rule version with the "social credit" line is OpenAI's, from its own Pentagon deal. If you've heard it attributed to Anthropic, that's a transposition. Also: the appeals court did not uphold the designation. It declined to pause it, on a different statute, without reaching the merits. Two courts, two postures.
Now the part I care about as an engineer. Strip the branding off those two carve-outs. They are deny rules on a permissive default — not "we won't serve you," but "we'll serve everything except these two classes." And here's the thing that makes this a spine rather than a sequence:
Run the ELITE workflow from Chapter 1 against those deny rules.
The only party in this entire story that wrote down a rule which would have rejected the Chapter 3 workflow — was designated a national security risk for refusing to delete it.
And one more correction, because the analogy I reached for first was wrong and the true version is worse. Those deny rules were not a technical guardrail somebody could route around. They were contractual — terms of service in a commercial agreement. The only functioning access-control mechanism in this entire architecture was a clause in a contract.
The rhyme with 2019 is real, but state it accurately. When Google walked away from Project Maven after roughly 4,000 employees signed a petition, Palantir picked up the work. Peter Thiel did use the word "treasonous" about Google around that period — but in 2018, as a rhetorical question about Google's China and Dragonfly work, not as a verdict on Maven. Don't let anyone hand you the cleaner version; the cleaner version isn't true. Karp's advice at Davos to employees with reservations was, on the other hand, exactly as blunt as advertised: "Don't work here."
Here's the 2026 rhyme nobody covered, and it runs the other direction. On February 27, employees at Google and OpenAI published an open letter backing Anthropic — roughly 450 signatures on day one, reaching nearly 900. Then on March 10, 30-plus OpenAI and Google DeepMind employees — including Google chief scientist Jeff Dean — signed an amicus brief: "This effort to punish one of the leading U.S. AI companies will undoubtedly have consequences."
Seven years after 4,000 Googlers signed a petition to get their employer out of a defense contract, 900 signed one to keep a competitor in one.
Every failure in this story is the same failure at a different layer. Someone decided the component that says no is the component slowing us down.
Before we look at the money I have to make the other argument properly, because if I can't make it convincingly I haven't earned the rest of this.
The acquisition system is genuinely broken, and the evidence is the government's own. Take IVAS — the Army's augmented-reality headset.
If you think procurement reform is a Silicon Valley talking point, that's a GAO report.
And the reform effort has underdelivered too, which cuts both ways. Replicator was supposed to field "attritable autonomous systems at a scale of multiple thousands, in multiple domains, within 18-to-24 months." Two years to the day later, a DIU official said: "We were able to field hundreds, not multiple 1,000s." You can read that as "the new model fails too" — or as "the old system is so slow that even the emergency workaround got stuck in it." Both readings are available and honest people hold each.
And the strategic argument is real. The most-cited number is that Chinese shipyards hold roughly 200 times U.S. shipbuilding capacity — from an Office of Naval Intelligence slide: 23.25 million tons versus under 100,000. Be careful with it: that's commercial shipbuilding, and the U.S. figure excludes every warship America builds. RAND argues the capacity "will not necessarily" convert to naval production; CSIS argues the firewall is porous. On actual warships it's roughly 370 PLAN hulls to 293 USN — 1.26 to 1, with the U.S. still ahead on tonnage.
But even on the conservative reading the argument stands, and CNAS states it cleanly: "the United States cannot afford, nor can it build quickly, enough high-end weapons... Thus, lower-cost autonomous systems are needed to make up the difference." Hicks put it as: Replicator "is meant to help us overcome the PRC's biggest advantage, which is mass."
If you cannot out-build, you must out-autonomize. That is not stupid. Every critique in this episode has to survive it.
Here is where I have to reverse the thing I believed going in, because the popular version of the Ukraine argument is backwards.
The popular version — Ukraine proves a $400 drone beats a billion-dollar tank, therefore expensive autonomy is a scam — is wrong, and it's wrong in a way that's checkable. Ukraine's trajectory runs toward autonomy, and the reason is jamming.
A radio-controlled FPV drone is a teleoperated system with a hostile adversary sitting on your control channel.
So the low hit rates are an argument for terminal-guidance autonomy, not against it. Ukraine's answer to EW came on two parallel tracks, not one: fiber-optic spools — 352,000 delivered since July 2025, about 15% of front-line drones — and onboard last-mile guidance, like The Fourth Law's system that takes control in the final 500 meters, whose CEO claims 2–4x effectiveness for a 10% cost increase. Treat vendor multipliers with suspicion; none are independently measured.
