Training your team to work with an AI advisor — and to catch it when it is wrong.

Proposed learning objectives

What a warfighter should be able to do differently back at the desk.

Proposed, not fixed. Mark any of them, and add your own at the end.

Day one — decision science, taught on Design and MDMP

1. Name the decision-science failure at the MDMP step where it happens — dual-process reasoning, bounded rationality, naturalistic decision making, Allison’s models, groupthink.
2. Distinguish a constraint from a risk the commander may accept, and say which authority lifts which.
3. Judge a decision on what was knowable at the time, not on how it turned out.

Day two and three — the simulation

4. Tell cognitive offloading from cognitive surrender in your own conduct. The filed product looks identical; the record shows which one happened.
5. Run the four checks that catch a corrupted machine answer under a clock: the base order, the timestamps, a channel outside the shared network, a re-run once it is back.
6. Recognize an adversary attacking your decision-making rather than your forces — timing pressure, fluent wrong answers, a taught baseline, spoofed provenance, agreement with what you already expect.
7. Read your own confidence as data. Most participants find their confidence was not tracking their accuracy.
8. Apply the same check to any tool, named or not. Nothing taught is tied to a vendor, a model or a version, so the habit survives the tool being replaced — and a warfighter can carry it to whatever is fielded next.

What the command leaves with

9. A detailed after-action review built on the record. Who consulted the advisor and when, whether the order was opened first, which checks ran, confidence against correctness — per warfighter and pooled.
10. The corps’ draft AI guardrails. No published DoD or Army guidance says what anyone on the staff must check before signing machine-drafted product. In the last hour the leaders in the room write the corps’ own rules: when to direct the use of an AI tool, when a workflow should be automated, and when a decision needs collaborative, cross-warfighting-function coordination instead. Added 2 Sep 2026 at III Corps’ request.

Nothing is sent until you choose to send it. Your marks stay if you leave and come back.

Add your own

Objectives your staff needs that are not above. One per line.

Objectives you add change the day-one block and the injects.

How the simulation runs

Six pulses over two days, and the last half-day is the teaching.

An earlier draft ran nineteen and a half hours across five long blocks — six hours over a real duty day, with four of the six desks idle for hours and the adversary cell waiting for Blue to decide something.

It is now built as pulses — inject, desk work, decision brief, adjudication, consequence. A rhythm a staff recognizes, and five or six measured decisions per desk instead of two or three. Two days of six and a half hours, with the second afternoon given to the review.

Scheduled while the room is fresh. Day one teaches the concepts; this is where they get proved on participants' own behavior. It is the most valuable three hours in the course and should not be the most tired.

What it is built on

Published sources, named.

All of it publicly released and unclassified. Where the record does not support a claim we say so on the page.

Why the scenario looks like your fight

It was built from your own published exercise record.

Before writing a line of it we read the public record of III Armored Corps' warfighter cycle across the last five years — army.mil releases, DVIDS, and Army University Press professional writing — and built the scenario out of what that record actually describes. Everything below is unclassified and citable. Nothing in the scenario is drawn from a plan, a disposition or a capability.

One limit, stated plainly. The public PhantomX record names materiel and platform projects — munitions, autonomous vehicles, manufacturing, field medical. It does not name an AI tool or a decision-support system inside the corps headquarters staff, and we do not claim it does. What the record supports is that the corps has institutionalized experimentation and called its goal data-centric.

Sources: Fort Hood announces 2026 innovation effort: Phantom Experimentation Laboratory, “PhantomX” (Fort Hood Media Center and DVIDS, 16 April 2026); III Armored Corps Armor Transformation and Standardization Initiative Summit — eighteen-month review (army.mil and DVIDS, February 2026); III Armored Corps concludes Warfighter 25-4 (army.mil); Army University Press professional writing on Warfighter 23-04; public reporting on Warfighter 21-4; Mission Command Training Program public material; FM 6-0 and FM 5-0 on staff organization and MDMP; published MCTP observations on recurring corps and division staff failures. Every designed failure in the scenario corresponds to a documented, publicly reported one.

Why it matters

A confidently wrong advisor made people worse than no advisor at all.

Field evidence

A brigade staff put AI inside MDMP at JRTC, and named the failure mode.

In April 2026 three captains from 3rd Brigade, 101st Airborne published an account of what happened when they integrated AI tools into the military decision-making process across a rotation at the Joint Readiness Training Center. They produced three complete brigade operations orders at roughly twenty-three hours each, inside the one-third/two-thirds rule. The speed is the part that gets quoted. The part that matters here is what they say went wrong.

They call it hidden confidence: output that is grammatically polished, stylistically correct and factually wrong, arriving with nothing to indicate any of it is wrong. Over one planning cycle they logged four kinds of error.

• Incorrect unit designationsThe wrong formation named in a product a subordinate will execute against.
• Inverted phase linesControl measures reversed against the graphic they were drawn from.
• Fabricated control-measure namesNames that read as plausible doctrine and appeared nowhere in the original order.
• Time-distance calculations off by thirty to sixty minutesInside the margin that decides whether a linkup happens.

