Almost every defence bid failure that involves an AI tool is a failure of order. The tool was chosen first and the classification was made second. From that point the failure was inevitable. No amount of prompt engineering, output filtering or post-hoc redaction repairs the fact that classified material passed through a system that was not authorised to see it.
The corrective is not a technical control. It is an intake discipline.
Three fields that no downstream stage can override
- Classification. The buyer's own classification, not the firm's guess. If the buyer has not stated a classification, the intake should default to the highest classification the firm has seen for this buyer or programme in the last three years.
- Handling regime. The consequence of the classification. Which agents, which people, which storage locations and which export controls apply. This is a lookup, not a judgement call.
- Named accountable owner. A single named person who owns the classification decision and can be held to it. Not a team. Not a role. A person.
What inheritance buys you
Once these three fields are set at intake, every downstream stage inherits them. The drafting engine refuses to touch material above its authorised classification. The evidence library refuses to accept a source whose signatory does not hold the corresponding clearance. The submission bundle carries the handling regime as a header, so the buyer's own security officer can verify the response was drafted within the correct envelope.
The order is not negotiable. Classification is a decision the firm makes about its work. Tool selection is a consequence of that decision. Every failure mode a defence buyer has seen this decade in AI-assisted bids is a case where the order was reversed.
The governed advantage on defence work is the intake stage that makes the reversal impossible.
Strategist so-what
Claim. Classification is an intake control, not a drafting preference.
Implication. Set classification, handling regime and a named owner before any agent runs and the failure mode disappears rather than being managed.