Autopilot Steered a Model X Into a Highway Barrier at 71 MPH, Killing the Driver With No Warning or Braking

High-consequence gate · human override

The AuthorityGate Operational Resilience framework treats any safety-critical autonomous control decision as a change that requires a validated human-oversight gate before it can be trusted to act unsupervised. For an automated steering system, the gate is a change-validation requirement: the system may not hand sustained lateral control to automation in an environment it has not been validated to handle (degraded lane markings, gore areas, lane splits) without a human SME having signed off that those conditions are within the validated operating domain. When the system encounters a scenario outside that validated envelope, the gate forces a verified, escalating handback to an attentive human and refuses to continue at speed on an unconfirmed lane track. Critically, the human-in-the-loop check must be real, not nominal: AuthorityGate requires positive, continuous confirmation that the human SME is actually engaged and attentive before automation is allowed to remain in control, and it must fail safe (slow and stop) rather than fail open (accelerate into an unverified path) when that confirmation is absent. Either gate would have caught this failure: the lane split was outside the system validated competence, the driver attention was unconfirmed for the final 6 seconds, and the car accelerated instead of degrading safely.