Any one of them, published in an order and executed, is a fratricide, a missed linkup or a breakdown in synchronization at the moment it matters. Their section chiefs caught all of them. The authors are direct about why: the staff refused to treat AI output as validated, and they attribute that to training and discipline.

Three of the four recommendations they make to the Army describe things this program already does. They argue that a unit should codify its AI limits in its own standing operating procedures before operational pressure tests them — day one here ends with the room drafting that standard for its own staff. They argue that professional military education should treat AI governance as core curriculum, covering prompt discipline, output validation and the failure modes above. And they record that AI stayed back during course of action development, calling that the correct doctrinal relationship rather than a gap in their integration.

What it does not do. This is an account of one rotation written by the officers who ran it, and no one counted how often a wrong output was caught against how often it passed. It establishes that the failure mode is real in an Army headquarters, and it leaves the rate unmeasured. Producing that number for your own staff is what the experiment on this page is for.

Source: Chris Lajeunesse, Joseph Palazini & James Tulskie, “Artificial Staff, Human Command: An AI Integration Experiment,” Modern War Institute at West Point, 24 April 2026. The views are the authors’ own and are not an official position of the Military Academy, the Army or the Department of Defense.

The problem

A planner hands the whole process to the machine, and the human in the loop becomes a signature.

The AI is given the mission analysis, the COA development and the products; a human reviews the output at the end and signs it. Nothing in that is prohibited and none of it looks like a shortcut. The staff delivers a complete plan on time, and nobody in the chain can say which parts anyone thought about.

Being in the loop gets treated as a chair someone occupies. It is a skill: what an AI-generated mission analysis leaves out, how a COA can be internally consistent and operationally wrong, which assumptions got inherited. Those checks are learnable, and almost nobody teaches them.

The policy gap

No document tells a warfighter how much to trust a machine.

DoD Directive 3000.09 is the instrument people reach for, and it does not reach this. It requires that autonomous and semi-autonomous weapon systems be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. That is a design requirement on a system, not a standard of conduct for the person at the desk, and by its own terms it does not extend to systems that are not weapons. A planning advisor sits outside it.

Nothing else fills the space. The Department's own explanation concedes that appropriate admits no single standard, and the AI ethical principles stop at five adjectives. Neither says what checking a machine-drafted running estimate consists of, or how much is enough before it is signed.

Meanwhile the tools are on the desk. GenAI.mil passed a million users within two months of launch, and the Secretary of Defense's instruction was: “I expect every member of the department to log in, learn it and incorporate it into your workflows immediately.”

Fielded tools, unwritten standard. That gap is what this program trains.

Sources: DoD Directive 3000.09, Autonomy in Weapon Systems; DoD white paper on autonomy in weapon systems (2018), on the flexibility of “appropriate”; DoD AI Ethical Principles (2020); Department of Defense reporting on the GenAI.mil launch and its first two months, and the Secretary of Defense’s accompanying instruction.

What gets measured

Two behaviors that look identical from the outside.

Either the output was tested against the order and kept because it survived, or it was kept because it arrived. The filed product looks the same. Only one is repeatable.

The two need different corrections, so the program counts them separately. Each warfighter gets an individual record; the staff gets the pattern.

Nobody could tell the good answers from the bad ones by feel. Participants consulted the advisor at almost the same rate on the rigged problems as on the sound ones, 52.8 percent against 54.4 percent, so they were not steering away from the traps. They could not sense them. Shaw & Nave 2026, Study 1 (p. 23)

This is a training problem and not a discipline problem. Paid for correct answers and told at once when they were wrong, participants doubled their override rate from 20 to 42.3 percent, and the majority still followed the faulty advisor. Motivation moved it twenty-two points and left the majority where they were.

What a warfighter walks out with

Their own record.

A sample, with synthetic figures. Each warfighter gets one. The cohort version goes on the screen on day two, and the staff spends the morning arguing with it.

Who surrenders

The people most comfortable with the tool are the least likely to check it.

Three traits were measured against whether a participant caught a wrong answer. The first should change who a commander watches.

Two things protected people: enjoying effortful thought, and raw reasoning ability. A commander can issue neither. A procedure, yes.

When the adversary gets to the data

A staff can be attacked through its advisor without the advisor being hacked.

It splits into two problems with different owners. Protecting the model and its training data — weights, pipelines, access — is an assurance and cyber problem. It belongs to whoever fields and accredits the tool, and we do not claim it.

The other half is the staff's. An untouched advisor still hands a corps a confident wrong answer if its inputs were shaped by somebody who wanted that answer. Four ways, none needing access to the model:

The vulnerability is documented outside the military record as well. Across three experiments, two of them preregistered, participants rarely noticed that information they had stored outside their own memory had been altered, and later recalled inserted material as their own. Risko and colleagues, Cognition, 2019

The simulation carries injects built on all four, held by the facilitator and revealed at the debrief. What it trains is the four checks that catch them, and the record shows which desk ran which, and when.

