Bounded AI and a Layered Assured-PNT Architecture for Jamming-Resilient PNT

Table 1. Nomenclature and abbreviations used in this paper.

Modern defense and aerospace systems depend on externally received radio signals for navigation, timing, and coordination. Public United States guidance treats disruption or manipulation of positioning, navigation, and timing (PNT) signals as a resilience problem to be met through verification, planning for signal loss, and layered alternatives rather than dependence on a single source (GPS.gov, n.d.). When that link is denied, timing, navigation, cybersecurity, and mission assurance degrade together.

The phrase “atom-based hardware” is used here to describe devices whose measurement reference is tied to controlled atomic transitions, atomic spin states, highly excited Rydberg states, or atom-wave interference. This category includes atomic clocks (Knappe et al., 2004), atomic magnetometers (Schwindt et al., 2004), Rydberg-atom electric-field sensors, and cold-atom inertial sensors whose sensitivity continues to improve under robust-control techniques (Kitching, 2018; Saywell et al., 2023). These devices do not absorb or cancel hostile RF energy by themselves. Their value is that they can preserve internal timing, supply non-GNSS navigation information, or provide independent measurements of the electromagnetic environment.

A recurring risk in technology assessment is to infer integrated-system readiness from component-level laboratory results. This paper therefore separates component evidence, integration evidence, and operational evidence throughout, and summarizes representative recent work alongside the technology evidence below.

The research question is how atom-based hardware, artificial intelligence, and future quantum-computing resources can be integrated into a layered defense architecture that continues essential functions during jamming without overstating the maturity of the underlying technologies. The contributions are a bounded systems concept; a requirements framework; a verification and validation roadmap, presented in the section ‘Proof-of-Concept Test and Evaluation Campaign’; and an accompanying safety, cyber, and human-systems analysis. The paper is not a prototype description, an experimental report, or a claim of operational capability, and it makes no claim of endorsement by any government organization.

A companion paper, “Atom-Based Timing and Quantum Sensing for Jamming-Resilient Positioning, Navigation, and Timing: A Systems-Oriented Synthesis,” by the same author (Oktenli, 2026: submitted), reviews the device-physics evidence base and closed-form timing and inertial models for the sensing layers referenced here; the two papers are designed to be read together but stand independently.

The paper is organized as follows. The operational context and mission relevance are established first, followed by the technology evidence base, the research gap and question, and the system requirements. The layered architecture is then developed, alongside the adaptation states it must enforce, its authority boundary and its policy to constrain risk. Subsequent sections address artificial-intelligence functions and controls, the bounded quantum-computing role, safety and mission assurance, cybersecurity and resilience, and human-systems integration. The paper closes with reproducibility and evidence discipline, the technology-maturity assessment, discussion, limitations, future work, and conclusions.

Mission dependence on external positioning, navigation, and timing

The operational problem is dependency, not merely signal loss. A platform that draws position, time, and frequency from one satellite link inherits the vulnerability of that link across every function that consumes those quantities (GPS.gov, n.d.). Timing dependence risks being underestimated because it is invisible in nominal operation. Coherent radar and electronic-warfare processing, time-division network access, cryptographic session management, and multi-node sensor fusion all assume a shared, accurate timebase (DARPA ROCkN, 2026). When that timebase drifts, the failures appear in functions that seem unrelated to navigation. A resilient design therefore treats trusted time as a first-class asset that must survive independently of the external link, and treats position and frequency similarly.

Threat environment and operational effects

It is useful to distinguish the principal forms of disruption because they demand different countermeasures. Jamming is the intentional introduction of interfering energy that saturates a receiver front end and denies service (Liu et al., 2018). Spoofing is deception through counterfeit signals that induce a false but plausible position or time solution (Borhani-Darian et al., 2024). Meaconing is a rebroadcast form of navigation-signal deception. Unintentional interference and spectrum congestion degrade or deny reception without malicious intent. A clock-only mitigation helps against denial but does not authenticate truth (Kitching, 2018); a spoof detector helps against deception but does not restore lost timing (Borhani-Darian et al., 2024); and a hybrid estimator helps against partial interference but not against arbitrary sensor corruption (Negru et al., 2024). These distinctions structure the analysis that follows and are summarized in Figure 1.

Figure 1.  Conceptual mapping of disruption classes to operational effects and defensive functions.

Platform, mission-phase, and lifecycle considerations

A single architecture cannot specify numeric requirements for every platform, because dynamics, size, weight, power, and outage tolerance differ widely. The architecture therefore fixes the authority and assurance structure and leaves platform-specific thresholds to be set per program, a separation that keeps the contribution portable across mission types (U.S. DoD, 2022, June).

Degraded-mode operation, disconnected operation, and recovery

The central operational principle is graceful degradation. A jammed external signal should not automatically cause loss of trusted time, navigation, communications management, or operator awareness (Knappe et al., 2004; Kitching, 2018). Instead, the system should transition through documented degraded modes with bounded, observable behavior, and should define a safe state appropriate to the platform (Tabassi, 2023). Recovery is equally important: when external positioning, navigation, and timing become available again, the system must not blindly reaccept them, because a spoofed source can appear at the moment of reacquisition (Borhani-Darian et al., 2024). Reacceptance must be gated by consistency checks and, where appropriate, by operator confirmation (DoD Directive 3000.09, 2023). These transitions are specified as a state machine in the degraded-mode discussion and are reflected in the safety and mission assurance analysis.

Representative platform classes

The entries in Table 2 are proposed qualitative design categories for representative platform classes rather than measured platform requirements. Dynamics denotes the expected rate and range of platform motion that the navigation estimator must track (Jarraya et al., 2025). SWaP tolerance indicates the relative ability of the platform to accommodate additional mass, volume, power, and cooling (Kitching, 2018). Typical outage need is the representative duration for which essential PNT functions may need to continue without an accepted external source (DARPA ROCkN, 2026).

Table 2. Representative platform classes and their dominant constraints on assured-PNT integration.

Concept of operations

A proposed concept of operations is summarized as follows and illustrated in Figure 2. In nominal conditions, the platform uses external PNT with monitoring. On detected interference, the system falls back to a trusted internal reference, bounds error growth with complementary sensors, and surfaces the change to operators. Recovery is keyed to evidence that the external environment is trustworthy again, not to a fixed timer. Degraded and recovery operations are considered in more depth later in the paper.

