Cleared to Fly or Drive Is Not Cleared to Act: Actuator-Level Execution Finality and Compact Act Evidence for UAS and Autonomous Vehicles

Abstract Unmanned Aircraft Systems (UAS) trust infrastructure establishes aircraft identity, Remote Identification, authentication, and mechanisms for determining whether a flight may operate within a particular airspace or operational context. However, these mechanisms do not necessarily establish whether a specific consequential act is authorized to become effective at the actuator at the precise moment of execution. This document addresses that boundary by introducing an actuator-level Execution-Finality architecture in which a Candidate Act remains non-effective until a Protected Enforcement Domain (PED) verifies the exact act, intended Finality Sink, current authority, freshness, generation state, and relevant execution context. The architecture introduces the UAS Candidate Act Descriptor (U-CAD), Airspace Authority Object (AAO), Execution Handle, Binding Commitment, Finality Sink, and optional Beacon Proof Capsule (BPC). For constrained Remote ID and air-to-air communications, the draft further defines compact broadcast evidence using delayed disclosure and a TESLA-style one-way key chain, enabling observers to verify that a protected enforcement domain made an allow, deny, or safe-state decision before corresponding evidence became verifiable. The proposal complements, rather than replaces, DRIP identity and authentication mechanisms. It provides a potential interoperability layer connecting DRIP, RATS, COSE/CBOR, ACE, SCITT, and constrained-device environments, while also defining reference state machines, negative-control tests, replay handling, and red-team evaluation. The accompanying reference implementation is intended to make the proposed security properties reproducible and testable.