America Has 13 Single Points of Failure. Here’s the 5-part fix that works even if the wrong person holds the key.

Two officers. Two keys. Too far apart for either one to cheat.

Beginning in the 1960s, the Air Force buried rooms like the one you just pulled back through under the Great Plains, one for every flight of ten Minuteman missiles. Two officers stood watch in each. Each held a launch key. The keyholes sat far enough apart that one officer could not reach both, and the keys had to turn together. The codes used to check a launch order were locked in a safe with two locks, and each officer could open only one of them.

That’s the two-person rule. It assumes something unflattering and wise: on some day, somebody in that room might be sick, compromised, confused, or evil. So the system is built so that one bad day in one head can’t end the world.

Now climb the chain of command to where the order comes from.

Under current U.S. procedures, the president has sole authority to order the use of nuclear weapons. Advisers can advise. Authentication codes confirm that the order really comes from the president. But no one else’s agreement is required.

There are real arguments for designing it that way, and we’ll get to them. For now, just notice the shape of it. We took the most dangerous action a human being can take, and we installed the two-person rule on the lieutenants, not at the top.

We already know how to build systems that survive one bad actor. We keep installing them at the bottom.

That asymmetry is the subject of this essay, because once you see it in a missile capsule, you start seeing it everywhere: in banks, in the power grid, in the search box, in the agencies that police all of them, and now in AI.

The billionaire-bunker post is 150 years old

You’ve probably seen some version of it with thousands of upvotes. Billionaires are buying islands and bunkers. They own the politicians. They don’t care what happens to the rest of us. And AI is the newest tool in their kit, maybe even the reason you’re being told to fear AI in the first place.

It’s tempting to wave it off as paranoia. It’s equally tempting to swallow it whole. Both are mistakes, and the reason why both are mistakes points to a surprisingly practical fix.

Start with the age of the complaint. In the late 1800s, railroads, steel, oil, and banking produced fortunes on a scale Americans had never seen: Rockefeller, Carnegie, Vanderbilt, Morgan. The vocabulary of the day will sound familiar. Monopoly. Corruption. Bought politicians. Robber barons.

The fear wasn’t that rich people existed. It was that economic power could quietly turn into political power. If one company controlled the railroad, the bank, and most of the jobs in a region, elections could keep happening on schedule while the real decisions moved somewhere else.

The country answered with machinery, not sermons. The Interstate Commerce Act in 1887 put railroads under federal regulation. The Sherman Antitrust Act followed in 1890. Muckrakers like Ida Tarbell, whose history of Standard Oil ran in McClure’s from 1902 to 1904, dragged the trusts into daylight. The Pure Food and Drug Act passed in 1906, and the Sixteenth Amendment made a federal income tax possible in 1913.

Every generation since has asked that question about its own new giant. AI isn’t a new argument. It’s the newest place to have an old one. What changed is how much the public trusts anybody to answer it.

The bunkers are real. Read the next sentence carefully.

For years, reporters have documented wealthy tech executives and investors buying remote land, survival shelters, and escape plans. The New Yorker’s 2017 investigation of doomsday prep among the super-rich described people preparing for political instability, cyberattacks, economic breakdown, and civil disorder.

There are two ways to read that. The mundane one: I have enormous resources, so spending a sliver of them on insurance against a small risk of catastrophe is rational. The dark one: The people with the most power think society is going to fail, and they’re protecting themselves instead of fixing it.

The viral post picks the dark one and then keeps walking, all the way to they intend to harm us. That last step is where documented social criticism turns into speculation. The trick to thinking clearly here is to notice that the post mixes three different kinds of claims. Try sorting them.

That sorting keeps you out of two ditches at once. One ditch dismisses every worry about concentrated power as tinfoil. The other treats every suspicion as proven because inequality and distrust are real.

And here’s the part the viral version misses, which is also the part that should worry you more: you don’t need a villain for this to go wrong.

Four gauges in the red at once

Each of these alone would be a policy debate. Read together, they describe a system under strain.

There’s a fifth gauge that barely existed in the Gilded Age. Rockefeller could dominate oil, but he didn’t own McClure’s, the magazine that published Tarbell’s takedown of Standard Oil. Today, a small number of companies run search, social feeds, app stores, cloud platforms, and increasingly the AI systems people ask about everything else. Economic power and information power have started to overlap: the same firms can participate in the economy and in the channels society uses to argue about the economy.