Figure 2.  Conceptual degraded-mode state machine. Transitions are guarded; recovery and reacceptance of external PNT require validated conditions or operator action.

Artificial-intelligence-assisted functions

The artificial-intelligence evidence base admitted into this architecture should be limited to functions with published demonstrations. Deep learning networks can be trained to detect spoofing directly on cross-ambiguity-function images (Borhani-Darian et al., 2024); reinforcement-learning agents select anti-jamming strategies in communications settings (Liu et al., 2018); and learned components have been validated inside navigation fusion filters under multipath, outage, and environmental variation (Negru et al., 2024). All of these are examples of demonstration-grade results rather than operational evidence. In the proposed architecture, every function drawn from them is carefully bounded by a deterministic governor and an authority boundary.

Quantum computing and post-quantum cryptography

Quantum sensing and quantum computing are distinct and must not be conflated (Kitching, 2018). Quantum sensors use controlled quantum systems for measurement and are the more mature; quantum computing manipulates quantum information for computation and is early-stage for this domain (NIST, 2025). Post-quantum cryptography is a separate classical-algorithm concern. Treating these technologies as a single “quantum” category can obscure their substantially different maturity levels (Kitching, 2018).

Representative recent work

Three recent publications illustrate the research lanes that the proposed architecture is designed to integrate, and comparing the proposal against them clarifies what the framework does and does not contribute. Negru, Geragersian, Petrunin, and Guo (2024) implement and validate a hybrid federated fusion architecture in which two extended-Kalman-filter local filters and a gated-recurrent-unit master filter combine GNSS, inertial, monocular-vision, and barometric measurements for uncrewed aircraft operating in urban environments. They report 95th-percentile position errors of 0.54 m and 1.72 m across two hardware-in-the-loop trajectories that included multipath, GNSS outages, and lighting and weather variation. Jarraya et al. (2025) review GNSS-denied localization for uncrewed aircraft across absolute and relative method families, analyze computational cost alongside accuracy, and conclude that no single sensing modality can satisfy the requirements of resilient operation, a finding that independently supports the diversity principle of the present architecture. Borhani-Darian, Li, Wu, and Closas (2024) train deep neural networks on cross-ambiguity-function images computed during GNSS acquisition to detect and characterize spoofing signals, an instructive example of artificial intelligence applied to integrity monitoring and deception detection rather than to platform control.

Each of these works exceeds the present paper in implementation depth and quantitative validation within its own lane. Negru et al. provide measured error statistics from a hardware-in-the-loop environment; Borhani-Darian et al. report detection performance on synthetic GNSS signal data; Jarraya et al. ground their conclusions in a systematic reading of the experimental literature. The present architecture has not been subjected to system-level trials; its architectural diagrams, readiness assessments, and proposed test thresholds are conceptual or illustrative rather than measured results.

What none of the three addresses, and what this paper is organized around, is the assurance and governance shell within which such components must operate on a defense platform. In the Negru et al. design, learning components sit inside the position solution itself, with no stated bound on their authority, no explicit trust boundary between estimation and actuation, and no treatment of cybersecurity, human oversight, or safety governance. These are reasonable exclusions for a fusion study, but they are precisely the elements a program office must add before such a system could be fielded. The Jarraya et al. review names interference and regulation among the challenges of GNSS-denied operation yet does not carry the analysis into system assurance. Borhani-Darian et al. confine artificial intelligence to detection, which matches the authority boundary argued here, but the detector is studied at the signal level rather than as one monitored component inside a governed platform architecture.

The research gap addressed by this paper is not a shortage of quantum or atomic component demonstrations. Individual devices have been demonstrated, and several are commercially available. The gap is the limited public synthesis available: few disciplined, publicly releasable systems-engineering treatments tie those demonstrations to explicit threat definitions, platform constraints, the timing- and inertial-error models developed in the companion paper, authority boundaries for artificial intelligence, verification strategies, safety and cyber analysis, and bounded operational claims. This paper contributes such a synthesis. The specific question addressed is how these technologies can be composed into an assured-PNT architecture that degrades gracefully under denial and deception, and what evidence would be required to move that architecture from an analytical concept toward a demonstrated capability.

Requirements are stated in measurable form and classified by type. The relevant classes for the proposed architecture include functional, performance, interface, environmental, safety, security, reliability, maintainability, human-factors, data, software, hardware, communication, power, regulatory, and mission-assurance requirements. The acceptance thresholds that depend on a specific mission, platform, outage duration, or threat model are deferred to the system owner rather than asserted here. A requirement is included only if it can, in principle, be verified, and the verification method is named in each case.

The nine requirements in Table 3 are intentionally sparse and span the classes most likely to drive the design. R-01 and R-02 are performance and integrity requirements that establish trusted time and the detection of source inconsistency. R-03 and R-06 are safety and reliability requirements that establish bounded degraded behavior and single-fault tolerance, respectively. R-04 is the safety property that bounds artificial-intelligence authority. R-05 and R-07 are human-factors and data requirements, respectively, that make the system legible to operators and auditable after the fact. R-08 is the environmental and interface requirement for electromagnetic compatibility, and R-09 enforces evidence discipline on any quantum-computing method. Each maps to one or more tests in the verification roadmap, and none asserts a numeric threshold that a defining mission has not yet supplied.

Table 3. Representative system requirements with verification methods and proposed acceptance criteria.

Design principles

This paper proposes a defense-in-depth assured-PNT stack organized around graceful degradation rather than a monolithic “quantum anti-jamming” system; the stack is illustrated in Figure 3. A deterministic estimator retains authority over the navigation solution. Artificial intelligence operates in an advisory capacity beneath a non-learning safety governor. Optional quantum sensors and quantum-computing services fail passively, so that their loss or malfunction cannot corrupt the baseline function. The stack is layered so that a failure in any one layer is contained, observed, and recoverable rather than propagated silently to the mission.

Figure 3. Author-generated conceptual architecture. It does not represent an implemented or validated defense system.

