Inside the Supreme National Security Council: The Architecture of Security Power

Introduction: The Institution Between the Leader and the State

 

The Supreme National Security Council (SNSC) serves as the point where the Islamic Republic translates supreme authority into coordinated state action. It brings the presidency, parliament, the judiciary, security ministries, senior military commanders and two representatives of the Supreme Leader into the same constitutional structure. Its membership is public, and its formal mandate is written into Article 176. Far less visible is the machinery between those facts: who shapes a decision before it reaches the Council, how the Supreme Leader enters the process, and how an approved policy moves from the centre into institutions capable of carrying it out.

That question has become more important since the death of Ali Khamenei and the succession of Mojtaba Khamenei. The new Supreme Leader formally inherited the highest office in the Islamic Republic, but he has exercised that authority under unusually restricted conditions. His public visibility has remained limited, access has been tightly controlled, and communication with senior officials has often appeared more mediated than it was under his father. Yet the regime has continued to govern. Negotiations have proceeded, military and diplomatic decisions have been taken, senior security appointments have been made, and state institutions have continued acting under a leadership far less publicly accessible than the one it replaced. IranSTO has examined that problem separately in its investigation of Mojtaba Khamenei’s post-succession system of mediated authority.

The more important question is not whether Mojtaba Khamenei personally attends every critical meeting, but how authority reaches the institutions expected to act beneath him. That process depends on a structure capable of collecting information, reconciling competing institutional interests, preparing policy, securing leadership approval and distributing the result into separate chains of implementation. The SNSC is one of the principal mechanisms through which that process occurs.

Its significance does not come simply from placing powerful officials around the same table. Different forms of authority intersect inside the Council without becoming part of a single hierarchy. The president chairs it. The heads of parliament and the judiciary participate alongside the ministers responsible for foreign affairs, intelligence and internal security. Senior military commanders enter the same process, while two members represent the Supreme Leader directly. Behind them operates a permanent Secretariat whose role, in the regime’s own terminology, extends beyond administration into decision-shaping.

Much of the Council’s power therefore exists before a final resolution is approved. Intelligence has to be selected and organised, threats defined, competing interpretations reconciled and policy options prepared before senior officials can deliberate. The Secretariat operates inside this less visible stage of the process. It neither replaces the Council nor possesses the Supreme Leader’s authority, but it helps determine the material from which formal decisions are made.

The SNSC is also not a military command centre. It can coordinate national security policy and produce decisions affecting the Islamic Revolutionary Guard Corps (IRGC), the regular armed forces, police, intelligence organisations and the Interior Ministry without absorbing those institutions into its own hierarchy. The Supreme Leader retains separate constitutional command authority over the armed forces, while the organisations responsible for implementation preserve command structures of their own. A political-security decision may therefore be collective even when the operational orders used to carry it out are not.

January 2026 provides the most consequential public test of that architecture. During the nationwide repression, former senior IRGC commander Esmail Kousari stated that the Council decided that the Law Enforcement Command of the Islamic Republic of Iran (FARAJA), the Basij and the IRGC should enter the confrontation armed. The United States Treasury separately identified Ali Larijani, then secretary of the SNSC and a representative of Ali Khamenei, as the official coordinating the protest response on behalf of the Supreme Leader. Independent human rights investigations subsequently documented those same security institutions using lethal force during the mass escalation of 8 and 9 January, examined in detail in IranSTO’s investigation into the January 2026 mass killings.

The evidence places the Council inside the regime’s coercive response without completing the chain between political decision and field implementation. No publicly available resolution examined for this dossier reveals the exact wording of the SNSC decision. No published voting record establishes how individual members acted. The operational orders transmitted to police, IRGC and Basij commands remain unavailable, as do the provincial rules of engagement and the reports that would show what senior officials learned after casualties began to rise. Those absences do not make reconstruction impossible; they identify the documents that would allow it to become more precise.

The same institutional problem appears outside domestic repression. Sensitive negotiating positions have been prepared through specialised structures inside the SNSC Secretariat. Wartime governance has involved smaller decision-making bodies and the revived Defence Council. Foreign proposals can move back through the security establishment before returning to the leadership for approval. The architecture changes according to the problem, but the underlying function remains recognisable: information is processed, policy is shaped, authority is formalised, and implementation is distributed into institutions possessing powers of their own.

The SNSC should therefore be understood neither as a ceremonial council nor as a hidden government directly commanding every security institution in the Islamic Republic. Both descriptions flatten a more complicated structure. The Council operates between supreme authority and the institutions capable of exercising coercive, military, intelligence, diplomatic and administrative power. Its importance lies in the conversion and coordination that occur between those levels.

That position has direct consequences for accountability. Membership in the Council does not prove attendance at a particular meeting, and attendance does not establish a vote. Coordination is not automatically operational command. At the same time, those distinctions cannot be allowed to turn institutional secrecy into an absence of responsibility. The Islamic Republic has disclosed enough of its structure to show where authority is formally supposed to move while withholding many of the records that would reveal how it moved in practice. Resolutions, minutes, voting records, transmission directives, operational orders and implementation reports remain among the most important missing evidence.

This Regime Atlas dossier reconstructs that machinery from the public record. It examines the constitutional design of the Supreme National Security Council, the decision-shaping role of its Secretariat, its relationship with the Supreme Leader, the domestic and military structures through which policy is implemented, its documented role in the January 2026 repression, the smaller mechanisms used during war and negotiations, and the network now operating under Mohammad Bagher Zolghadr.

The central question is no longer whether the Supreme National Security Council matters. The evidence already establishes that it does. The harder question is what kind of power it exercises, where that power ends, and what happens between a decision taken at the centre of the Islamic Republic and the institutions that eventually act on it.

 

Chapter 1: The Constitutional Machine

 

The Supreme National Security Council was not created as an advisory forum. Article 176 of the constitution places it inside the formal architecture of national security and assigns it three broad functions: determining defence and national security policies within the general policies set by the Supreme Leader, coordinating political, intelligence, social, cultural and economic activities connected to security and defence, and mobilising the country’s resources against internal and external threats. The mandate is deliberately broad. It extends beyond military planning and gives the Council a constitutional role wherever the ruling system defines an issue as a matter of national security.

That authority is substantial without being sovereign. Article 176 places the Council inside a framework whose outer limits are established by the Supreme Leader. The SNSC may formulate defence and security policy, but it does so within general policies determined above it, and its decisions do not become executable simply because the Council has agreed. The same article requires confirmation by the Supreme Leader before a resolution can be implemented.

The result is a constitutional structure in which the Council occupies the space between supreme authority and the institutions responsible for state action. It is neither independent of the Leader nor reducible to his administrative office. The Leader defines the framework within which the Council operates and retains the final power of confirmation, while the Council provides the mechanism through which security policy is processed collectively across institutions that otherwise possess separate authorities.

This is more precise than the common description of the SNSC as the Islamic Republic’s “top security body”. The phrase captures its importance but obscures its function. The Council is not simply the highest committee in a vertical hierarchy. It is a constitutional junction designed to bring several centres of power into the same national security process without merging them into a single chain of command.

A Council Built Around the Centres of Power

Article 176 makes that design visible through the Council’s membership. The president chairs the SNSC. The heads of parliament and the judiciary participate alongside the official responsible for planning and budget affairs, the ministers of foreign affairs, interior and intelligence, senior armed forces leadership, the highest-ranking officials of the regular military and the IRGC, two representatives appointed by the Supreme Leader and, when required, the minister responsible for the issue under discussion.

The composition matters because these institutions do not normally belong to a single hierarchy. The cabinet does not command the IRGC. Parliament does not direct the intelligence services. The judiciary does not control military operations, and the armed forces do not exercise constitutional authority over civilian ministries. The Council creates a formal setting in which information and authority from those different systems can be brought together before a national security policy is adopted.

Military assessments can therefore be considered alongside intelligence reporting, domestic-security concerns alongside diplomatic consequences, and economic resources alongside defence requirements. The heads of the three branches enter the same decision process as commanders whose military authority ultimately runs through the Supreme Leader. The Council does not erase the institutional boundaries between them; its function is to coordinate across those boundaries.

The two seats reserved for representatives of the Supreme Leader are particularly important. They place leadership representation inside the Council before any resulting resolution is returned to the Leader for confirmation. These representatives do not enter the institution through the presidency or cabinet. Their position derives directly from the office above the Council.

