[Broken_Hippo]

Very much this: A system should be designed with the mindframe that the user won't be at 100%. Especially this, weirdly - because in a time of crisis, folks might not be at 100% even though they should be.

Its why some things just won't work unless put together just right - to account for people's mistakes. It'd make sense for a submarine to refuse to dive if the seals aren't sealed, for example. I'd think there would be something that could be applied even for this.

[M_Grey]

That sounds very good, but now here are your real-world constraints.

You have a network of detection systems which you give you (optimistically) 15-40 minutes of warning before everything and everyone you've ever known and cared about ends. In that time you have to make the decision to launch a counter-attack. Your decision needs to be something which can be rapidly acted upon, but also needs to be something that absolutely cannot be interfered with by any adversary launching the first strike. If you delay, your ability to counterattack will be forever lost. If you're wrong, you'll be setting off Armageddon.

Now... describe how you make that work.

[Animats]

Perimetr, the Russian system, is one solution. The USSR decided not to go for launch on warning. Their plan is that, when things get tense, they activate Perimeter. This is sometimes called "The Dead Hand". If the system was enabled, detected nuclear explosions, and there was no way to communicate with higher authority, it would automatically release weapons control to some lower level of authority. Even then, it's not auto launch; there are people in bunkers somewhere who have to make that decision.

Part of the rationale is that this didn't give the leadership of the USSR direct launch authority. They could enable the system, but that didn't cause a launch. It took H-bombs on Moscow plus an enabled system to do that. This provided a safeguard against the leadership going nuts.

The US should have an interlock like that.

[M_Grey]

...Have you seen Dr. Strangelove?