Layer descriptions

1. Conventional RF layer. Existing receivers, antennas, filtering, authentication, interference monitoring, and platform-specific protection remain the first line of defense; see for example Jarraya et al. (2025). Atom-based hardware supplements, rather than replaces, electromagnetic-compatibility engineering.
2. Atomic timing layer. A local atomic reference maintains clock continuity when external timing is rejected or unavailable; see for example Kitching (2018). Independent monitors compare external and internal time sources before external synchronization is reaccepted.
3. Hybrid navigation layer. A classical IMU provides high-rate motion data; see for example Negru et al. (2024). Atom-based inertial or magnetic measurements, when available and valid, bound drift through periodic correction or map matching.
4. Atomic RF-awareness layer. Rydberg or atomic sensors provide an independent measurement channel for field strength, phase, polarization, or spectrum characteristics within their validated operating envelope; see for example Anderson et al. (2021) and Simons et al. (2021).
5. Integrity-monitoring layer. Residual checks, source-consistency tests, clock comparison, and confidence estimates identify disagreement among GNSS, inertial, RF, and atomic sources; see, for example, Borhani-Darian et al. (2024).
6. AI-assisted fusion and adaptation layer. Artificial intelligence proposes bounded actions such as sensor weighting, channel preference, route replanning, or degraded-mode entry. Safety constraints and deterministic fallback logic limit its authority. This layer is a novel addition in the architecture to provide the bounded adaptation outlined earlier and does not come from previous GNSS literature.
7. Authority and safety governor. A non-learning control boundary enforces approved operating modes, rejects unsafe reconfiguration, records decisions, and supports human override. Machine-learning outputs cannot bypass this boundary. This predominantly assurance-oriented layer is a novel addition to the architecture for implementing trusted autonomy (e.g., NIST AI RMF, DoD Responsible AI Strategy, and DoDD 3000.09).
8. Optional quantum-computing backend. Quantum or quantum-inspired optimization may be evaluated offline against classical baselines. It is not assumed to be available onboard or in real time, and the architecture must continue to operate without it. This layer is a further novel addition, reflecting the earlier argument that quantum computing should not be trusted as a real-time operational dependency while quantum computing remains immature.

Data flow, command flow, and trust boundaries

The separation of authority is made explicit in Figure 4. Data and state flow from the sensor layer through the integrity monitor and the advisory fusion channel toward a deterministic safety governor, which is the only path to the mission computer and actuators. Command and authority flow originate from the human operator, or from a verified deterministic mission profile, and pass through the same governor. The artificial-intelligence channel can influence the state estimate and can recommend actions, but it cannot command actuators or alter core control parameters. Two trust boundaries are enforced: one separates the external GNSS and communication receivers from the internal timing and inertial layers, and one separates the artificial-intelligence fusion engine from the deterministic governor.

Figure 4. Conceptual data, command, and trust-boundary structure. Machine-learning outputs are advisory and cannot bypass the deterministic governor.

Degraded-mode behavior and recovery

Degraded-mode behavior is specified as the guarded state machine in Figure 2. From a nominal state that uses all sources, detection of jamming or spoofing transitions the system to a GNSS-denied state that relies on inertial navigation disciplined by the atomic clock. Conflicting sources transition the system to a sensor-disagreement state. If the artificial-intelligence channel exhibits distribution shift or low confidence, the governor isolates it, and the system uses a purely deterministic estimator on internal sensors. If trusted-navigation uncertainty exceeds an approved bound, the system enters an owner-defined safe-hold state. Recovery and reacceptance of external positioning, navigation, and timing require validated conditions or operator action, precisely because a spoofed source can appear at the moment of reacquisition (Borhani-Darian et al., 2024).

Building upon established concepts of governed or bounded AI in which autonomous behavior remains subject to externally imposed safety, security, authority, and risk constraints (Tabassi, 2023; U.S. Department of Defense, 2022; U.S. Department of Defense, 2023), this paper defines bounded adaptation as the subset of bounded AI concerned with runtime optimization and reconfiguration. Under bounded adaptation, adaptation may alter actions, sensor selection, or resource allocation, but may not modify the governing constraints, authorities, or safety controls that define the approved operational envelope. The following formalization states the bounded-adaptation policy that the proposed architecture must enforce. It is a statement of structure rather than a performance model: platform-specific error budgets are set per program, and the closed-form timing and inertial error models that support the sensing layers are developed in the companion paper (Oktenli, 2026: submitted).

Risk-constrained adaptation

A bounded decision policy can be expressed conceptually as selecting, from an allowed action set A, the action a that maximizes expected mission utility, E[ U(a) ], subject to safety, authority, power, thermal, cybersecurity, and communications constraints denoted as gⱼ(a):

The allowed set A must exclude unapproved waveform generation, unbounded online learning, and any change that bypasses operator or system-safety controls. These bounds can be set by program policy, including applicable U.S. DoD policies (2022, June; 2023, January 25), and by the trusted-autonomy requirements adopted for the system. The constraint set gⱼ is deterministic and is enforced by the governor of the architecture, not learned by the adaptation policy.

Uncertainty and sensitivity

The bounded decision formulation is only as useful as its uncertainty treatment. Bias stability, scale-factor error, and environmental sensitivity each widen the error envelope, so the deterministic governor must key on monitored evidence rather than on nominal specifications. Reported values are device specifications or published results, not projected system performance.

Appropriate functions and the authority boundary

For the proposed architecture, artificial intelligence is confined to a bounded advisory role. Its appropriate functions are to classify interference or anomaly patterns from multisensor observations, to estimate confidence and uncertainty for positioning, navigation, timing, and communications sources, to fuse heterogeneous measurements while preserving source provenance, to recommend channel, route, sensor, or power-management options within an approved envelope, to support maintenance by detecting clock degradation or sensor drift, and to generate test cases and prioritize scenarios for engineering analysis. In every operating mode, the human operator retains authority, and the deterministic governor retains veto, as summarized in Figure 5. The artificial-intelligence channel never holds decision authority over actuators.

Figure 5. Conceptual authority allocation across modes.