The Supreme Leader is therefore connected to the SNSC at more than one stage. General policy is set at the top, representation is built into the deliberative body, and the resulting decision remains subject to leadership confirmation before implementation. The Council cannot accurately be understood as an autonomous security institution that develops policy and then seeks a ceremonial signature. Supreme authority is embedded in the process from the outset.

Coordination Is Not Military Command

The most important limit on SNSC authority becomes clearer when Article 176 is read alongside Article 110.

Article 110 places command of the armed forces with the Supreme Leader. It gives the Leader authority over war and peace, mobilisation of the armed forces and the appointment or dismissal of senior military commanders, including the chief of the Armed Forces General Staff and the commander of the IRGC. Those powers belong to the Leader rather than the Supreme National Security Council.

This separates political-security coordination from military command. The SNSC can determine defence and national security policy, coordinate institutions and adopt decisions requiring action by the armed forces without becoming their constitutional commander. A Council decision affecting the IRGC does not turn the Guards into a department of the SNSC, just as the participation of military commanders in the Council does not transfer their operational hierarchies into it.

The distinction becomes essential when reconstructing responsibility for a security or military operation. A political decision may be taken through the SNSC while the operational order required to execute it moves through a separate military hierarchy. The existence of that hierarchy does not erase the political decision that preceded it, but the political decision alone cannot establish the content of every command later issued in the field.

The system is therefore better understood as a set of overlapping authorities than as a single pyramid. Political, military, intelligence and administrative chains remain distinct while intersecting at selected points. The SNSC is one of the most important of those intersections.

Article 176 also anticipates the need for specialised structures below the full Council. It authorises the creation of subordinate councils, including a Defence Council and what the constitutional text describes as a National Security Council, with their responsibilities defined by law and their organisational arrangements approved through the SNSC framework.

A terminology distinction is important here. Later chapters examine the pre-existing domestic-security body referred to in this dossier as the State Security Council, established under the Interior Ministry before the current SNSC architecture. It should not be confused with the Supreme National Security Council itself or treated as though the constitutional and statutory structures are interchangeable. Their exact legal relationship after 1989 is examined separately where the domestic-security system becomes relevant.

The broader constitutional point is more straightforward. Article 176 allows specialised work to be moved into smaller institutions without removing it from the wider national security architecture. The SNSC was never designed to execute every policy itself. Its constitutional function is to determine policy, coordinate institutions and connect bodies whose operational powers remain elsewhere.

The President Chairs It, but Does Not Control Its Outer Limits

The president’s position also requires precision.

Article 176 places the president in the chair, giving the presidency a central procedural and political role inside the Council. The president can lead meetings, coordinate the governmental side of the process and represent collective positions. Chairmanship, however, does not give the president sovereignty over the institution.

The Council’s policies remain bound by the general policies set by the Supreme Leader, and its resolutions still require leadership confirmation before becoming executable. The president therefore presides over a body whose constitutional limits are partly defined outside the presidency.

This arrangement explains why the SNSC cannot accurately be described either as a presidential committee or as a mere rubber stamp for the Leader. If it were simply an extension of the presidency, there would be little constitutional purpose in reserving two seats for representatives of the Supreme Leader and requiring final confirmation from above. If it were purely decorative, there would be little reason to assemble the heads of the three branches, senior ministers, military commanders and leadership representatives inside one permanent national security institution.

The constitution instead created a mechanism through which competing branches, security bodies, military institutions and government ministries can be brought into a common national security process without surrendering their separate powers. At the same time, it ensured that the process would remain structurally tied to the Supreme Leader before and after the Council acts.

Article 176 tells us where formal authority sits. It does not tell us who controls the agenda, which intelligence assessments reach the room, how competing options are prepared or which alternatives disappear before members deliberate.

Those questions belong to the Secretariat.

 

Chapter 2: The Secretariat: Where Decisions Are Made Before They Are Made

 

The public face of the Supreme National Security Council is the Council itself: presidents, ministers, military commanders, intelligence officials and representatives of the Supreme Leader gathered around the same table. That is the part of the institution the Islamic Republic occasionally allows to be photographed. Less visible is the permanent Secretariat behind it, where much of the work required to turn information into policy begins before the Council formally deliberates.

The regime has described that role in unusually direct terms. In a 2016 meeting with the SNSC secretary, deputies and experts, Ali Khamenei distinguished between the Council’s responsibility for decision-making and the Secretariat’s responsibility for decision-shaping. The formulation places the Secretariat upstream of formal approval. Its purpose extends beyond scheduling meetings, circulating documents or recording resolutions; it helps organise the material from which those resolutions are produced.

National security decisions rarely begin with a clean choice between clearly defined alternatives. Intelligence agencies submit assessments, military institutions produce operational judgments, ministries defend bureaucratic interests and political officials bring competing priorities into the same process. Before senior decision-makers can act, that material has to be collected, compared, reduced and presented in a form that can support a decision. The Secretariat occupies that preparatory space, which gives it influence over the architecture of choice without giving it final authority.

Power Before the Vote

A formal vote can reveal who approved the options placed before a decision-making body. It reveals much less about how those options reached the room.

No security council can meaningfully examine every raw intelligence report, military assessment, ministry memorandum or competing interpretation of a crisis. Information has to be filtered, contradictions identified, risks ranked and alternative courses of action reduced to a manageable number. In the SNSC system, much of that preparatory work falls to the Secretariat and the specialist structures operating around it.

The Secretariat cannot constitutionally replace the Council, remove the requirement for leadership confirmation or impose national security policy independently. Its influence operates earlier. A body presented with two prepared options still exercises formal decision-making power, but the institution that determined why those options survived while others disappeared has already shaped the environment in which the choice is made.

That role became particularly visible when Ali Larijani returned to the Secretariat in 2025. His presidential appointment decree described responsibilities extending well beyond internal administration. The Secretariat was instructed to monitor and prioritise national security risks, address emerging threats, reconsider strategic concepts and strengthen coordination among relevant institutions. National security matters were to be examined and prepared for decision through the Secretariat.

The language points to a broad institutional function. The Secretariat is positioned not simply to manage decisions after they are made, but to participate in defining which problems require decisions and how those problems are presented.

Who Defines the Threat?

That function becomes politically consequential because national security is not a neutral category.

Economic unrest can be treated as a policy failure or reframed as a security threat. A labour dispute can remain an administrative matter or be interpreted as hostile mobilisation. Political opposition can be addressed through ordinary political mechanisms or placed inside a framework of infiltration, foreign influence and subversion. A diplomatic proposal can be assessed as an opportunity for negotiation or as a security risk requiring military and intelligence scrutiny.

The way a problem is defined affects which institutions enter the process and which responses become thinkable within the ruling system.

Once an issue is moved into the national security framework, the institutional field changes. Intelligence assessments acquire greater weight. Military views may be introduced. Interior Ministry structures become relevant. Communications policy, economic controls or judicial measures can be incorporated into what had previously been a narrower political or administrative problem.

The Secretariat operates close to this point of conversion. There is no public evidence that it can simply override the assessments of the IRGC, intelligence services, ministries, judiciary or presidential administration. Its importance lies in receiving competing inputs and turning them into material the Council can use.

Access to the decision process is therefore a form of power in its own right. IranSTO has documented a similar principle in its investigation of Ali Asghar Hejazi and the security architecture surrounding the Office of the Supreme Leader, where influence often depended on controlling access to information and decision-makers rather than possessing the most visible public title. The Secretariat operates in a different institutional environment, but the underlying problem is comparable: the official who formally approves a decision is not necessarily the official who determined which choices were available.

Institutional Memory Behind Political Turnover

The Secretariat also gives the SNSC something its political members cannot provide on their own: continuity.

Presidents leave office. Ministers are replaced. Military commanders die, are dismissed or are promoted. Representatives of the Supreme Leader change, and secretaries themselves can be replaced. The permanent bureaucracy beneath those positions remains.

That continuity matters because national security policy accumulates over time. Negotiating records survive individual diplomats. Threat assessments can pass from one administration into the next. Classified correspondence, implementation reports and institutional relationships remain relevant after the officials who originally handled them have gone. A permanent Secretariat can preserve not only documents, but also the assumptions and policy histories attached to them.

The scale and internal organisation of that bureaucracy remain difficult to reconstruct from outside the state. Deputies occasionally become visible through appointments, meetings or foreign travel, and specialised committees emerge when officials later discuss their work publicly. Yet the current Secretariat publishes no sufficiently detailed organisational chart showing its full internal structure, directorates, decision procedures or distribution of responsibilities.

