[the8472]

a big red emergency switch telling it to pull over and shut down may be useful.

Anything more than that would mean your system is not fully autonomous, because the driver would have to pay attention all the time. What good is manual override if there's nobody paying attention? It would also mean you need a qualified driver, you couldn't use it to ferry around children, disabled people or simply people without a license.