Required controls

Seven required high-level controls have been identified for the proposed architecture:

1. A non-learning safety governor that can reject artificial-intelligence actions.
2. Explicit operating-domain definitions and out-of-distribution detection.
3. Versioned training data, model provenance, and reproducible evaluation.
4. Independent residual monitors that do not rely on the same model or data path.
5. Abstention and fallback behavior when confidence is inadequate.
6. Operator-visible reasons, confidence, source status, and mode indication.
7. Controlled update and rollback mechanisms with cybersecurity review.

Failure modes

The identified high-level controls address specific failure-mode classes. Distribution shift, adversarial manipulation, and silent degradation each map to a monitor and a bounded response, and none should be permitted to alter authority without passing the deterministic gate. The design objective is that any single control failure be contained by another, so that no artificial-intelligence output reaches the network or the operator without an independent check. This containment is a design objective that may impose performance costs while improving the ability to establish and test trust. It has not been demonstrated; establishing it would require evidence of control independence, common-mode-failure analysis, and the verification activities specified in the test and evaluation campaign.

Figure 6 maps each of these failure modes to the deterministic control that bounds it.

Figure 6. Conceptual mapping of artificial-intelligence failure modes to the deterministic controls that bound them.

Quantum computing may eventually assist high-dimensional optimization problems associated with sensor scheduling, route planning, resource allocation, network design, and robust estimation. Before it contributes to a defense anti-jamming architecture, this paper proposes three preconditions. First, a precisely defined problem instance must map to a quantum algorithm. Second, the total workflow, including data encoding, error handling, and classical post-processing, must outperform a strong classical baseline. Third, the hardware must meet mission latency, availability, security, SWaP-C, and sustainment requirements. The reviewed research evidence currently provides little support for placing quantum computers directly on tactical platforms for anti-jamming control: size, weight, power, and cooling demands, control-loop latency, error rates and the overhead of error correction, and availability, sustainment, and cybersecurity considerations all argue against a real-time onboard role at current maturity. Until operational constraints can be demonstrated to have been satisfied, studies should treat quantum computing as a remotely hosted or laboratory-based capability and benchmark it against classical and quantum-inspired alternatives. Including quantum computing in a title or an architecture does not create technical value by itself; its contribution must be justified by reproducible benchmarks and by total-system cost, as reflected here in requirement R-09 and Layer 8.

The primary hazards are not limited to loss of communications. Incorrect time, undetected navigation drift, false interference classification, unsafe artificial-intelligence adaptation, stale sensor data, and mode confusion can each propagate into mission functions. The safe state is mission-dependent and must be defined by the system owner; depending on the platform, it may mean holding position, returning to a known route, reducing autonomy, terminating a task, or transferring authority to an operator. Safety cannot be claimed merely because no failure was observed in limited testing. The preliminary hazard analysis in Table 4 identifies representative hazards, their causes and effects, and the controls that should reduce residual risk. It follows a conventional severity-and-likelihood structure but does not assert compliance with any specific system-safety standard.

Table 4. Preliminary hazard analysis: representative hazards, controls, and residual risk.

The hazard analysis (Table 4) is a starting point that a system-safety process would refine once a platform, a safe state, and a severity classification are defined. Its purpose here is to make explicit that the hazards of this architecture are not confined to loss of communications, and that several of the most serious hazards, notably accepted spoofing and undetected drift, are failures of trust rather than failures of availability. Designing for observability, so that a dangerous condition is detected and surfaced rather than silently propagated, is therefore as important as designing for availability (Borhani-Darian et al., 2024; NIST AI RMF, 2023).

Representative failure modes and effects

The hazard analysis is complemented by an indicative component-level failure modes and effects analysis in Table 5. The entries are representative rather than exhaustive and use qualitative severity; a program-specific analysis would assign risk priority numbers once detection and occurrence rates are measured against a defined mission.

Table 5. Representative failure modes and effects for principal subsystems.

Figure 7 places the hazards of the preliminary hazard analysis on a qualitative severity-and-likelihood grid before mitigation. The controls listed in the hazard analysis move the residual risk toward the lower-left. The figure is a communication aid, not a quantitative risk computation.

Figure 7. Qualitative inherent-risk placement of the identified hazards before mitigation. Controls in the hazard analysis reduce residual risk toward the lower-left, as the arrow indicates.

The proposed architecture inevitably expands the attack surface through added components and networking, such as sensor interfaces, artificial-intelligence models, clock-distribution networks, update paths, logs, and optional remote computing. The attack surface can be organized as concentric trust zones, from the external radio-frequency environment to a more trusted governor and actuator core, with prevention, detection, and recovery controls at each boundary. Threats include spoofed sensor data, replay, time-source manipulation, model poisoning, malicious updates, privilege escalation, denial of service, and compromise of a shared fusion processor. A zero-trust posture should treat each interface as untrusted until authenticated, apply least privilege between zones, and assume that any single control may fail. Supply-chain and provenance risks are addressed through signed software and models, controlled build and update pipelines, and integrity attestation at boot.

MIL-STD-461G establishes equipment-level electromagnetic-interference emission and susceptibility requirements for applicable equipment, but it does not by itself demonstrate resilience against every intentional-jamming scenario or validate an entire platform (U.S. DoD, 2015). Post-quantum cryptography should be planned for long-lived systems to protect key material and signed artifacts against future cryptanalysis, using the finalized NIST standards (NIST, 2024). The threat-control matrix in Table 6 maps representative threats to prevention, detection, and recovery. Consistent with the paper’s discipline, the system is not described as secure or tamper-proof but as designed with defined controls whose effectiveness must be established by test.

Table 6. Representative cybersecurity threats with prevention, detection, and recovery measures.

Two properties deserve emphasis. First, the timing-distribution layer is a high-value target precisely because so many functions depend on it, so its authentication and its cross-checking against the internal clock are as important as the clock’s own stability. Second, the artificial-intelligence update path is a supply-chain attack surface: a model is only as trustworthy as the pipeline that produced and delivered it, which is why signed models, controlled training data, provenance records, and rollback are treated as security controls rather than as software conveniences. Resilience in this architecture is therefore a property of the whole lifecycle, from build and update through operation and recovery, and it must be demonstrated by test rather than asserted by design.

Operators require concise indications of source health, confidence, degraded-mode status, and recommended action, without being asked to adjudicate raw sensor data in real time (NIST AI RMF, 2023). The interface must make the current authority state legible at a glance and must not normalize silent degradation; a system that quietly narrows its own authority while presenting nominal displays has failed a human-systems requirement even if every component reports healthy (DoDD 3000.09).