That opacity matters because the missing material concerns the stage of policy formation least visible elsewhere. Public announcements may reveal the final position, but they rarely show which assessment prevailed, which alternatives were rejected, what objections were raised or which intelligence assumptions shaped the eventual choice.

The state can disclose the decision while concealing much of the process that produced it.

Smaller Rooms Before the Larger Decision

The clearest public evidence of this preparatory role comes from specialised structures operating inside the Secretariat.

Abbas Araghchi has publicly described a six-member body that began as a nuclear committee and later evolved into a negotiations committee within the SNSC Secretariat. Ali Shamkhani initially chaired it, followed by Ali Larijani. According to Araghchi, substantive negotiation issues were examined inside this smaller structure before the resulting positions moved through the established SNSC approval process.

The example shows how policy can be narrowed before reaching the full Council. A smaller authorised group can absorb technical material, reconcile disagreements and prepare an institutional position without requiring every permanent member of the SNSC to participate in each stage of the process.

The committee did not replace the Council. Its importance lies in showing how much substantive work can occur before the formal decision-making body becomes visible.

That finding should not be generalised beyond the evidence. The existence of one specialised negotiations committee does not show that every security issue is handled through an identical six-person mechanism. Domestic repression, intelligence operations and military targeting may involve different structures entirely. Each has to be reconstructed from its own record.

What the available evidence does establish is an organisational principle: sensitive policy preparation can be moved into smaller structures within the national security bureaucracy while the constitutional authority of the larger Council remains intact.

Where Decision-Making Actually Begins

The Secretariat is powerful without being sovereign. Its influence lies in the stage before formal authority is exercised, where information is organised, threats are defined, and policy options are prepared for senior decision-makers.

That has direct consequences for accountability. When a national security decision produces serious consequences, the final resolution is only one part of the evidentiary record. Investigators also need to know who prepared the underlying assessment, which intelligence was presented, what alternatives were considered, what risks were identified and whether foreseeable consequences were discussed before approval.

Those records can reveal who shaped a decision even when they did not possess the authority to sign it.

Most of that material remains inaccessible. The Secretariat is therefore one of the largest blind spots in any public reconstruction of the Supreme National Security Council. The Council tells us where formal decisions are taken. The Secretariat raises the harder question of how those decisions are constructed before members reach the point of approval.

The next question is what happens when that prepared decision encounters the authority above the Council.

That is where the Supreme Leader enters the architecture.

 

Chapter 3: The Leader Inside and Outside the Council

 

The Supreme Leader does not sit on the Supreme National Security Council, but his authority is built into its constitutional structure. Article 176 places two representatives appointed directly by the Leader inside the Council, requires its policies to remain within the general framework set above it, and makes leadership confirmation a condition for implementation. The relationship is therefore more complicated than a Council that deliberates independently and later seeks approval from outside.

Supreme authority enters the process at several points. It shapes the policy boundaries within which the Council operates, remains represented during deliberation and returns at the end through the constitutional requirement that makes a resolution executable. The Leader can remain formally outside the Council while remaining structurally present throughout its work.

Two Seats Belong to the Leader

Article 176 reserves two seats for representatives appointed directly by the Supreme Leader. Their presence ensures that leadership representation is built into the Council before any resulting decision returns upward for confirmation.

Under Ali Khamenei, Saeed Jalili held one of those positions. Ali Larijani occupied the other after his return to the national security system in 2025. Larijani’s case is particularly useful because his two roles were formally distinct. The president appointed him secretary of the SNSC, placing him at the head of the permanent Secretariat, while Ali Khamenei separately appointed him as one of the Leader’s representatives on the Council.

The distinction matters. The secretary manages the institutional machinery responsible for preparing and coordinating national security work. A representative of the Supreme Leader occupies a constitutional position derived directly from the leadership. The two roles can be combined in one person, but they are not the same office and should not be treated as interchangeable.

After Larijani’s death in March 2026, Mohammad Bagher Zolghadr was appointed secretary with the publicly stated approval of Mojtaba Khamenei. By June, senior state officials were also referring to him as a representative of the Supreme Leader. A separate public decree appointing Zolghadr to that representative seat has not been located in the records reviewed for this dossier, leaving the formal appointment mechanism unresolved. What is clear is that the regime itself is treating him as both secretary and leadership representative.

That combination places Zolghadr at an important institutional junction between decision-shaping and leadership representation. It does not, however, establish that he is the exclusive channel between the Council and the Supreme Leader.

Representation Is Not the Same as Transmission

The existence of two leadership representatives creates an obvious question: do they carry the Leader’s instructions into the Council and return the Council’s decisions to him?

The public record provides only a partial answer.

Article 176 creates the representative positions without publicly defining their operational functions in enough detail to show whether either representative acts as the exclusive messenger, authenticator or custodian of leadership decisions. Their constitutional proximity is clear. The mechanics of transmission remain much less visible.

Several different forms of access can otherwise be collapsed too easily into one. An official may represent the Supreme Leader without possessing sole authority to speak for him in every circumstance. He may have direct access without personally transmitting every decision. He may communicate a leadership position without being the official responsible for authenticating the approval returned to the state.

Access, representation and transmission are related forms of institutional power, but they are not identical.

IranSTO’s investigations into Mohammad Mohammadi Golpayegani and the administrative machinery of the Supreme Leader’s Office and Ali Asghar Hejazi’s position within its security architecture illustrate the wider problem. Proximity to the Leader can create substantial institutional influence without proving that every decision, communication or approval passes through the same official.

The same evidentiary discipline is required here. No public procedure examined for this dossier identifies the individual or office inside the Supreme Leader’s apparatus that receives an SNSC resolution, briefs the Leader, records his response and returns an authenticated decision to the Council or the institutions below it.

For a body whose resolutions require leadership confirmation, that remains a significant black box.

The President Provides Another Visible Route

The two leadership representatives are not the only identifiable connection between the Council and the authority above it.

The president chairs the SNSC and can represent its collective position directly to the Supreme Leader. The current period has produced unusually useful public evidence of this route.

During the 2026 dispute over the understanding with the United States, Mojtaba Khamenei publicly described a process in which he held reservations about the arrangement while Masoud Pezeshkian, acting as chairman of the Supreme National Security Council and speaking on behalf of its members, accepted responsibility for protecting the regime’s stated interests. Mojtaba then allowed the process to proceed.

The episode reveals a sequence that is usually hidden. The policy was not publicly presented as a complete instruction originating with the Supreme Leader and moving downward. A collective institutional position had already been formed. The president carried that position upward, and the Leader then permitted it to proceed.

This single episode cannot establish that every SNSC decision travels through the president. It does show that the presidency can function as one route between the Council and the Leader.

The current architecture therefore contains several visible interfaces rather than one demonstrable channel: the president as Council chairman, two representatives appointed by the Supreme Leader, the secretary and permanent Secretariat, and the Supreme Leader’s Office itself. Their relative importance may change according to the issue, and the public record does not reveal a universal procedure assigning every decision to the same route.

Confirmation Is a Constitutional Power, Not a Formal Signature

Leadership confirmation should not automatically be treated as ceremonial.

Historical practice shows that a Supreme Leader can approve a Council decision while attaching conditions to its implementation. Ali Khamenei’s handling of the 2015 nuclear agreement is a useful example. He confirmed the relevant national security decision while imposing requirements and restrictions on how it was to be carried out.

The 2026 episode described by Mojtaba Khamenei reveals a different variation of the same principle. According to his own account, he did not initially share the position presented to him, but allowed it to proceed after Pezeshkian, acting as SNSC chairman, assumed responsibility for protecting the regime’s interests.

These examples show why confirmation should not be confused with authorship. A policy may originate with the leadership, be constructed primarily inside the national security bureaucracy, emerge through negotiation among Council members, or reach the Leader as a position already substantially developed below him. Confirmation gives the decision executable authority. It does not tell investigators, by itself, who designed the policy or how much of it originated at the top.

The reverse is equally possible. The Leader may establish the direction before the Council deliberates and use the institution to coordinate implementation across the state.

The public procedure is not detailed enough to determine which model applies in every case. That uncertainty is analytically important and should remain visible rather than being replaced by assumptions about how supreme authority must operate.

The Missing Interface Inside the Supreme Leader’s Office

The unresolved issue is not whether the Leader possesses final authority. The constitution answers that clearly. The harder question is how that authority is processed administratively.