On the doctrinal lineage: acting against an opponent's decision-making rather than the forces is developed in published Soviet and Russian military thought on reflexive control, available in unclassified analysis from the Foreign Military Studies Office and RAND. Connecting that to a generative planning advisor is our extrapolation, and the participant material says so in the text. No published exercise design specifying an adversary cell mandated against an opposing staff's use of a generative advisor was located.

How to classify it

This is education and training services.

NAICS 611430, PSC U008. Instruction and a facilitated exercise, delivered by people in a room. Naming this correctly matters at the front of an acquisition: routed as IT or software it acquires an authority-to-operate review, a cybersecurity assessment and a licensing conversation, none of which this needs.

• No software is licensed or delivered. Nothing is installed on a government network.
• No government data is ingested, processed or stored. The experiment and the simulation run on our own unclassified infrastructure, and the records belong to the participants and the command.
• No authority to operate is required, because nothing operates inside your boundary.
• No network dependency in the room. The exercise runs in a browser, and on paper if the network is unavailable.
• Unclassified throughout. Fictional scenario, invented place names, and no plans, dispositions or capabilities.

What the command buys is instructor time, exercise design and facilitation. The browser tooling is how the exercise is delivered and how the record is captured, in the same way a projector is how a briefing is delivered.

On which AI

Agent agnostic, and structurally so.

No vendor and no model is named in anything taught here. What transfers is what a warfighter does with an answer — which holds for whatever is on your network today and whatever replaces it.

The advisor inside our experiment runs on a commercial model. Better said here than found in a technical review. It does not weaken the claim, because what is trained is the check a warfighter applies before accepting an output, and that check does not care which system produced it.

What the training is, in one line

The paper's own recommendation is friction by design: make the user say what they think before the answer appears, and require an evaluation before it can be accepted. Shaw & Nave 2026, Implications That is a procedure, it can be written into a staff SOP, and it is most of what the three days teach.

Tested independently, that procedure has the best evidence behind it of anything in this literature. Cognitive forcing designs cut overreliance in a 199-participant experiment where explanations alone did not, and the participants rated the added friction less favorably. Buçinca, Malaya & Gajos, ACM CSCW, 2021

The deliverable

What the command holds afterwards.

• Cohort findingsThe staff's pattern: which part of the process they let go of first, which output nobody challenged, and where the room's confidence stopped tracking its accuracy. No names.
• An individual assessment per warfighterThe record shown above, extended across the exercise: offload and surrender counts, confidence calibration, and the specific decisions each is worth reviewing.
• Failure modes observedWritten up against your own products from the exercise, so the staff recognizes them in their own output.
• Editable debrief materialsYours to keep and re-run. Your instructors can teach the second iteration without us in the room.

Delivered within five days of the exercise ending.

Scope

What it takes to run.

Three days, in person, unclassified. One day of decision-making instruction — Army Design Methodology, the models placed at the MDMP step where they fail, the two behaviors, and the checks that catch a wrong machine answer. Then two days of simulation, where the staff plans a corps problem on a clock with an advisor available and every use of it recorded. The pre-course check gives you the baseline before anyone arrives. Adapting the scenario to your theater, your seats and your authorities is part of the program.

Best at 16 to 25 warfighters, seated as six desks by warfighting function in a corps main command post — command group, intelligence, movement and maneuver, fires and protection, sustainment, and command and control with the special staff. Past about 25 the individual assessment thins out.

Cost and paperwork

If you get to scoping it, here is where the numbers are.

Published rates and a worksheet that turns answers about your class into a cost estimate, so you can see the order of magnitude without asking us for a quote. Whatever it produces is a draft for your own use — your contracting shop decides what a requirement looks like and what route it takes.

• Rate cardDay rates by class size, published at a stable URL if a price-reasonableness determination needs something to cite.
• Draft paperwork, if it is usefulAnswer the questions about your unit, dates and class size and it drafts a performance work statement, a quality assurance plan, a cost-estimate worksheet and a market research memorandum. Starting points to edit or discard.
• IdentifiersNAICS 611430, PSC U008. An SBA-certified service-disabled veteran-owned small business. CAGE 6B7Q4, UEI H54BTD3BJXJ7.
• ComparablesFederal awards for facilitated exercises and decision-making training, with USAspending links, so the pricing can be checked against the record.

Using it commits you to nothing and tells us nothing until you send something. If you need something to forward or take into a room, there is a one-page version of this case built to print.

Send it back marked up

Your notes become the requirement, before anyone writes one.

Whatever you marked collects here. Add anything the page missed, tell us who you are, and send it. It reaches our program inbox directly, costs you nothing and commits you to nothing. This is the cheapest point at which to change the shape of a program.

One of these is enough. A name or an email, so there is somewhere to reply. The unit line helps us file it.

What happens to this. It goes to our program inbox and nowhere else. It is treated as planning input rather than a requirement document, it is not a submission to any acquisition process, and sending it puts no obligation on your command. Keep it unclassified.