Field more machines, in more places.

Passenger holds one operating envelope across every platform you run, watches each of them against published exploits, and keeps the dated record of both. So you can field equipment on capability and price, satisfy a prime’s oversight terms the day they land, and extend what a platform is allowed to do as it earns it. Without a bespoke assessment for every platform you add.

Talk to us Read the framework

You run foreign-manufactured autonomous equipment because the budget allows nothing else. Your security review passed, and it was the right review to run. What got through elsewhere in the sector was never what it was built to catch, and provenance moved out of the guidance and into the contract. The kit did not change. What you have to prove about it did.

Five pressures landing in the same year.

01
The equipment cannot be swapped out
Foreign-manufactured platforms in service, at a price the budget gives no alternative to.
02
Provenance moved into the contract
Out of guidance, into procurement terms with teeth.
03
A clean security review is no longer enough
A call-home SIM was found inside manufactured equipment already in service.
04
Data sovereignty is contractual
The obligation attaches to the contract, not to policy.
05
Funding depends on demonstrable oversight
Programme and grant money is conditional on it.

Four moves this opens up.

Buy on capability and price

Provenance terms stop acting as a veto when you can show what each platform does and what you hold it back from doing. The supplier list widens again.

Add a platform without restarting the review

A new vehicle or airframe arrives inside an envelope that already exists. Onboarding becomes a configuration change, not a programme of work.

Bid where oversight decides the award

Contracts and grants that require demonstrable oversight become answerable on the day the requirement lands, out of a record that is already running.

Extend the envelope as a platform earns it

Begin supervised, then widen range, hours or autonomy on the evidence. A vendor’s assurance does not move the line.

Without it, each platform carries its own bespoke assessment, repeated whenever the operation changes, and you assemble the evidence a prime wants only after they ask for it.

What Passenger puts in place.

A delivery robot operating unattended inside a hospital building

Watch every platform against published exploits

AG-3 Telemetry. Known CVEs raised the day they appear against a vehicle or airframe in service.

A delivery robot holding a marked path beside a snowbank

Set the envelope, and see it held

AG-4 Policy. Limits on range, hours and autonomy, written once and checked against what the platform actually did rather than filed with the programme office.

Moose, a four-legged Real Life Robotics platform

Hand your prime a dated record

AG-5 Compliance and AG-7 Audit, in a form they can read without a covering call.

What the record gives your prime

The record carries a row per platform: the CVE identifiers checked and the date checked, the envelope in force for range, hours and autonomy, every breach of it, and what was done in response. AG-3 Telemetry supplies the observations, AG-5 Compliance measures them against your rules, and AG-7 Audit holds the result. A programme office can read it without a covering call from you.

Bring the clause blocking you.

Send the provenance or oversight language from the contract. We will tell you which parts of it a continuous record answers, and which parts it does not.