No public material reviewed for this investigation establishes who submits an SNSC resolution to the Supreme Leader, in what form it is presented, whether supporting assessments accompany it, who briefs objections or competing views, how changes are recorded, or which office certifies the decision returned to the Council.

The security architecture surrounding the Office of the Supreme Leader shows that sensitive information and access have historically passed through a dense network of political, administrative and security officials. That wider structure cannot simply be assumed to perform the SNSC transmission function without direct evidence, but it makes the absence of a publicly identified mechanism more significant.

The constitution tells us that confirmation must occur. It does not reveal the administrative machinery through which confirmation becomes an actionable state decision.

Under Mojtaba Khamenei, that problem has become more visible because his access and public presence have been more restricted than his father’s. The broader consequences of that change belong to the post-succession architecture examined later in this dossier. For the SNSC, the narrower finding is sufficient: leadership authority remains constitutionally decisive, while the channels through which that authority enters and exits the Council are only partially visible.

The distinction becomes critical at the next stage. Once a decision has been prepared, adopted and confirmed, it has to leave the national security system and enter institutions capable of implementing it.

That is where political authority encounters separate chains of command.

 

Chapter 4: From Decision to Action

 

A decision of the Supreme National Security Council matters only if institutions outside the Council act on it. Once policy has been prepared, adopted and confirmed, it has to enter organisations with the actual capacity to arrest, deploy forces, collect intelligence, restrict communications, negotiate, mobilise resources or use armed force. The transition from political decision to implementation is where the architecture becomes harder to reconstruct.

The Islamic Republic does not operate through a single command chain descending from the Supreme Leader through the SNSC into every security institution below. The Council can coordinate national security policy across several systems, but those systems retain authorities and hierarchies of their own. A domestic-security measure, a military decision, an intelligence priority and a negotiating mandate therefore do not travel through the state in the same way.

That distinction has to be established before examining any specific operation. Political authorisation and operational command can belong to the same sequence without belonging to the same institution. A policy may be approved at the centre and translated elsewhere into operational instructions. Conversely, the existence of a separate command hierarchy does not mean that the policy it implements originated inside that hierarchy.

The importance of the SNSC lies precisely in its ability to connect institutions that remain separate after the decision has been made.

Domestic Security: From Tehran to the Provinces

For internal security, the most visible administrative bridge is the Interior Ministry and the network organised around the State Security Council.

The legal foundations of that structure predate the creation of the current SNSC. The 1983 State Security Council law placed national domestic-security coordination under the Interior Minister and created a territorial system extending through governors, provincial security councils and county-level bodies. Those structures bring together officials from institutions that otherwise answer through different chains, including police, intelligence bodies and, when required, military and IRGC representatives.

A national security position can therefore enter the domestic-security system without the SNSC having to issue instructions directly to every governor or provincial commander. The Interior Ministry provides the administrative reach needed to translate a central security policy into coordinated action across the country.

The precise legal relationship between the pre-1989 State Security Council and the structure created by Article 176 remains only partially visible in the public record. The constitution allows the SNSC to establish subordinate councils, but the material reviewed for this dossier does not provide a single public instrument explaining every aspect of the older domestic-security structure’s incorporation into the post-1989 system.

In practice, however, the institutions continue to intersect. The State Security Council remains active, provincial security councils continue to operate, and the Interior Ministry retains a central role in coordinating domestic security. The evidence supports an integrated working architecture even where the legal history of that integration is incompletely documented.

For present purposes, the structural point is straightforward: the SNSC can establish or coordinate the national security position, while the Interior system provides a route through which that position reaches territorial administration and local security coordination.

FARAJA Between Administrative Coordination and Armed Command

The position of FARAJA shows why implementation cannot be understood through a simple civilian hierarchy.

The Law Enforcement Command performs core domestic policing and public-order functions, placing it in constant interaction with the Interior Ministry, governors and provincial security structures. At the same time, it is an armed national organisation with its own command system rather than an ordinary branch of provincial administration.

A governor can coordinate a provincial response without becoming the commander of local police units. The Interior Minister can establish national security priorities without personally issuing tactical instructions. FARAJA headquarters can convert broader political or security requirements into operational police orders without having originated the policy itself.

During unrest, those layers overlap. The same police organisation may be acting within a response coordinated through domestic-security institutions while receiving operational instructions through its own national hierarchy.

Any reconstruction of responsibility therefore has to follow both levels. Identifying the political body that authorised a response is not enough, but neither is identifying the officer who issued the final field instruction. The evidentiary chain lies in the relationship between them.

Military Implementation Follows a Separate Hierarchy

The distinction becomes clearer when the IRGC and regular armed forces are involved.

Senior military commanders participate directly in the Supreme National Security Council, and military assessments can shape the policies adopted there. The Council can approve positions requiring military action or the involvement of the IRGC without acquiring operational command over those institutions.

Article 110 places command of the armed forces under the Supreme Leader, while implementation proceeds through the Armed Forces General Staff and the command structures of the IRGC and the regular military, or Artesh. A national security decision can therefore create the political or strategic basis for military action while the operational orders required to execute it travel through a separate hierarchy.

The separation is not absolute because senior commanders can move between two institutional roles. Inside the SNSC, they contribute to collective policy formation. Outside it, they return to organisations in which they may possess command authority. The same official can help shape a political decision and later participate in its implementation without turning the Council itself into a military headquarters.

This overlap is one reason formal titles alone cannot establish responsibility. What matters is the function an official performed at each stage.

IranSTO encountered a related structural problem in examining Vahid Haghanian’s role as an executive operator around the Supreme Leader. Officials can become important not because one hierarchy formally contains every power they exercise, but because they connect institutions whose authorities remain separate. The SNSC operates at a much larger scale, but its coordinating power depends on the same structural fact.

Intelligence Is Coordinated Without Becoming Unified

The intelligence architecture introduces another form of fragmentation.

Article 176 gives the SNSC a role in coordinating intelligence activities related to defence and national security. The Islamic Republic, however, does not possess a single intelligence service operating under one ordinary administrative hierarchy. The Ministry of Intelligence, IRGC Intelligence, military intelligence and protection organisations, police intelligence and other security bodies retain distinct institutional identities and chains of authority.

The legislation establishing the Ministry of Intelligence also created an Intelligence Coordination Council intended to bring major intelligence and security bodies into a common process. Its existence reflects a familiar problem: coordination is necessary precisely because institutional fragmentation is built into the system.

The public record does not show that every intelligence requirement generated through the SNSC passes through the Intelligence Coordination Council, nor does it establish that the Ministry of Intelligence exercises operational control over every body participating in a national security matter. What can be reconstructed is a layered system in which strategic priorities may be coordinated at one level while collection, analysis and operations remain distributed among several organisations.

Intelligence is therefore relevant on both sides of a decision. Assessments can help define the problem presented to the SNSC before policy is adopted. Afterwards, intelligence bodies may monitor targets, identify individuals or networks, support arrests, conduct counterintelligence or report on implementation.

In domestic-security cases, that creates a particularly important feedback problem. The same institutional system that helps construct the threat may later generate information used to justify or operationalise the response to it.

Diplomacy Moves Back and Forth

Diplomatic implementation follows a different logic.

A negotiating mandate can be shaped through the SNSC and its Secretariat, but the Foreign Ministry and negotiating teams carry that position into direct contact with foreign governments. Unlike a domestic-security directive or military instruction, negotiation does not move primarily downward through a chain. New information returns from the other side and re-enters the policy process.

A proposal can leave the national security system through diplomats, generate a counterproposal and then return for review by specialised committees, the Secretariat, senior officials or the Council. The approved position can then be adjusted and sent outward again.

This recursive structure helps explain why the official negotiating is not necessarily the official controlling its political boundaries. A foreign minister may manage the diplomatic process while the limits of acceptable compromise are determined through national security institutions behind him.

The more sensitive the negotiation, the more important that distinction becomes.

One Decision Can Create Several Implementation Streams

A single national security decision can activate several of these systems at once.

A domestic crisis may require the Interior Ministry to coordinate provincial authorities, FARAJA to deploy police units, intelligence organisations to identify organisers, the IRGC to mobilise additional forces and communications authorities to restrict networks. A wartime decision may simultaneously generate military instructions, diplomatic initiatives, intelligence requirements, economic measures and strategic communications.

Those actions can originate in the same national security policy without being contained in the same operational order.

