The pipeline that decides.

The doctrinal lesson hidden inside Lavender and Habsora, the most reported AI deployment of the decade. When the recommendation arrives in 20 seconds and the human reviewer has 60, the human-in-the-loop is governance theatre.

Prologue. The most reported AI deployment of the decade.

Two systems entered Western public discourse in 2024 and have not left it. Lavender, an Israeli Defense Forces tool reportedly used to identify suspected Hamas and Palestinian Islamic Jihad operatives at population scale, and Habsora (translated as The Gospel), a parallel system used to recommend buildings and structural targets. Both were first described in detail by the Israeli outlets +972 Magazine and Local Call in April 2024, drawing on six current and former IDF intelligence officers.¹

The reporting is contested in important specifics. The IDF rejects the framing that an algorithm has displaced human judgement. The journalists' sources hold that, in the operational tempo of the autumn 2023 campaign, the human review collapsed into a near-rubber-stamp at the cyclic rate the systems generated recommendations. RUSI's commentary published shortly after applies a sober eye to the capability claims and a sceptical one to the operational claims, and concludes that both points are partially true.²

This study is not a verdict on Gaza. The reporting on what specifically happened, and what specifically did not, is contested in court and in journalism, and will remain so. The study is a verdict on a doctrinal point that the Lavender/Habsora discourse has surfaced and which will shape every armed force buying targeting AI in this decade. The point is the following.

The thesis.

Speed is doctrine. When the system recommends a strike in seconds and the human review cycle is structurally longer, the review collapses into pattern-matching against the recommendation rather than independent judgement. The constraint that a human must approve remains formally satisfied. The constraint's purpose, which was to insert a deliberative pause into the kill chain, ceases to be satisfied.

This is not a problem you can solve with better training, more screens, or a longer mandatory review window applied politically. It is a problem of system architecture: the recommendation arrives faster than it can be independently verified, and the work cannot be done in the time available regardless of who is in the seat.

The Lavender and Habsora reporting, and the Israel Defense Forces' partial pushback on it, has done the world a service. Between them they have made the architectural problem legible in a way that two decades of academic discussion of autonomous weapons never quite managed.

What the systems actually do.

The IDF acknowledges Habsora exists, and characterises it as a recommendation engine for structural targets that ingests intelligence inputs and produces ranked candidate strikes. According to +972, Habsora's throughput is what made it doctrinally significant. Where the pre-AI Targeting Directorate produced approximately 50 vetted structural targets per year as a baseline, Habsora's reported pace was on the order of 100 candidates per day during the autumn 2023 campaign, an increase of two orders of magnitude on the daily basis.¹

Lavender, the personnel system, occupies a different category. Its reported task is to estimate, for the population of the Gaza Strip, the probability that a given individual is a member of Hamas or Palestinian Islamic Jihad. The reporting describes a list of approximately 37 000 individuals identified by Lavender at the system's peak operational tempo, with a stated precision of around 90 percent on a held-out test set. Both numbers require careful unpacking, which is the next section's job.¹⁵

The 90-percent number and what it does not mean.

Ninety percent precision is, in machine-learning terms, a respectable score on most binary classification tasks. Applied to an unknown entity in a population, it is also, by construction, a number that produces approximately one false positive for every nine true positives. When the population evaluated is on the order of tens of thousands, the absolute count of false positives runs into the low thousands. The arithmetic is unforgiving and the arithmetic is what matters.

The IDF's pushback on the +972 reporting includes the assertion that Lavender outputs were not converted into strike decisions without further human review and corroboration from independent sources. The reporting's counter-assertion is that, under operational time pressure, the corroboration step degenerated into pattern-matching against whatever low-bar evidence supported the recommendation. RUSI's analysis observes that both can be true simultaneously: the formal procedure is intact, the procedure's epistemic content is hollowed out, and no audit of the formal procedure will surface this.²

The doctrinal lesson is independent of which side of the operational dispute one favours. Any system whose throughput exceeds the rate at which independent corroboration can be performed, by definition, produces outputs that cannot be corroborated independently. Whether the operator notices is a question of culture and the institutional incentives applied to the seat. The system architecture has already determined the answer.

Time-to-strike. The velocity problem.

Habsora reportedly produces ranked candidates within seconds of intelligence ingestion. The +972 reporting describes review windows of approximately 20 seconds per personnel target during high-tempo operations. The official IDF position emphasises that strikes still require formal authorisation by a unit commander and that the approval is not algorithmic. The two characterisations are not in direct contradiction; they describe different layers of the same chain.³

Twenty seconds is enough to read three sentences. It is not enough to challenge a model's confidence interval, to cross-reference an independent source, to verify the absence of a pattern of life inconsistent with the classification. A human-in-the-loop with a 20-second review window is, operationally, a reaction key: green to confirm, red to abort. The seat exists. The deliberation it was supposed to host does not.

Where the institutional fiction lives.

The question is no longer is there a human in the loop. The question is what the human is empirically allowed to do inside the loop. The decision pyramid below sketches what reportedly happens to a candidate target on its way through the chain.