The allocation of responsibility between operator and automation must be explicit and stable. Ambiguity about who is responsible for a decision is itself a hazard, because it produces both duplicated effort and gaps in which neither party acts. The design principle adopted here is that automation informs and recommends, the deterministic governor constrains, and the human decides and can always override. This principle is not a limitation to be relaxed as confidence in the automation grows but the property that keeps the consequences of an automation failure bounded, and it is the reason human authority is retained in every mode in Figure 5.

Because this paper makes no experimental claim, its reproducibility obligation is to make its reasoning and its sources transparent, and to state precisely what a future program would need in order to reproduce and extend the work. Appendix A lists the next-step evidence package: mission profile and system boundary, threat model, interface-control document, calibrated dataset with provenance, software and model configuration with version control and seeds, hardware-in-the-loop test report, human-in-the-loop evaluation, and an independent validation report. The claims in this paper are summarized by type in Table 7 so that a reader can distinguish established fact from official finding, peer-reviewed result, engineering inference, and concept proposal. No performance threshold, test result, or compliance status is asserted without a source, and where a value would be required but is mission-specific, an explicit deferral to the system owner is recorded rather than a fabricated number.

Table 7. Classification of representative technical statements by evidence strength.

The integrated architecture should be classified as an analytical concept. It has not been built, verified, or validated. The subsystems, however, occupy a wide maturity range, summarized in Figure 8 and Table 8. The judgments are qualitative and reflect the reviewed literature only; the positions in Figure 8 are engineering judgments, not measurements.

Figure 8. Qualitative maturity-versus-relevance summary of the maturity assessment based on public evidence. Positions are engineering judgments, not measurements.

Table 8. Practical status, value, and limitations of the principal enabling technologies.

A defensible next maturity step is a laboratory breadboard implementation of the proposed architecture that includes a commercial atomic clock, a classical inertial measurement unit, representative auxiliary quantum-sensor data or hardware, conventional RF monitoring, a bounded artificial-intelligence fusion module, and a deterministic safety governor. Success should be measured against explicit timing, navigation, detection, false-alarm, recovery, power, and operator-performance criteria.

Technology-readiness estimates

To make the maturity assessment explicit, the table below records technology-readiness estimates on the standard nine-level scale. These are the author’s judgments from the reviewed literature only. They are not readiness assignments by NASA, the Department of Defense, or any program office, and a formal assessment would require program-specific evidence.

Table 9. Technology-readiness estimates for principal subsystems, with the basis for each estimate.

This section is the verification and validation roadmap promised in the Introduction. It specifies the laboratory campaign that would take the architecture from concept to evidence: what would be built, in mixed software-in-the-loop and hardware-in-the-loop form, and how it would be tested. The campaign is designed to retire the integration risks named in the maturity assessment and to produce the evidence package of Appendix A. Nothing in this section claims results; the campaign is specified, not performed.

Campaign Scope and Rig Architecture

The software-in-the-loop element implements the eight layers as executable, version-controlled components with simulated sensor models, the degraded-mode state machine of Figure 2 as executable logic, and the deterministic governor as a separately built and separately reviewed component. A scenario engine injects jamming, spoofing, meaconing, and congestion profiles from recorded seeds so that every run can be reproduced exactly, in keeping with the reproducibility discipline described earlier.

The hardware-in-the-loop element adds physical components where physics matters: a GNSS constellation simulator driving a real receiver over a conducted radio-frequency path, with radiated testing in a shielded enclosure as a later option; a chip-scale atomic clock as the physical trusted timebase, exercised through thermal and vibration profiles representative of the platform classes in Table 2; a tactical-grade inertial unit on a motion table; and the artificial-intelligence channel executing the actual advisory models rather than stubs. The governor is hosted on hardware physically separate from the learning components, so that the mechanism being judged and the mechanism doing the judging never share a processor, memory space, or failure domain. All internal buses are instrumented, and logs are authenticated end to end as required by the cybersecurity section.

Test Design Traced to Requirements and Hazards

The campaign does not invent its test cases; it inherits them. Each requirement row in Table 3 already names a high-level verification method and an acceptance criterion, and each row becomes a test-case family executed first in software and then, where the method demands hardware, on the rig. The transitions of the state machine in Figure 2 are enumerated as guard-condition tests, including deliberate attempts to force forbidden transitions, and the trust boundaries of Figure 4 receive negative tests in which the artificial-intelligence channel attempts actuation and the expected result is a block, a log entry, and an operator alert. Fault injection reproduces each hazard H-01 through H-07 of Table 4, and detection latency, containment behavior, and recovery behavior are measured against the controls the hazard analysis assigns.

Human-Autonomy Teaming and the Trust Contract

Operators enter the campaign as participants, not observers, because the architecture assigns them retained authority in every mode and that assignment is testable. Trust is treated as calibrated reliance and is measured rather than assumed: in each teaming session, operators predict how the system will behave under the injected condition before it responds, and the divergence between prediction and observed behavior is recorded per mode and per session. A trust contract is being built when that divergence falls across sessions. The sessions also measure alert comprehension, mode awareness, and the quality of reacceptance decisions with and without the explanation display, so that automation bias and inappropriate distrust, the paired failure modes of Figure 6, are both observable in data (rather than argued about afterwards).

Override Triggers and Authority Assignments

Override triggers are derived from three sources rather than chosen by preference: guard or consistency violations raised by the integrity monitors, severity assignments from the hazard analysis of Table 4, and comprehension gaps discovered during the teaming sessions themselves. Table 10 records the resulting authority assignments for the campaign, distinguishing decisions where the human is on the loop, informed and able to intervene, from decisions where the human is in the loop, and the system may not proceed without explicit confirmation.

Table 10. Authority assignments and override triggers for the proof-of-concept campaign. HOTL denotes human-on-the-loop; HITL denotes human-in-the-loop.