This is why the documentation between political decision and field implementation matters so much. A Council resolution can define an objective or authorise a course of action. An Interior Ministry directive can translate that objective into an administrative requirement. A military or police headquarters can then issue operational instructions to subordinate units. Each document belongs to the same broader process while answering a different accountability question.

Collapsing those stages produces two opposite errors. One treats a broad political decision as though it necessarily contained every tactical instruction that followed. The other allows senior political bodies to escape scrutiny because they did not personally issue the final field command. A defensible reconstruction has to preserve the distinction without breaking the chain.

Implementation Also Sends Information Back Upward

The process does not end when institutions begin to act.

Domestic-security structures are designed to report conditions upward. Military and intelligence organisations maintain their own reporting systems. Security operations generate information about casualties, arrests, resistance, logistical problems, political consequences and the performance of the forces involved. That information can return to the same institutions that shaped the original policy.

This feedback loop is crucial for accountability because knowledge changes during an operation. An official may dispute what he knew when a policy was first approved, but the evidentiary question changes once reports of its consequences begin reaching the centre. What senior officials learned during implementation, how quickly they learned it and whether they altered or continued the policy can become as important as the original decision itself.

The architecture therefore operates in both directions. Authority and policy move outward through separate implementation systems, while information about the consequences moves back toward the centre.

For domestic repression, the clearest institutional bridge between those two movements is the Interior Ministry and the State Security Council network.

The next chapter examines that domestic-security hinge in practice.

 

Chapter 5: The Domestic Security Hinge

 

The Interior Ministry and the State Security Council provide the Islamic Republic with something the Supreme National Security Council cannot supply on its own: territorial reach. National security policy may be formulated in Tehran, but domestic repression is implemented across provinces, cities and local security structures. The machinery connecting those levels is built around governors, provincial security councils and the institutions brought into their orbit during a crisis.

The legal foundations of that structure predate the current SNSC. Under the 1983 State Security Council law, the Interior Minister occupies the central position in national domestic-security coordination. Governors are responsible for security within their provinces and chair provincial security councils that bring together representatives of police, intelligence and, when required, military and IRGC bodies. Similar structures operate below the provincial level.

This does not place every security organisation under Interior Ministry command. FARAJA retains its own hierarchy, the IRGC retains its military chain, and intelligence agencies preserve institutional autonomy. The domestic-security system instead provides a mechanism for coordinating across those boundaries, receiving information from the provinces and aligning several institutions around a common response.

Successive protest crises make that function increasingly visible. The evidence does not reveal an identical decision process in 2009, 2019, 2022 and 2026. What changes is the amount of the machinery that can be reconstructed.

2009: The Missing Middle

The 2009 Green Movement demonstrates the limits of retrospective reconstruction.

The political signal from the top was visible. Ali Khamenei publicly demanded an end to the demonstrations, while Amnesty International subsequently documented killings, beatings, mass arrests and the involvement of the Basij, IRGC and police in the repression that followed.

What remains difficult to identify is the institutional process between the leadership signal and those deployments.

The available public record provides no specific SNSC resolution directing the repression and no sufficiently detailed State Security Council documentation showing how national policy was translated into provincial action. The political authority at one end and the coercive institutions at the other can be identified, but the machinery connecting them remains largely concealed.

Later evidence should not be projected backwards to fill that gap. The fact that national and domestic-security institutions become more visible in subsequent crises does not prove that the same documented procedure operated in the same form in 2009.

The narrower conclusion is more defensible. Senior political authority publicly hardened the regime’s position, coercive institutions acted, and the coordination process connecting those stages was never exposed in enough detail to reconstruct it reliably.

2019: An Administrative Chain Becomes Visible

The November 2019 protests exposed more of the system.

Demonstrations following the sudden increase in fuel prices were met with lethal force and a near-total shutdown of international internet access. The communications blackout is particularly useful for institutional reconstruction because it required more than the deployment of security forces. A nationwide shutdown depended on central authority, regulatory instructions, technical implementation and compliance by telecommunications providers.

ARTICLE 19’s reconstruction of the shutdown identified the Supreme National Security Council as a central authority in decisions governing internet access while documenting the role of communications institutions and service providers in implementing the restrictions.

That evidence reveals an administrative chain that street violence alone often leaves hidden. A police unit can fire without exposing the national policy process above it. A nationwide communications shutdown requires several levels of coordinated action and therefore leaves a different institutional footprint.

The blackout and the lethal repression should not be collapsed into a single undocumented order. They were distinct measures. Taken together, however, they show that the regime could treat communications control and coercive security measures as parallel components of the same national crisis response.

The Interior Ministry becomes more significant in this setting because unrest across several provinces requires both territorial coordination and information flowing back towards Tehran. By 2019, the response was becoming harder to explain simply as a collection of local security forces reacting independently.

2022: Repression Across Several Systems

The 2022 uprising made the distributed character of the system more visible still.

Following the death of Mahsa Jina Amini in custody, the regime combined physical repression with communications restrictions, intelligence activity, pressure on media organisations and mass arrests. United Nations reporting documented restrictions on major platforms and warnings issued by national security and intelligence bodies to media organisations covering the protests.

The significance lies in the number of systems operating at the same time.

Police and other security forces confronted protesters. Intelligence bodies targeted networks and individuals. Communications authorities restricted information flows. Judicial institutions expanded prosecution and detention, while IRGC and Basij forces added coercive capacity as the uprising spread.

There is no public evidence showing that every one of these actions emerged from a single SNSC resolution or one unified operational order. The wider institutional point does not depend on such a finding. Once the ruling system treated the protests as a national security problem, the response expanded across bodies whose ordinary functions and chains of authority were different.

The result was coordinated fragmentation: several institutions acting through their own structures while serving a broader security response defined at the centre.

This is precisely the kind of environment in which a domestic-security coordination system becomes important. It does not need to erase separate chains of authority. Its function is to make those chains act toward a common political objective.

January 2026: The Middle Becomes Harder to Hide

January 2026 marks a significant shift in the evidence because important elements of the central, domestic and provincial layers become visible at the same time.

At the national level, public evidence connects the Supreme National Security Council to the decision to expand armed intervention. Ali Larijani, then SNSC secretary and a representative of Ali Khamenei, was later identified by the United States Treasury as coordinating the protest response on behalf of the Supreme Leader.

Within the domestic-security structure, Interior Minister Eskandar Momeni headed the State Security Council. Ali Akbar Pour-Jamshidian served simultaneously as deputy interior minister for security and law enforcement and as secretary of the State Security Council. Both later became subjects of European sanctions connected to the repression.

Below them remained the territorial machinery of governors and provincial security councils, where police, IRGC and intelligence officials could be brought into coordinated local responses while retaining their own organisational hierarchies. Foreign sanctions against provincial police and IRGC commanders provide additional identifiable points at the implementation end of the system.

The significance is not that every connection between those officials has now been proven. The relevant Interior Ministry directives, provincial minutes and operational orders remain largely unavailable. What has changed is that the middle layer can no longer be treated as entirely invisible.

The public record now identifies a central security institution, a leadership-linked coordinator, domestic-security officials positioned between Tehran and the provinces, and identifiable coercive forces operating below them. Independent investigations then document the mass violence that followed, examined separately in IranSTO’s investigation into the January 2026 mass killings.

The institutional question can therefore be framed much more precisely than in earlier protest cycles: how did the decision taken at the centre move through the domestic-security machinery before reaching the organisations that carried it out?

The State Security Council as the Domestic Hinge

Across these cases, the evidence supports a careful but consequential conclusion. The Supreme National Security Council functions as a strategic junction where a domestic crisis can be elevated into national security policy. The Interior Ministry and State Security Council appear to provide the principal administrative hinge through which that policy can be coordinated territorially.

This is coordination rather than direct command.

A governor does not become commander of an IRGC provincial corps because both participate in a security council. The Interior Minister does not acquire the Supreme Leader’s constitutional military authority. FARAJA, the IRGC and intelligence bodies retain hierarchies of their own.

The importance of the Interior system lies in its ability to coordinate across them. When unrest is no longer treated as a local administrative problem but as a national security threat, the regime already possesses a permanent network capable of collecting information, setting territorial priorities and aligning institutions whose operational chains remain separate.

That function becomes especially important during nationwide protests. A decentralised movement presents the state with different local conditions, fragmented information and several coercive organisations operating simultaneously. Provincial security structures provide a mechanism for bringing those actors into a common administrative process without requiring them to become part of one unified command.

The State Security Council system sits at that intersection.