Also a category error I need to retire. Comparing a $500 FPV to Anduril's full catalog doesn't work. A Dive-LD operates at 6,000 meters for ten days. A Barracuda-500 flies 500+ nautical miles off a cargo pallet. Fury is a reusable fighter-adjacent aircraft carrying AIM-120s. Five hundred FPVs do not give you a way to hit an airfield five hundred miles away.
Here's the narrow claim that does survive, and it's sharper for being narrow. Anduril's Altius-600M carries roughly a 3 kg warhead. Ukraine's Vyriy 15 FPV carries 8 kg — for about $500. On the strike mission specifically — not ISR, not electronic warfare, not relay, where Altius genuinely has an edge — the price-per-effect comparison is brutal. And "affordable mass" is Anduril's own marketing frame, so price-per-effect is a metric they chose.
The field record is mixed in a way that's worth stating exactly. The Wall Street Journal, via TechCrunch, November 2025: more than a dozen drone boats failed in a Navy exercise with sailors warning of safety risks; a Fury engine was damaged in a ground test; a counter-drone test started a 22-acre fire in Oregon; and Ukrainian SBU soldiers reportedly stopped using Altius in 2024. That last one is single-sourced to former employees and unnamed people, with no Ukrainian official on the record — so hold it loosely, and note the UK bought Altius for Ukraine in March 2025, after the alleged abandonment.
The most useful number in the whole story came from Anduril itself, in its rebuttal: early in the conflict, under EW pressure, Altius and Ghost had "effective hit rates of only 10 to 15 percent." Nobody had ever published a number. The company did — alongside a line that is actually a reasonable engineering position: "an 85 percent solution in the hands of our armed forces today is infinitely better than an unachievable 100 percent solution that arrives too late."
Now the money, stated carefully. The FY2027 request contains $54.6 billion for autonomous warfare — $1B in the base budget, $53.6B in reconciliation — against $225.9M the year before, widely reported under the Defense Autonomous Warfare Group.
The phrase "DAWG" does not appear in the comptroller's own budget overview, which calls the line "Drone Dominance." And the increase is substantially a re-aggregation of existing service programs plus a reconciliation top-up, not $54B of net-new annual appropriation. The 24,000% figure is a denominator artifact. Don't use it.
What is fair to say: no unclassified analysis justifying it has been released. And the reason isn't a cover-up — it's structural, which is worse. DoD's own instruction on Analyses of Alternatives routes the report to the milestone decision authority and to CAPE. Cost analyses go to the acquisition executive and to Congress "upon request." There is no step in the process that publishes anything. The transparency isn't blocked. It was never specified.
Be fair about what he's saying: at 28x, Anduril is well below the multiples he's calling absurd, he's describing the tail, and he has an interest in describing it. But he is the chairman of the most valuable company in the sector saying the sector is heading for a collapse.
The thing that can't be evaluated on published results gets evaluated on something else. When performance data is structurally unpublished, allegiance becomes the available metric — which is exactly what Chapter 6 was about. It isn't one AI company's bad quarter. It's the procurement model.
If this landed in your inbox as a design doc, you'd leave five comments — and none of them are political.
The mechanism exists — Purpose-Based Access Controls are real and documented. The policy is owned by the customer under a shared responsibility model. Every cloud breach you've ever read about has this shape.
ICE's own section chief declared six users still held copies of a dataset that had been deleted.
ELITE assigns address confidence scores that precipitate physical enforcement. No precision figure, no recall figure, no false-match rate, ever published — and the object layer supports write-back and external tasking, so the score is an assignment, not a search result.
Recusal built after deployment, contractor executives inside the acquisition enterprise, a request to weaken the cooling-off statute, a Defense Policy Board with no disclosure rules. Every enforcement point is a court, an IG, or a Senate letter — exogenous and asynchronous. And the one party that put a deny rule in its own contract was designated a supply chain risk.
$54.6 billion requested against a process that contains no publication step for the analysis that would justify it.
It says it is a processor, not a controller, and nothing we found contradicts that.
Nothing in the public record shows Palantir sought it.
Hardware fails in tests; that's what tests are for. And Anduril published a hit-rate number nobody made it publish.
We could not corroborate it, so we're not saying it.
It declined to stay it, on a different statute, without reaching the merits.
Every one of these is one adjective away from false — and the sourced version is stronger anyway.
One open thread we should state honestly: we do not know who signed the January 7 transfer. No name is public. That's a real hole, and if you have the docket, we want to hear from you.
Somebody made the most consequential schema decision in American civic life — that a Medicaid record and an enforcement target are the same person — and the only party that wrote down a rule which would have rejected that query was designated a national security risk for refusing to delete it.
Nobody in this story is the policy decision point. That's not a bug in the architecture. That is the architecture.