Concept
Scene restrictions
At an active emergency scene, driving automation may not continue unsupervised. A signed, time- and place-bounded restriction tells cars so, a two-way sign checks each car is complying, and officers are warned about the ones that are not.
Why: I-80, Fairfield, 13 October 2026
Just before midnight, four lanes of eastbound I-80 west of Air Base Parkway had been closed for about an hour after a fatal crash, marked with flares and cones. A car at freeway speed drove through the closure and struck a CHP patrol car with two officers inside. The driver told investigators he was asleep with Tesla FSD (Supervised) engaged; as of 16 October that claim was unconfirmed.
The gap. The C=US kill switch stops agents that ask C=US before acting; a car’s driving software asks no one. California’s AB 1777 lets officials geofence driverless vehicles out of an area within two minutes, but as far as we know it does not reach Level 2 driver assistance.
How it works
Four steps, in order. The first is the only one a person does at the scene.
- 1Officer
Restrict
One tap in the patrol car, confirmed with a passkey. The agency key signs a restriction: this stretch, this direction, until it expires.
- 2Two-way sign
Announce and ask
An arrow board about a mile upstream broadcasts the signed restriction and challenges every approaching car to answer.
- 3Vehicle
Respond and comply
The car reports its automation and driver state, then continues only with an attentive driver. Otherwise it stops on the shoulder before the scene.
- 4Sign to officers
Alert
Cars that do not answer and are coming fast, or answer that no attentive driver is confirmed, raise an alert in the patrol car.
What would happen?
Pick a case, or set the conditions yourself. The panel shows what the sign concludes, what the car does, and whether the officers are warned.
Sign sees
–Car does
Officers
–Outcome
Illustrative logic only. Timings assume a sign 1.6 km upstream and a car at 65 mph.
How it fits C=US
A restriction is the mirror image of a grant. It uses the same directory, the same signatures and the same evidence log, but it can only take authority away.
| Authorization grant | Scene restriction | |
|---|---|---|
| Direction | Gives a scope | Withdraws scopes; can never grant |
| Applies to | One agent | Every vehicle in the area and direction |
| Bounds | Start and end dates | Start, automatic expiry, area, direction |
| Issued by | Accountable sponsor or endorser | An officer of an agency listed under its state, e.g. st=California,c=US |
| Proof | mTLS certificate and directory entry | Agency signature checked against the state’s trusted issuers |
| Device | Raman device, registered | Two-way roadside sign, registered with its own certificate |
dn: cn=i80-eb-fairfield-20261014T0605Z,ou=Scene-Restrictions,
o=Example State Patrol,st=California,c=US
objectClass: cequsSceneRestriction
cequsRestrictedScope: vehicle.drive.automated.unsupervised
cequsRestrictionEffect: require-supervision
cequsRestrictionDirection: eastbound
cequsApproachDistance: 3000
cequsRestrictionStart: 20261014060500Z
cequsRestrictionEnd: 20261014120500Z
cequsSignedRestriction: <agency signature>
dn: cn=arrow-board-07,ou=Roadside-Units,o=Example State Patrol,st=California,c=US
objectClass: cequsRoadsideUnit
cequsRoadsideUnitIdentifier: wimse://patrol.example.org/roadside/arrow-board-07
cequsAlertRecipient: cn=patrol-unit-12,ou=Officers,o=Example State Patrol,...
cequsAlertLeadTime: 55
Synthetic agency and entries. Draft schema in the project repository under schema/restriction/; not loaded on any directory. See also schemas, the kill switch and stop my agent.
Where the information lives
The state’s own branch of the directory, for example st=California,c=US, already holds everything the scene needs for cars registered in that state: the agency and its officers, its roadside signs, the restriction itself, and each registered vehicle’s entry with its automation capability and the issuer of its credential. The gap is cars registered somewhere else.
| Car | How the sign checks its answer | Gap |
|---|---|---|
| Registered in this state | Against the state’s own trusted issuers, carried on the sign | None |
| Registered in another state | Against the home state’s issuers, reached through c=US by chaining or referral (e.g. st=Nevada,c=US); signs keep a cached copy of every participating state’s list | Only if the home state has not joined |
| Registered abroad | Chained to that country’s directory, as in the project’s c=CA referral for Quebec | Needs a cross-border agreement |
| Not registered, or no radio | Cannot answer | Treated as silent; the radar alert still works |
The sign never looks anyone up during the approach; there is no time. It verifies signatures against issuer lists it already holds. Identity also stays in the home state: that state’s directory knows who is accountable for a vehicle, but the sign sees only a pseudonymous answer. Linking an answer to an owner happens afterwards, in the home state, through legal process.
Safeguards and limits
Safeguards
- Only takes authority away. A forged restriction can at worst make cars more cautious.
- Restricts a place, never a person or a specific car, and never orders an unsafe stop.
- Expires on its own; each agency’s longest window is set in the directory.
- The car answers, not the driver. Its own driver camera vouches for attention; a habitual “OK” tap does not count.
- Answers use short-lived pseudonymous certificates: a legitimate vehicle, not whose. No plate, VIN or name, and logs are discarded unless there is an incident.
- The sign issues no tickets.
Limits
- It does not fix perception. Flares, cones and a stopped patrol car should be enough on their own.
- Lead time is physics: under a minute at freeway speed from a sign a mile out.
- Radar will raise some false alerts in heavy traffic.
- The first car to a scene may arrive before any sign is placed.
- Manufacturers would honour restrictions for Level 2 only under a mandate, a step beyond AB 1777.
- Nothing here has been tested with a vehicle, an agency or a live directory.
Sources
- Electrek, Tesla on FSD crashes into CHP patrol car, driver says he was asleep, 16 October 2026; KTVU video report.
- California DMV, New autonomous vehicle regulations; AB 1777.
- SAE J2735 V2X message set; IEEE 1609.2 vehicular security services; USDOT WZDx.
The ideas of a “no FSD” safety zone and a two-way sign that requires a response are Peter Bachman’s. This page, the draft schema and the scenario logic were drafted by Claude (Claude Opus 5.5) at his request on 18 October 2026, from the sources above, while the crash facts were still developing. No endorsement by any agency or manufacturer is implied.