What Comes Back From the Provinces

The same architecture that carries coordination outward is also designed to receive information from below.

Provincial security councils, governors, police commands, intelligence organisations and other state bodies generate reports about protests, arrests, casualties, infrastructure disruption and operational requirements. That information can return to Tehran while the response is still underway.

This feedback is essential to any later accountability inquiry because knowledge changes during an operation. A senior official may dispute what he expected when an initial security decision was taken. A different question arises once reports of shootings, deaths or escalating violence begin moving upward through the system.

The relevant evidence would include provincial security reports, requests for reinforcements, casualty assessments, changes to rules of engagement and communications showing whether the centre ordered restraint, escalation or continuation after learning what was happening.

Most of those records remain inaccessible. Their absence from the public domain does not suggest that the state lacked information about its own operation. The domestic-security system was built in part to collect precisely that information.

This is where institutional opacity intersects with the wider architecture of impunity surrounding state violence in the Islamic Republic. Secrecy can make external attribution difficult, but it does not dissolve the structures through which officials receive information and exercise authority.

Across 2009, 2019, 2022 and January 2026, the most defensible conclusion is not that the regime invented a new repression mechanism for each crisis. Successive episodes exposed more of an existing architecture.

By January 2026, enough of that architecture had become visible to move beyond the question of whether the Supreme National Security Council and the domestic-security machinery were involved.

The next question is what the Council actually decided.

 

Chapter 6: January 2026: The Decision to Escalate

 

By the first week of January 2026, lethal force was already being used against protesters. Amnesty International and Human Rights Watch documented the use of rifles and shotguns before the main escalation of 8 and 9 January, with at least 28 protesters and bystanders killed across 13 cities in eight provinces between 31 December and 3 January. The significance of 8 and 9 January therefore lies not in the first appearance of firearms, but in the scale, coordination and national character of the violence that followed.

The protests had begun on 28 December 2025 and spread rapidly from demonstrations driven by economic grievances into a nationwide challenge to the ruling system. By 8 January, unrest had reached hundreds of towns and cities across all 31 provinces. Internet connectivity then collapsed to near zero, telephone communications were heavily disrupted and, from the evening of 8 January into the following day, independent human rights investigations documented a dramatic escalation in unlawful lethal force. IRGC units, Basij formations, different branches of FARAJA and plain-clothes forces were identified among those involved.

In earlier protest crises, the central decision behind repression was often the least visible part of the chain. Political threats could be documented, security forces identified and victims counted, while the institutional process linking the leadership to deployment remained largely concealed. January 2026 produced stronger public evidence of that middle layer.

A Decision Inside the Supreme National Security Council

The most important public statement came from Mohammad Esmail Kousari, a member of parliament, former senior IRGC commander and former deputy commander of Tehran’s Tharallah Headquarters. In describing the regime’s response, Kousari stated that the Supreme National Security Council decided that FARAJA, the Basij and the IRGC should enter the confrontation armed.

The significance of the statement lies in where it places the decision. Kousari was not an outside investigator inferring institutional involvement from events on the street. He was a long-serving figure from inside the security establishment describing a decision taken at the regime’s highest national security council. His account provides direct public evidence that the expansion of armed participation was not simply the product of local commanders reacting independently across the country.

Kousari did not, however, release the decision itself. His statement provides no resolution number, identifies no individual votes and gives no detail on ammunition, rules of engagement, targeting thresholds or the circumstances in which firearms could be used. What it establishes is a central decision for armed involvement by three of the principal coercive institutions later documented in the crackdown.

That finding is already substantial. It does not need to be enlarged into a claim the available evidence cannot sustain.

A central decision authorising armed intervention is not the same as a documented order to kill protesters. The missing records between those stages are precisely what would establish how a political-security decision was translated into operational force.

The Timing Problem

Kousari’s account also raises a chronological problem.

His description suggested that security forces had initially operated without firearms before the SNSC authorised armed participation. Independent documentation shows that this cannot be read literally across the country. Rifles and shotguns had already been used before 8 January, and protesters had already been killed.

The strongest interpretation consistent with both records is that the SNSC decision represented a broader, more coordinated or nationwide escalation rather than the first authorisation for any security force anywhere in the country to carry or use firearms. Local police, IRGC or other security units were already shooting before the central decision described by Kousari appears to have brought FARAJA, the Basij and the IRGC into a more systematic armed response.

That remains an analytical reconstruction because the decision itself has not been disclosed.

Its precise timing is unresolved as well. Public evidence places the critical escalation within the 8 to 9 January period, but it does not show when the Council met, whether the decision was taken in a full session or through a restricted emergency procedure, or whether formal approval preceded the beginning of the mass killings documented from the evening of 8 January.

Those details matter. A difference of several hours can change the evidentiary relationship between authorisation and implementation. Without the meeting record, false precision would weaken the reconstruction rather than strengthen it.

Ali Larijani and the Leadership Connection

A separate evidentiary track identifies the official at the centre of the national response.

On 15 January, the United States Treasury’s Office of Foreign Assets Control (OFAC) designated Ali Larijani, then secretary of the Supreme National Security Council and one of Ali Khamenei’s representatives on the Council. OFAC stated that Larijani was responsible for coordinating the response to the protests on behalf of the Supreme Leader and had publicly called for security forces to use force against protesters.

The designation is a United States government sanctions determination, not a criminal judgment. Its value for this dossier lies in what it says about institutional position and function.

According to OFAC, Larijani was not simply present inside the national security apparatus during the crisis. He was coordinating the response on behalf of the highest authority in the system. Combined with Kousari’s account of an SNSC decision on armed intervention, this creates the strongest public connection currently available between the Council, its secretary and the leadership layer above it.

The evidence stops short of showing that Larijani personally drafted the decision, issued tactical orders to FARAJA, IRGC or Basij commanders, or transmitted every instruction involved in the response. What it does establish, according to the United States government, is a coordination role far beyond passive membership or administrative proximity.

That distinction becomes important when the investigation moves from the institution itself to the individuals who may have participated in its decisions.

The Blackout as a Parallel Security Measure

A second nationwide measure unfolded at the same moment as the armed escalation.

On 8 January, internet connectivity across Iran fell abruptly to near zero, and telephone communications were heavily restricted. The blackout isolated people inside the country, disrupted communication between protesters and sharply reduced the ability of witnesses, journalists and families to transmit information as the security response intensified.

Its timing is significant, but effect and intent have to be separated.

The blackout coincided with the regime’s most lethal phase of repression and made immediate documentation of the violence substantially more difficult. That alone does not prove that the communications shutdown was ordered specifically to conceal a predetermined massacre. No public evidence reviewed for this dossier establishes such an intent.

The stronger institutional conclusion is that information control and armed coercion were operating in parallel during the same national security crisis. Whether both measures originated in one SNSC meeting, in separate decisions or through overlapping security structures remains unknown.

The regime did not need a single written order to create a coordinated security environment. Different institutions could move through different implementation chains while serving the same broader objective of restoring regime control.

From Central Escalation to Mass Lethal Force

What followed is documented more clearly than the internal decision process.

Amnesty International identified IRGC forces, Basij battalions, FARAJA units and plain-clothes agents among those involved in the crackdown and concluded that the authorities carried out mass unlawful killings primarily on 8 and 9 January. The human cost and wider pattern of violence are examined separately in IranSTO’s investigation into the January 2026 mass killings. The question here is institutional: what can be established about the decision preceding that escalation?

The evidence is sufficient to reject an explanation based solely on spontaneous actions by local commanders. A central national security decision for armed participation has been described publicly by a former senior IRGC commander. OFAC identified the SNSC secretary as coordinating the protest response on behalf of Ali Khamenei. The institutions named in the central decision were then documented participating in widespread lethal repression.

These facts form part of the same institutional reconstruction even though the document connecting them has not been released.

The evidentiary boundary needs to remain exact. SNSC involvement is no longer inferred only from constitutional powers. Public evidence places the Council inside the decision to escalate. What remains unknown is the content of the authorisation and the operational chain through which it was implemented.

What the Evidence Establishes, and What It Does Not

The public record reviewed for this dossier does not reveal the exact wording of the SNSC decision, the individual votes or whether any member objected, abstained or demanded limits on the use of force. It does not show what information about expected casualties was presented before the decision, the form of Ali Khamenei’s approval or direction, or the subsequent instructions issued through the Interior Ministry, FARAJA headquarters, IRGC command and Basij structures.

For that reason, the statement that the SNSC “ordered the massacre” cannot presently be treated as an established documentary fact.