Campaign Phases and Exit Criteria

The campaign proceeds in four phases with explicit exit criteria. Phase 1 is the software-in-the-loop sweep: every state-machine transition and every fault injection is exercised, and the phase exits only with full guard coverage and zero unauthorized-actuation events across the scenario set. Phase 2 is signal-and-timing hardware-in-the-loop: holdover, detection latency, and source-exclusion behavior are measured on the rig against the acceptance criteria of Table 3, with the numeric thresholds set per program as that table requires. Phase 3 is the human-autonomy teaming series described above, exiting when operator prediction accuracy improves across sessions and reacceptance decisions meet the correctness rate defined for the trial. Phase 4 is adversarial evaluation, in which a red team designs spoofing profiles, including slow-drag deception, against the fielded configuration of the rig; the phase exits when no deception is accepted without a flag, and the inherent-risk placements of Figure 7 are revisited with measured rather than judged likelihoods. Reporting in every phase follows the evidence discipline of the reproducibility section, and the campaign output is the package of Appendix A.

Representative Measures of Effectiveness

Bridging architectural intent and testable evidence requires stating what successful outcomes would look like. Table 11 therefore proposes representative measures of effectiveness for the campaign, each paired with illustrative measures of performance and example threshold and objective values. The values are representative rather than prescriptive: mission-specific requirements remain with the eventual system owner, and the acceptance criteria of Table 3 continue to govern per-program thresholds. What the table adds is the form of the evidence the campaign is designed to produce, so that resilience is demonstrated objectively through test and evaluation (rather than asserted as a design aspiration).

Table 11. Representative measures of effectiveness with illustrative measures of performance and example threshold and objective values for the proof-of-concept campaign. Values are illustrative; program-specific requirements are set by the system owner.

These measures also connect the phases to their exit evidence: Phases 1 and 2 exercise the state-machine, timing, and integrity rows; Phase 3 produces the human-autonomy teaming measures; and Phase 4 tests the spoofing, cyber-resilience, and mission-assurance rows under adversarial conditions.

The strongest case for this architecture is not that it defeats a jammer directly but that it reduces the number of mission functions that fail when an external reference becomes unreliable. Trusted internal timing, complementary sensing, bounded artificial-intelligence adaptation, and deterministic authority together emphasize diversity, monitoring, isolation, and recovery rather than dependence on a single mechanism.

Comparison with Representative Recent Work

The three works summarized under Related Technology Evidence and Representative Recent Work are compared here dimension by dimension. Table 12 summarizes the comparison across eleven dimensions drawn from the assurance, governance, and test-and-evaluation concerns of this paper, following the feature-differential style used for cyberworthiness evaluation by Fowler, Joiner, and Ma (2026).

Table 12. Feature-differential comparison of the proposed architecture with three representative recent publications. Entries summarize the stated scope of each publication; absence of a dimension is not a criticism of work that did not aim to address it.

The analysis in Table 12 supports a specific and limited novelty claim. The three comparators are representative anchors of substantially larger literatures rather than an exhaustive survey; the comparison is therefore illustrative of the research lanes, not a census of them. On individual sensing, fusion, and detection technologies, the comparators are more advanced and better validated, and Table 12 records that honestly. The value claimed for this paper is accordingly that of an assurance-oriented synthesis: connecting assurance, governance, cybersecurity, bounded artificial-intelligence authority, human oversight, and maturity assessment in one publicly releasable structure. The claim this paper makes is narrower and different: the contribution is the integration itself. The framework combines assurance, governance, resilience, and bounded autonomy in one systems-engineering structure, with explicit trust boundaries, deterministic limits on artificial-intelligence authority, defined degraded-mode and recovery behavior, safety and cybersecurity governance, retained human authority, technology-maturity discipline, and a specified verification path. Published work supplies mature instances of individual layers; this paper supplies the connective structure that a test-and-evaluation organization can use to ask whether a proposed assured-PNT system is complete.

Integration, Cost, and Maturity Considerations

The main integration challenge is assurance. Each added sensor introduces calibration uncertainty, environmental sensitivity, software complexity, and new cyber interfaces, so more sensors do not automatically mean more resilience. Resilience improves only when source independence is real, failure modes are understood, monitors can isolate bad data, and fallback behavior has been verified under representative conditions.

Cost and complexity temper every resilience argument. Each added sensor, monitor, and control carries acquisition, integration, and sustainment burdens while enlarging the attack surface. The correct program question is not whether a device is impressive but whether its marginal contribution to bounded, observable, recoverable behavior justifies its marginal cost.

A final observation: a systems-engineering treatment should avoid compressing technologies at substantially different maturity levels into a single narrative of imminent capability. It should keep visible the difference between a fielded component, a program-target device, a laboratory result, and a research-stage capability, and attach to each an explicit statement of what has been demonstrated.

No hardware prototype, simulation, field experiment, flight test, maritime test, or operational evaluation was conducted for this paper; the next verification and test-and-evaluation step is specified but has not been performed. No quantitative performance thresholds are asserted, because mission requirements, platform type, outage duration, threat model, and environmental conditions were not supplied; quantitative values in the paper are device specifications or published experimental results attributed to named sources, not projected system performance. The figures are author-generated conceptual diagrams or qualitative engineering judgments based on the cited evidence; they are not measured or model-generated data, and real performance depends on hardware, environment, and integration. The comparison with recent work draws on three representative publications rather than a structured survey; a citation-chained literature analysis is identified as follow-on work to substantiate the synthesis claim across the broader literature.

The architecture omits platform-sensitive implementation detail and therefore cannot support procurement, certification, or deployment decisions. Several artificial-intelligence studies considered in this paper rely on simulated or synthetic environments and may not generalize to adaptive adversaries or mission hardware (Liu et al., 2018; Borhani-Darian et al., 2024; Negru et al., 2024). Atom-based sensors can be limited by vibration, optics, dynamic range, calibration, thermal control, magnetic contamination, and SWaP-C, and the quantum-computing discussion is prospective, with no utility-scale quantum advantage for defense anti-jamming claimed.

This paper does not constitute compliance with any DoD, service, NATO, NASA, NIST, IEEE, or military standard, and public-source analysis cannot account for classified capabilities, classified threat data, or platform-specific vulnerabilities.