The dense band at the top is bureaucratically robust. The thin band at the bottom is the band that makes the human review a control instead of a witness. When that band shrinks toward zero, the system has converged on de-facto algorithmic targeting whether or not anyone has called it that.

What this exports.

The Lavender and Habsora design pattern is replicable. The classification model itself is unremarkable: a feature-engineered classifier built on signals intelligence and pattern-of-life data, trained on a labelled set, evaluated against a held-out validation. The operational workflow that wraps it, the geolocation tie-in, the strike authorisation pipeline, are all conventional military C2 plumbing. There is no exotic new mathematics on display here. There is a workflow.

That workflow will be adopted. Several armed forces have observable interest in similar architectures. The 2025 RAND analysis on AI wonder weapons in cyberspace concludes that the hype cycle around algorithmic targeting overstates the technical novelty and understates the institutional novelty. The institutional novelty is that the throughput-precision-velocity triangle now favours machines on every leg, and the work of governing that has not started in earnest in any Western jurisdiction.⁴

The International Court of Justice Palestine submission of August 2025 catalogues the international humanitarian law concerns that AI-assisted targeting raises under existing law. Proportionality is one such principle; the obligation of distinction between combatants and protected persons is another, alongside the standing requirement of precaution in attack. The submission is careful not to rule the technology categorically unlawful; the law concerns conduct of hostilities, not the means by which targets are recommended. Conduct, the submission argues, has to demonstrably satisfy IHL irrespective of how the recommendations were generated. That bar is the right one to apply, and as the throughput-velocity problem above suggests, it is also the bar the system architecture makes hardest to satisfy.⁷

The libertarian read.

It is tempting to read this as an indictment of AI in war. The temptation should be resisted; the analysis it produces is bad. The same throughput-velocity problem applies, with different magnitudes, to every prior generation of military automation. Cruise missile guidance closed the kill chain at a speed faster than human re-evaluation in 1991. Automated air defence systems make engage/no-engage decisions on a ten-second cycle. The architectural question, which is who controls the system and on what terms, has been with us for a generation.

The libertarian read is the architectural one. Constraint on state violence is a function of system design, not of political pressure applied to the system after the fact. The constraint that worked for the Cold War's nuclear command-and-control was a hard-engineered slowdown: dual keys, geographic separation, paper protocols. The constraint had no political content; it had time and material in it. That is the model that needs to be ported into AI-assisted targeting. Slowdowns that are physical, not procedural. Authorisations that require something the system cannot fabricate, not signatures that the system can pre-fill.

State capacity to slow itself down is a small set of countries' actual capability. The countries that have it are also the countries with the best chance of writing the doctrine for the rest. There is a small irony in noting that the same governments most active in deploying targeting AI are also the ones most likely to discover, in their own time, that the kill-chain needs a hard slowdown. Whether they will discover that cost soon enough is a separate question.

What it means for builders.

If you are building software at the boundary where machine recommendation meets human decision, the doctrinal lessons of the Lavender/Habsora discourse are the following.

Time is the first constraint. If the system recommends faster than independent review can be performed, you have shipped a rubber stamp regardless of the procedural wrapper. Architect time into the workflow, or expect the workflow to architect time out of itself.

Auditability is not the same as accountability. An audit trail that records that a human pressed approve is a logging facility, not a control. Accountability requires that the human had the means to do otherwise, and that the system can produce evidence on demand of cases in which the human did otherwise.

Hard slowdowns beat soft ones. Cooling-off periods imposed by policy will be eroded under operational pressure. Cooling-off periods imposed by physics or by separation of duty will not. Where the stakes warrant, build the constraint into materials that are not editable by the operator.

Throughput is a control variable. The most consequential governance decision in any AI-assisted decision system is the rate at which it is allowed to recommend. Optimising for throughput is, in effect, opting out of meaningful human review. Throughput should be set by what can be reviewed, not by what can be generated.

Distinguish recommendation from authorisation. A recommendation is an opinion. An authorisation is a binding commitment of force. They live in different parts of any well-architected system. Conflating them is the structural failure mode the Lavender/Habsora discourse has documented.

Closer.

The most reported AI deployment of the decade has been useful precisely because it has been reported. The discourse has surfaced architectural problems that academic discussion of autonomous weapons kept abstract. Whoever writes the next generation of doctrine on AI-assisted decision systems, in war or out of it, will be writing against a backdrop in which the throughput-velocity problem is no longer a hypothetical. That is the work to be done. The Chronicle's purpose is to do some of it before the urgency forces shortcuts.

Tobias Hager

Founder · CEO · Sole engineer · mi media intelligence SL

Tobias designs and operates every system inside the house. He builds AI-native products and the offensive/defensive cyber capability stack the company runs alongside its research thread toward agentic generative reasoning. He writes the Chronicle from inside the operational stack rather than from outside of it.

tobias-hager.com LinkedIn contact@mi.network

mi media intelligence SL · Palma de Mallorca · April 2026 · SIGIL CHR-0002