The narrower conclusion is already serious. Public evidence places the Supreme National Security Council inside a central decision to expand armed intervention during a nationwide protest crisis. It places its secretary at the centre of coordination on behalf of the Supreme Leader. It identifies the coercive institutions brought into that response, while independent investigations document those institutions using mass lethal force during the escalation that followed.

The unresolved question is what authority the Council gave them and how that authority changed as it travelled through separate chains of command.

January 2026 therefore marks an important shift in what can be reconstructed about coercive decision-making inside the Islamic Republic. The state has not disclosed the resolution, the vote or the operational instructions, but enough of the institutional structure is now visible to move beyond asking whether the SNSC was involved.

The next question is who participated in the decision, and what can actually be established about the individuals entitled to sit inside the room when it was made.

 

Chapter 7: Who Decided?

 

Once a central decision has been identified, the next risk is obvious: treating the constitutional membership of the Supreme National Security Council as a ready-made list of officials responsible for it. Article 176 tells us who was legally entitled to participate in the Council. It does not tell us who attended a particular session, who spoke, who objected, who abstained, who drafted the proposal or how each member voted.

For January 2026, that distinction is critical. Public evidence supports the existence of an SNSC decision for armed involvement by FARAJA, the Basij and the IRGC. What remains hidden is the internal process that produced it.

The constitutional roster is therefore a starting point, not a conclusion.

The Possible Decision-Makers

At the time of the January escalation, the Council’s permanent membership included President Masoud Pezeshkian, parliamentary speaker Mohammad Bagher Ghalibaf and judiciary chief Gholam-Hossein Mohseni-Ejei. Ali Larijani and Saeed Jalili sat as representatives of Ali Khamenei, with Larijani also serving as secretary of the SNSC. Interior Minister Eskandar Momeni, Foreign Minister Abbas Araghchi and Intelligence Minister Esmail Khatib were among the ministerial members, alongside the senior armed forces leadership and the officials specified under Article 176.

That list identifies the officials who could have participated in a full Council decision. It does not show that all of them did.

No public attendance record for the relevant decision has been released. No minutes identify those present, and no voting record shows who supported, opposed or sought to modify the proposal. The available record also leaves open whether the decision described by Esmail Kousari was taken in a full formal session, a restricted emergency meeting, a remote procedure or another crisis mechanism.

The institution can be identified with confidence. The vote cannot.

Ali Larijani: The Strongest Individual Link

Among the officials connected to the January decision, the evidence surrounding Ali Larijani is the strongest.

Larijani occupied two significant positions simultaneously. As secretary, he stood at the head of the permanent machinery responsible for preparing and coordinating national security work. As one of Ali Khamenei’s representatives, he also occupied a constitutional leadership seat inside the Council.

On 15 January, OFAC added a more specific finding. The United States Treasury stated that Larijani was responsible for coordinating the response to the protests on behalf of the Supreme Leader and had publicly called for security forces to use force against protesters.

That determination does not reveal Larijani’s vote or show that he personally drafted the armed-intervention decision. It also stops short of establishing that he issued tactical instructions to police or IRGC commanders. What it does establish, according to the United States government, is a central coordination role linked directly to Ali Khamenei.

That places Larijani in a different evidentiary category from officials whose connection rests only on formal membership.

His role cannot responsibly be reduced to presence in the institution, but the available evidence still does not show the precise action he took inside the decision-making process.

The Heads of the Three Branches

The evidence concerning Pezeshkian, Ghalibaf and Ejei is more contested.

All three were constitutional members of the Council and occupied positions at the highest political level of the ruling system. Iran International reported on 13 January, citing a source close to the SNSC, two sources in the presidential office and several sources within the IRGC, that the lethal response proceeded with the explicit knowledge and approval of the heads of all three branches and that the SNSC had issued a live-fire order.

The reporting is highly relevant because it alleges knowledge and approval at the top of the political system. It remains source-based reporting rather than a disclosed Council record.

No public minutes, signatures or voting documents reviewed for this dossier independently confirm the individual approval of Pezeshkian, Ghalibaf or Ejei. The allegation belongs in the evidentiary record, but it has to remain attributed.

Their public positions also differed in ways that matter when individual responsibility is examined.

Masoud Pezeshkian

Pezeshkian chaired the Supreme National Security Council as president. That made him procedurally central, but chairmanship alone cannot establish authorship or approval of a particular decision.

The public record contains an important complication. On the morning of 8 January, his administration communicated a position against confrontation with protesters unless national security was endangered. The qualification leaves open the possibility of a later shift once the regime determined that the security threshold had been crossed.

What is missing is the record of that transition.

If policy changed during the day, investigators need to know when, on whose assessment and with what response from the president. Iran International’s sources allege that Pezeshkian knew of and approved the later escalation. The documentary record reviewed here does not independently confirm that allegation.

His significance therefore lies less in assuming a vote than in identifying the evidence that could resolve it: meeting records, communications, presidential instructions and testimony showing what he knew as the response changed.

Mohammad Bagher Ghalibaf

Ghalibaf’s role has to be assessed in light of both his constitutional seat and his background inside the security establishment.

As parliamentary speaker, he participated in the SNSC as a branch head. His earlier career included senior IRGC command and leadership of the national police, giving him direct experience inside the coercive institutions involved in the crisis.

Before the main escalation, Ghalibaf publicly distinguished between economic grievances and actors he portrayed as connected to hostile intelligence services. That rhetoric increasingly placed the protests inside a national security framework, but public framing cannot establish how he acted inside the Council.

The same source reporting that alleges approval by Pezeshkian and Ejei includes Ghalibaf. Until corroborating records emerge, his individual approval remains an attributed claim rather than a fact.

Gholam-Hossein Mohseni-Ejei

Ejei’s public position towards repression was more explicit.

Before the mass escalation, the judiciary chief had already called for uncompromising action against those the regime classified as rioters and instructed judicial and security officials to identify and act against organisers. IranSTO has separately documented Mohseni-Ejei’s role in the Islamic Republic’s system of judicial repression.

That record establishes a strongly repressive public posture and institutional role. It still cannot substitute for evidence of his vote inside the SNSC.

Iran International’s sources allege his knowledge and approval of the later decision. The Council records required to confirm that allegation remain unavailable.

Eskandar Momeni: Stronger Evidence Downstream

Interior Minister Eskandar Momeni occupies a different evidentiary category.

As a permanent SNSC member, he belonged to the pool of possible participants in the central decision. At the same time, he stood at the top of the domestic-security architecture responsible for coordinating implementation through the State Security Council and Interior Ministry.

The European Union later sanctioned Momeni in connection with the violent repression of the protests. That designation strengthens the case for examining his role in the domestic response, but it does not reveal how he acted during the SNSC deliberation itself.

His institutional importance is particularly strong downstream.

If the central decision moved through the Interior system, Momeni occupied a critical position between national policy and territorial coordination. The unanswered questions concern when his ministry received the decision, what instructions followed and what information returned once casualties began to rise.

Those questions require transmission and implementation records rather than inference from office alone.

The Military Members

The military members of the Council present the same problem from another direction.

Senior armed forces officials possessed constitutional seats in the SNSC, while one of the institutions represented there, the IRGC, was specifically named in Kousari’s account of the armed-intervention decision. Their participation in the broader security architecture is therefore clear. Their individual conduct inside the decision process is not.

A commander could have provided intelligence or operational assessments, supported escalation, argued for restraint, requested expanded authority or received a collective decision after it was approved. Without minutes, testimony or other direct evidence, the constitutional seat cannot tell us which role a particular commander performed.

Military officials can also operate in two institutional capacities during the same crisis. They may participate in collective policy formation inside the SNSC and later exercise command authority inside their own organisations.

That makes them potentially important bridges between decision and execution, but the bridge has to be established through evidence rather than assumed from position.

Jalili, Araghchi, Khatib and Other Members

For several other permanent members, the public record provides even less evidence of individual participation.

Saeed Jalili occupied one of Ali Khamenei’s representative seats, giving him a constitutionally significant position inside the Council. No reliable public evidence reviewed for this investigation establishes his position or vote on the armed-intervention decision.

Abbas Araghchi was Foreign Minister and a Council member, but the public record presently provides no substantive link between him and the domestic-security decision.

Esmail Khatib, as Intelligence Minister, headed an institution whose assessments would have been directly relevant to how the regime interpreted the protests. That makes the ministry institutionally important to the decision environment. It does not reveal what Khatib personally recommended or approved.