Many technologies in the GNSS field have been shown to contribute individually to advancing increasingly autonomous capabilities. Atom-based hardware can strengthen the resilience of defense and aerospace systems against jamming when it is used to reduce dependence on externally received timing, navigation, and radio-frequency information. Atomic clocks can preserve trusted time during outages. Atom-based inertial sensors can reduce long-term navigation drift when hybridized with classical sensors, and the closed-form models of the companion paper make explicit why suppressing low-frequency bias is valuable (Oktenli, 2026: submitted). Magnetic-anomaly and Rydberg sensors can provide independent electromagnetic observations within their operating envelopes. Artificial intelligence can assist detection, fusion, confidence estimation, and bounded adaptation, but it must be governed by deterministic safety constraints, independent monitors, cybersecurity controls, and human oversight. Quantum computing is not presently a demonstrated anti-jamming capability; its credible role is limited to offline optimization, simulation, and design analysis until utility, reliability, latency, and cost advantages are verified against classical systems. However, these technology advances occur against a backdrop of limited system-level synthesis and architecture addressing trusted-autonomy concerns (NIST AI RMF, 2023; U.S. DoD, 2022, 2023).

This paper proposes a layered assured positioning, navigation, and timing (PNT) architecture in which bounded artificial intelligence assists detection, integrity monitoring, and sensor fusion while deterministic controls retain final authority over mission-critical decisions. Using a public-source systems-engineering method, it defines the authority boundary between machine recommendation and human or deterministic decision, specifies the required controls and failure modes for artificial-intelligence-assisted functions, and bounds a risk-constrained adaptation policy (i.e., constrained optimization). It develops the layered architecture, the data, command, and trust-boundary structure, degraded-mode behavior and recovery, and a safety, cybersecurity, and human-systems-integration framework, together with a reproducibility and technology-maturity discipline. The proposed architecture has not been demonstrated. The next required evidence is the laboratory integration, test, and research effort outlined above: explicit requirements, calibrated interference and fault injection, environmental and cyber testing, human-in-the-loop evaluation, and independent validation in a mission-representative environment.

Use of AI. Generative artificial-intelligence tools (Anthropic Claude) were used under the author’s direction between May and July 2026 to assist with drafting and editing prose across all sections, with formatting, and with the preparation of the conceptual figures. The author structured the manuscript, set its technical positions, and verified every technical claim, citation, and reference against primary sources. No artificial-intelligence system generated data, measurements, or test results; the manuscript reports none. The author is solely responsible for the content and conclusions and acknowledges peer-review and editing assistance from the ITEA Journal.

Data availability. No new dataset was generated. Figures 1–6 are author-generated conceptual diagrams. Figures 7 and 8 present qualitative engineering judgments based on the cited evidence and are not measured or model-generated data. No executable model or source code accompanies this conceptual manuscript.

Funding. No external funding was received for this work.

Conflict of interest. The author declares no competing interests.

Author contributions. The author is solely responsible for the conception, analysis, writing, and revision of this work.

Ethics. No human-subject, animal-subject, or personally identifiable research data were used. Any future human-in-the-loop study would require the appropriate institutional determination or review.

Public-release note. This draft uses public sources and omits operationally sensitive implementation details. It has not been independently cleared for public release, export-control compliance, or institutional publication. Public dissemination should follow the author’s applicable institutional and legal clearance process.

Anderson, D. A., Sapiro, R. E., & Raithel, G. (2021). An atomic receiver for AM and FM radio communication. IEEE Transactions on Antennas and Propagation, 69(5), 2455-2462.

Bennett, J. S., Vyhnalek, B. E., Greenall, H., Bridge, E. M., Gotardo, F., Forstner, S., Harris, G. I., Miranda, F. A., & Bowen, W. P. (2021). Precision magnetometers for aerospace applications: A review. Sensors, 21(16), 5568.

Borhani-Darian, P., Li, H., Wu, P., & Closas, P. (2024). Detecting GNSS spoofing using deep learning. EURASIP Journal on Advances in Signal Processing, 2024, 14.

Canciani, A. J., & Raquet, J. F. (2016). Absolute positioning using the Earth’s magnetic anomaly field. NAVIGATION: Journal of the Institute of Navigation, 63(2), 111-126.

Cheiney, P., Fouche, L., Templier, S., Napolitano, F., Battelier, B., Bouyer, P., & Barrett, B. (2018). Navigation-compatible hybrid quantum accelerometer using a Kalman filter. Physical Review Applied, 10(3), 034030.

Defense Advanced Research Projects Agency. (n.d.). Chip-scale atomic clock. DARPA Innovation Timeline. https://www.darpa.mil/about/innovation-timeline
Defense Advanced Research Projects Agency. (2026, March 2). ROCkN enables GPS-free operations [News release].

Fowler, S., Joiner, K., & Ma, S. (2026). Assessing cyberworthiness of complex system capabilities using the Cyber Evaluation and Management Toolkit (CEMT). Computers & Security, 170, 105067.

GPS.gov. (n.d.). Resilience through responsible use of positioning, navigation, and timing (PNT) services. U.S. Government.

Jarraya, I., Al-Batati, A., Kadri, M. B., Abdelkader, M., Ammar, A., Boulila, W., & Koubaa, A. (2025). GNSS-denied unmanned aerial vehicle navigation: Analyzing computational complexity, sensor fusion, and localization methodologies. Satellite Navigation, 6, 9.

Kitching, J. (2018). Chip-scale atomic devices. Applied Physics Reviews, 5(3), 031302. https://doi.org/10.1063/1.5026238

Kitching, J., Knappe, S., & Donley, E. A. (2011). Atomic sensors: A review. IEEE Sensors Journal, 11(9), 1749-1758. https://doi.org/10.1109/JSEN.2011.2157679

Knappe, S., Shah, V., Schwindt, P. D. D., Hollberg, L., Kitching, J., Liew, L.-A., & Moreland, J. (2004). A microfabricated atomic clock. Applied Physics Letters, 85(9), 1460-1462.

Liu, X., Xu, Y., Jia, L., Wu, Q., & Anpalagan, A. (2018). Anti-jamming communications using spectrum waterfall: A deep reinforcement learning approach. IEEE Communications Letters, 22(5), 998-1001.

Microchip Technology Inc. (2026). Quantum SA.45s chip-scale atomic clock (CSAC) datasheet (Document 900-00744).

