Two operators, one drone
Shift change at 0200. The outgoing operator has a quadcopter orbiting a named area of interest. He writes the tail number on the whiteboard, tells his relief the bird is hers, and walks out. She is mid-brief on a separate tasking and hears half of it. Forty minutes later the day-shift ISR cell, which still has the drone on its own board from yesterday, retasks it to sweep a road to the south. Now two people are flying one aircraft. It follows whichever command arrived last. Both plans are broken and neither operator knows it yet.
The people did not fail here. The software did. Every tool in that room could show who was watching the drone. None of them could say who owned it. Ownership lived in a sentence spoken across a desk at two in the morning, and the sentence did not transfer. The other failure mode is quieter and worse. Nobody picks the bird up at all. It orbits on a dying battery while two shifts each assume the other has it. Ask anyone who has run a JOC on whiteboards and group chat. They have seen both.
A flat pile of everything
The root problem is older than the drone. Most mission software dumps everything into one namespace. Tasks, map markers, chat, detections, and camera feeds all pile up in a single shared space that never ends. Open the map after six months and you are looking at markers from operations nobody remembers, tasks assigned to people who rotated out, and feeds nobody is responsible for. A pile has no edges. And without edges there is no such thing as ownership, because ownership is a boundary question. Whose is this, and until when.
EdgeLance draws the edges first. Every task, asset, marker, and record in the system binds to exactly one of three scopes. The organization persists across everything. It holds identity, policy, and whatever the unit has decided is permanent. A workspace is a team's standing room. Rosters, SOPs, standing watchlists, the stuff a team keeps between operations. A mission is bounded in time. It opens, it runs, and it ends in a burn. There is no fourth place for data to live and no unscoped record anywhere in the system.
The boundary that matters most is the one at the bottom. Data born in a mission dies with the mission. If the team wants a detection, a track history, or a lesson to outlive the op, someone promotes it upward to the workspace or the organization on purpose. Promotion is a signed decision with a name attached, recorded in the ledger. The default is death. Survival is the exception you have to choose.
The lease
Inside a mission, scopes solve where things live. Leases solve who holds them. When a drone feed, a camera, or a task passes between operators, the receiving operator acquires a control lease on it. The ledger records the acquisition with identity and time. The lease is exclusive. The moment it transfers, the previous operator's controls go read-only. From the first tasking to the burn, there is never an instant when two people both hold an asset and never an instant when nobody does.
That closes both failure modes from the JOC. The double-tasking case cannot happen because the day-shift cell's retask bounces off someone else's lease, with the current holder's name right there on the denial. The orphan case cannot happen either. If a lease holder drops off the mesh or fails to renew, the lease expires and the asset returns to the mission pool flagged for pickup, visible to everyone as unowned instead of silently assumed to be someone else's problem. The whiteboard sentence becomes a ledger entry, and ledger entries do not depend on who was listening.
Leases are not a drone feature. They cover anything controllable in the mission. A camera feed being actively monitored, a task in execution, a radio net being managed. Handoff is the same everywhere. Acquire, log, release. Shift change stops being a verbal ritual and becomes an auditable sequence you can replay after the fact.
Fifty endpoints of boring
There are more than fifty API endpoints in EdgeLance just for scope management. Granting, promoting, leasing, releasing, expiring, burning. When we counted them, the number looked like overengineering for what amounts to putting labels on data. Then you watch one shift change go wrong on a whiteboard system and the number starts to look small. Handoff is where operations break, and handoff is exactly the machinery those endpoints exist to carry.
The machinery matters because ownership is moving down the chain whether the software is ready or not. West Point's Modern War Institute argues that drone dominance comes from giving squads their own assets and letting them fail with them, rather than routing every aircraft through a centralized cell. More owners means more handoffs. A battalion managing four aircraft through one desk can survive on a whiteboard. Forty squads each owning their own birds cannot. CSIS's study of Ukraine's digital transformation shows the same pressure from the other side. Units adopt the tools that match how they actually fight, and they actually fight distributed.