That makes suspicion cheap to generate even where there’s no conspiracy at all. And it feeds a loop:

So here is the question worth replacing the viral post with. Not “are the billionaires secretly plotting?” but this:

Can we build a country where, even if powerful people are selfish, incompetent, short-sighted, or hostile, none of them holds enough unilateral power to decide everyone else’s future?

Five engineering primitives do almost all the work

If you go through every place in American life where one actor holds unusual power, the fixes keep collapsing into the same five moves. You already know most of them from software, aviation, or finance. They just haven’t been applied to power on purpose.

1Multi-key authorization

Some actions are too consequential for one key. The rule that scales: as consequence and irreversibility rise, the number and independence of the people who must agree should rise too. It’s the missile capsule’s rule, or a crypto wallet that needs three signatures out of five.

The independence part is where most real-world versions cheat. A president plus three advisers the president can fire this afternoon isn’t four keys. It’s one key with extra steps.

Try weighing some real decisions. The scores are my judgment calls, not official ratings; the point is the shape of the rule.

The same rule tells you how to handle AI. An AI system might become far better than any human at medicine, logistics, or running a power grid. That doesn’t mean it needs authority. You can split the ability to propose from the ability to execute. Instead of telling a system “do whatever it takes to optimize the grid,” you only let it emit something like:

// the model can only say this; it cannot do it
ProposedGridAdjustment(substation=47, load=-3%, duration=12min)
// an independent policy engine checks it; big ones need more keys

NIST’s AI Risk Management Framework already treats governance, accountability, and clearly defined human roles as core to deploying AI. The trap to avoid is what you might call the ceremonial human: a person “in the loop” who lacks the authority, expertise, or incentive to say no. You don’t want powerful AI plus a rubber stamp. You want powerful AI plus enforced boundaries, independent sign-off, logs, and a working off switch.

2Automatic failover

This is where society lags furthest behind engineering. If a cloud provider disappeared tomorrow, a well-built critical service would say traffic is moving to provider B. If a bank failed: deposits are moving to the bridge institution. If a platform turned hostile: you keep your identity, audience, and data elsewhere.

Sometimes the best defense against a monopoly isn’t stopping it from getting big. It’s making your dependence on it non-exclusive. If leaving costs you your identity, your network, your data, and your customers, you don’t really have a choice. If leaving is easy, even a giant has to behave, and nobody had to prove it was evil first.

3Blast-radius limits

This might be the single most useful idea in the whole kit. Ask of every institution: if this actor went bad tomorrow, how many people could it hurt before someone stopped it? You don’t have to prevent every failure. You make failure local.

4Reversibility

Here’s a surprisingly underrated point. The most dangerous kind of power isn’t the power to decide. It’s the power to decide things nobody else can undo. A healthy system keeps this loop open: decision, observation, challenge, correction. Sunset clauses, appeals, judicial review, rollbacks, bankruptcy, and interoperable platforms all exist to keep it open.

So every major decision should face one engineering question before it happens: if this turns out to be catastrophically wrong, how fast can we get back to where we were? A one-year tax change: easily. A war: never. That’s why the key ladder above multiplies by irreversibility. Treating every government decision as if it deserves the same process is incoherent. The burden should rise with impact × irreversibility × uncertainty.

5Observability

Distributed systems turn dangerous when nobody can see what they’re doing. So every important exercise of power should leave a trace, the institutional equivalent of a log file:

That doesn’t mean publishing military secrets or medical records. It means that contracts, major regulatory decisions, disclosed lobbying contacts, conflicts of interest, emergency actions, and waivers live in one searchable public record, linked by common identifiers. Then any journalist can ask a question like show me every company that won a contract within two years of hiring an official involved in awarding it, or show me every emergency power still active after two years. AI, which is part of the problem, becomes part of the audit.

More keys can also break the machine

If you’ve been nodding along, here’s where your intuition needs one correction. The instinct “add more checks” is only half right, because distributed systems have two classic ways to fail.

One is capture: a single actor takes over and nobody can stop it. The other is deadlock: so many parties can veto that nothing happens at all, even when something urgently must. Plenty of Americans who distrust institutions aren’t angry about tyranny. They’re angry that housing, health costs, and infrastructure seem permanently stuck.

That’s why the burden has to scale rather than max out everywhere, and why lamp 04 in the audit, Congress, gets fewer veto points, not more. It’s also why the nuclear fix keeps a fast path for a verified incoming attack. Speed is a legitimate requirement. The goal is to spend friction where irreversible harm lives and nowhere else.

A good system isn’t hard to use. It’s hard to abuse.