National Institute of Standards and Technology. (2024, August 13). NIST releases first 3 finalized post-quantum encryption standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA).

Negru, S. A., Geragersian, P., Petrunin, I., & Guo, W. (2024). Resilient multi-sensor UAV navigation with a hybrid federated fusion architecture. Sensors, 24(3), 981.

National Institute of Standards and Technology. (2025). Quantum computing explained.

Oktenli, B. (2026: submitted). Atom-based timing and quantum sensing for jamming-resilient positioning, navigation, and timing: A systems-oriented synthesis. GPS Solutions.

Salducci, C., Bidel, Y., Cadoret, M., Darmon, S., Zahzam, N., Bonnin, A., Schwartz, S., Blanchard, C., & Bresson, A. (2024). Quantum sensing of acceleration and rotation by interfering magnetically launched atoms. Science Advances, 10(44), eadq4498. https://doi.org/10.1126/sciadv.adq4498

Saywell, J. C., Carey, M. S., Light, P. S., Szigeti, S. S., Milne, A. R., Gill, K. S., Goh, M. L., Perunicic, V. S., Wilson, N. M., Macrae, C. D., Rischka, A., Everitt, P. J., Robins, N. P., Anderson, R. P., Hush, M. R., & Biercuk, M. J. (2023). Enhancing the sensitivity of atom-interferometric inertial sensors using robust control. Nature Communications, 14, 7626.

Schwindt, P. D. D., Knappe, S., Shah, V., Hollberg, L., Kitching, J., Liew, L.-A., & Moreland, J. (2004). Chip-scale atomic magnetometer. Applied Physics Letters, 85(26), 6409-6411.

Simons, M. T., Artusio-Glimpse, A. B., Robinson, A. K., Prajapati, N., & Holloway, C. L. (2021). Rydberg atom-based sensors for radio-frequency electric field metrology, sensing, and communications. Measurement: Sensors, 18, 100273.

Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1

Templier, S., Cheiney, P., d’Armagnac de Castanet, Q., Gouraud, B., Porte, H., Napolitano, F., Bouyer, P., Battelier, B., & Barrett, B. (2022). Tracking the vector acceleration with a hybrid quantum accelerometer triad. Science Advances, 8(45), eadd3854.

U.S. Department of Defense. (2015). MIL-STD-461G: Requirements for the control of electromagnetic interference characteristics of subsystems and equipment.

U.S. Department of Defense. (2022, June). Responsible artificial intelligence strategy and implementation pathway.

U.S. Department of Defense. (2023, January 25). DoD Directive 3000.09: Autonomy in weapon systems.

Zhang, C., Ooi, T., Higgins, J. S., Doyle, J. F., von der Wense, L., Beeks, K., Leitner, A., Kazakov, G. A., Li, P., Thirolf, P. G., Schumm, T., & Ye, J. (2024). Frequency ratio of the 229mTh nuclear isomeric transition and the 87Sr atomic clock. Nature, 633, 63-70.

1. Mission profile and system boundary, including platform dynamics, required outage duration, timing-error tolerance, navigation-uncertainty tolerance, and essential functions.
2. Threat model that distinguishes unintentional interference, broadband noise, deceptive PNT, cyber compromise, sensor faults, and environmental disturbances.
3. Interface-control document for clocks, IMUs, atomic sensors, RF monitors, AI services, safety governor, operator display, and logs.
4. Calibrated laboratory dataset with source provenance, environmental conditions, uncertainty, and reproducible preprocessing.
5. Software and model configuration with version control, dependencies, random seeds, training-data lineage, and expected outputs.
6. Hardware-in-the-loop test report covering nominal, degraded, faulted, cyber, power, thermal, vibration, and recovery cases.
7. Human-in-the-loop evaluation of alert comprehension, mode awareness, workload, override, and recovery.
8. Independent validation report stating where the system succeeds, fails, or remains untested in a mission-representative environment.

The following frameworks are relevant to an eventual implementation. They are cited because they apply, not to imply compliance; this paper performs no compliance assessment, and each entry notes how the framework applies and where a gap remains between the proposed concept and the framework’s requirements.

Table B-1. Applicable governance frameworks and the gaps that remain for this concept.

Two additional classes of standard would apply to a specific program but cannot be applied in the abstract. Environmental-qualification standards would govern thermal, shock, and vibration testing once a platform and its environment are defined. System-safety practice would govern hazard analysis, safety cases, and residual-risk acceptance once a safe state and a severity classification are defined by the system owner. Both are named here so that a reader understands the scope of work that separates this analytical concept from a qualified system.

The analysis rests on explicit assumptions. Recording them allows a reader to test the conclusions against a specific application and to identify where the models must be extended.

1. Timing-error accumulation is dominated by offset and drift over the outage durations considered; oscillator noise is treated as a separate stochastic term.
2. Inertial-error growth uses the short-duration free-inertial approximation, ignoring Schuler oscillation and Earth rotation, which is valid only for outages short relative to the Schuler period.
3. Sensor biases are treated as approximately constant over an outage; in practice they vary with temperature, time, and dynamics.
4. The deterministic estimator and governor are assumed correct by construction and independently verified; their assurance is itself a program deliverable.
5. Quantum inertial and Rydberg sensors are treated as optional aids that fail passive and cannot corrupt the baseline.
6. Quantum-computing services are assumed unavailable in the tactical loop; the architecture must operate without them.
7. All cited quantitative values are device specifications or published experimental results, not projected system performance.
8. No classified capability, threat, or vulnerability is represented; the analysis is public-source only.

The interface matrix below records the principal data, status, and command flows among the major functional elements of the architecture. Each row is a source and each column is a destination; the diagonal marks the element itself. The matrix is conceptual and functional; a program would expand it into a formal interface-control document with signals, rates, formats, and timing.

Table D-1. Permitted information and command flows between architectural elements (N-squared matrix).

The matrix makes two properties visible. The artificial-intelligence fusion element sends advisory outputs only to the governor and the operator, never to the sensors, the mission computer, or the actuators. The governor is the sole source of approved commands to the mission computer, and the operator is the sole source of override authority. These constraints are the same authority boundaries expressed in Figure 4 and Figure 5.