This week, a Senate Foreign Relations Committee hearing focused congressional and public attention on the president’s authority to launch a nuclear attack. The widest concern is not about procedure for launching forces on warning or retaliating against an enemy attack, but about a potential decision to initiate use of nuclear weapons without good cause. Right now, the president can launch a nuclear first-strike on his authority alone.

Below we outline a proposal to constrain that authority. This proposal grows out of discussions within a study group at Columbia University’s Saltzman Institute of War and Peace Studies consisting of eminent experts on nuclear policy and civil-military relations.

Starting a nuclear war is the most momentous national security decision imaginable, and some naturally wish to ban that option altogether. For better or worse, U.S. and NATO strategic doctrine has always rested on keeping the option of nuclear first-use, and there is no consensus for reversal. Our case for introducing checks into the process for nuclear first-use, however, is not just to limit the commander in chief’s power but also to ensure it.

For the United States to use nuclear weapons first, there are two opposite procedural problems: insufficient deliberation and insubordination. On one hand, the president might initiate a launch without adequate consideration or consultation of responsible advisors, and the military chain of command might simply comply. On the other hand, the president might order the launch and officers might refuse to comply, either doubting the order’s authenticity or resisting it on moral or other grounds.

Either possibility is dangerous. The first risks unnecessary and catastrophic escalation. The second may seem less dangerous—or even desirable—but the upshot for civilian control would be very damaging. Currently, if the president orders a launch, there are technical means to assure authenticity of the order, but the system is insufficient for dealing with an order that appears to be irrational. A solution that requires military disobedience without clear legal backing is both unreliable and fraught with bad constitutional and policy implications.

A third problem has received less attention: the possibility of unauthorized parties tampering with the system to inject false orders. This is unlikely. The nuclear command and control system has been carefully designed with redundant bulwarks against imaginable accidents, but when it comes to nuclear weapons, even small odds of malfunction need to be covered. Whether it be some action by an unhinged military aide in charge of the “football” that contains the codes for a presidential order to launch, or malign cyber hackers managing somehow to penetrate the command system, safeguards to require concurrence by additional officials serve both purposes. They prevent a wayward president or others from starting a nuclear conflagration, while preserving the president’s option to fire nuclear weapons first when sensible officials might consider it necessary.

One solution would be a process that requires, in addition to authentication of the president’s order, certifications from the secretary of defense or designee that the order is valid (definitely from the commander in chief) as well as from the attorney general or designee that it is legal. Criticism that this procedure could dangerously lengthen the authorization process would be misplaced, since the requirement would not apply under conditions of enemy attack.

Such a process could simultaneously improve integrity of the launch process and proper deliberation. It should appeal to a broad range of opinions—those who want to go further to a complete no-first-use posture as well as those who worry about weakening deterrence or whether the command and control system will function as intended in crises.

Ideally, such a procedural mechanism would be adopted by the executive branch, but otherwise Congress could mandate it. There would be strong political and constitutional objections that such a measure interferes with the president’s commander-in-chief powers. It is justifiable, however, as necessary to ensure that the president’s commands are properly carried out. The requirement of attorney general legal certification would avoid having to resolve through legislation the thorny constitutional issue of when the president may take unilateral nuclear action. Just having the law on the books would provide confidence to the chain of command below a disastrously misguided president to resist an order to start nuclear war without reasonable grounds—to put insubordination on firm legal footing—and it would help guard against cyber breaches or glitches that seem impossible now but could surprise us at just the most crucial time.