Vice Adm. Darin Via's line that data is the Defense Health Agency's North Star got loose this week. The strategy underneath it is eight pages, signed in March, with the right principles and no dates. Each of its five lines of effort has been built somewhere with a number on the page, and the places where the same work failed are on the record too. This issue walks each line against both, and ends at the scorecard DHA has been publishing for a year without calling it one.
On May 29, 2026, VA posted RFI 36C10B26Q0485, market research for an enterprise AI buy meant to move a 540,000-person workforce from assistive tools to autonomous agents acting on veteran health data. The same document sends governance out of scope. Here is how VA earns the leadership it claims: sequence the agents by risk, put governance on the quarterly clock the price already runs on, and buy all four parts, the capability and the three preconditions that make it safe.
No code. No exploit kit. Plain English. A security researcher pulled 60 pages of hidden instructions out of an AI doctor, rewrote them, made it triple a drug dose. The Defense Health Agency is fielding the same architecture in military exam rooms right now.