The same rule applies to the remaining members: access to the decision-making forum cannot substitute for evidence of conduct inside it.

From Roster to Accountability

The January decision can therefore be reconstructed only in evidentiary tiers.

At the institutional level, the SNSC decision for armed involvement is supported by Kousari’s on-record account. At the individual level, Larijani has the strongest documented connection because OFAC identified him as coordinating the response on behalf of Ali Khamenei. Separate source reporting alleges the knowledge and approval of the heads of all three branches. Momeni’s downstream relevance is strengthened by his position at the top of the domestic-security system and by subsequent sanctions. For several other members, the current public record establishes little beyond their legal presence in the Council.

That hierarchy matters because a serious accountability inquiry requires records that the constitutional roster cannot provide: attendance lists, intelligence briefs, draft proposals, objections, voting records, leadership communications and subsequent reporting showing what Council members learned after armed intervention began.

Those records would answer the questions titles cannot. Who proposed bringing FARAJA, the Basij and the IRGC into a wider armed response? Which members were present when the proposal was discussed? What intelligence was used to justify it? Did anyone seek limits on force? Did anyone object? What was communicated to Ali Khamenei, and what did he approve?

Most importantly, what did the participants know once the consequences of the decision became clear?

Membership identifies the pool of possible decision-makers. It does not identify the vote.

The next stage of the investigation therefore moves away from the people who may have taken the decision and towards the documents required to show how that decision left the Council.

That is where the missing orders begin.

 

Chapter 8: The Missing Orders

 

By this stage of the investigation, both ends of the January 2026 chain are visible. Public evidence places a decision for armed involvement inside the Supreme National Security Council and identifies Ali Larijani as a central coordinator acting on behalf of Ali Khamenei. Independent investigations, meanwhile, document FARAJA, IRGC and Basij forces using lethal violence during the crackdown.

What remains concealed is the documentary chain connecting those stages.

That gap is not a minor technical problem. It is the central evidentiary issue.

No public copy of the relevant SNSC resolution has been located. Its number, exact wording and precise time of adoption remain unknown. There is no published attendance list or voting record. The available evidence does not reveal whether the decision authorised deployment, armed deployment, the use of firearms under specified conditions or a broader security response later translated into more aggressive operational instructions.

Those distinctions matter because political authorisation and field command occur at different levels. A Council decision can establish a strategic objective without specifying how a police unit or IRGC formation is expected to act. A later operational directive can define the use of force more precisely, while provincial commanders may retain additional discretion under local conditions.

The missing evidence lies inside those transitions.

The Resolution the State Has Not Disclosed

Kousari’s account establishes that an SNSC decision existed for armed participation by FARAJA, the Basij and the IRGC. What it does not provide is the decision itself.

The resolution would be the first place to determine the scope of the Council’s authorisation. Its wording could show whether the decision concerned deployment alone, the carriage of weapons, the use of live ammunition or some broader form of security escalation. It could also identify conditions, assigned responsibilities and the mechanism through which the Council expected implementation to be coordinated.

Without the text, the existence of a central decision can be established more confidently than its precise content.

The next missing record sits above it.

Article 176 requires SNSC decisions to receive confirmation from the Supreme Leader before becoming executable. If the January decision followed that constitutional process, some mechanism must have existed through which Ali Khamenei approved, modified or authorised the resolution.

No public record reviewed for this dossier shows how that occurred.

The evidence does not reveal whether the decision was presented to him in writing, briefed orally, transmitted through a representative or communicated through another part of the leadership apparatus. Nor does it show whether conditions or amendments were attached before approval returned to the Council.

The gap becomes more significant because OFAC later identified Larijani as coordinating the protest response on behalf of Ali Khamenei. The leadership connection is visible. The document or communication through which authority passed between them is not.

The Missing Domestic Directive

Below the SNSC, the Interior Ministry and State Security Council provide the clearest publicly identifiable administrative route for nationwide domestic-security coordination.

Eskandar Momeni headed both the Interior Ministry and the State Security Council. Ali Akbar Pour-Jamshidian served as deputy interior minister for security and law enforcement and as secretary of the State Security Council. Governors and provincial security councils formed the territorial network beneath them.

If the central decision moved through this architecture, Interior Ministry or State Security Council records could establish when provincial authorities were informed, how the crisis was classified, which institutions were expected to deploy and whether additional measures, including communications restrictions, were coordinated through the same process.

No such directive has been made public.

This is the missing administrative hinge between national policy and provincial implementation.

Its absence matters because the Interior Ministry did not need to command every armed institution directly in order to shape the domestic response. It could coordinate governors, police, intelligence bodies and IRGC representatives while those organisations continued issuing operational instructions through their own hierarchies.

The institutional route is visible enough to investigate. The document that would confirm how it operated in January 2026 is not.

FARAJA, the IRGC and the Operational Gap

The next missing layer sits inside the coercive institutions themselves.

FARAJA was specifically named in Kousari’s account of the SNSC decision and was subsequently documented participating in the lethal crackdown. Yet no central FARAJA order reviewed for this investigation shows how the national decision was translated into instructions for provincial police commands.

Such records could answer critical questions. Did headquarters authorise live ammunition? Were limits placed on firearm use? Was discretion delegated to provincial commanders? Were different rules applied to different categories of protest activity? Who inside the police command received the national security decision and converted it into operational language?

The IRGC and Basij chains are even less transparent.

Both were included in Kousari’s description of the SNSC decision and later identified among the forces involved in the crackdown. The unresolved issue is how the central political-security decision entered the Guards’ own command architecture.

Several routes are institutionally possible. The decision may have travelled through senior IRGC participation in the national security system, through the Supreme Leader’s separate military authority, through the Armed Forces General Staff or through a combination of those channels. Provincial IRGC corps and Basij formations could then have received instructions through internal command structures.

The public record does not identify which sequence occurred.

This is precisely why the distinction between SNSC coordination and operational command has to remain intact. The Council could authorise or coordinate IRGC involvement without issuing the final command used by a provincial unit. Establishing where political authorisation ended and military command began requires the records between those stages.

Provincial Records May Be the Most Revealing

Some of the most important evidence may exist below Tehran.

Provincial security councils sit at the point where central policy encounters local conditions. Their minutes, directives and reporting could show when governors were briefed, which forces attended meetings, whether reinforcements were requested, what intelligence was presented and how casualties were discussed as the crackdown escalated.

Those records could also reveal how much discretion remained at the provincial level.

The January violence did not unfold identically across the country. Different cities experienced different levels of lethal force, and local commanders operated under different protest conditions. A central decision may have established the framework for armed repression while leaving substantial tactical choices to provincial or institutional commanders.

Without provincial records, it is impossible to determine precisely where national instruction ended, and local command began.

That boundary is central to individual accountability.

The Reports That Returned to the Centre

The evidentiary chain did not end once forces were deployed.

Governors, provincial security councils, police commands, intelligence organisations, the IRGC, hospitals and judicial bodies all generate information during a major security operation. Arrests, casualties, requests for reinforcements and changing local conditions become part of the state’s internal record.

The regime later produced casualty figures of its own. Whatever their reliability, the existence of those figures confirms that information about the consequences of the crackdown was being collected inside the system.

That makes the feedback chain as important as the original authorisation.

An official may dispute what he anticipated when a decision was first taken. The accountability question changes once reports of mass casualties begin reaching the centre and the operation continues.

The relevant evidence would show when Larijani learned the scale of the deaths, what reached Momeni and the Interior Ministry, what was reported to the SNSC Secretariat, what information reached Ali Khamenei and whether senior officials ordered restraint, modification or continued escalation after learning what was happening.

Those records remain inaccessible. Their absence does not show that senior officials lacked information. It means the public cannot yet see what information they received or what they did with it.

This distinction is central to the wider architecture of impunity surrounding state violence in the Islamic Republic. Responsibility is not confined to what an official knew when an operation began. It can also depend on what he learned during implementation and whether he continued to approve, coordinate or tolerate the policy after its consequences became clear.

Secrecy Does Not Erase Institutional Continuity

The Islamic Republic’s refusal to disclose these records creates a serious obstacle for external investigation, but secrecy should not be confused with the absence of a chain inside the state.

The institutions involved knew who participated in the relevant meetings. They knew what decision was taken, how leadership confirmation was communicated, which ministries and commands received instructions and what reports later returned from the provinces. The state’s own machinery generated information at every stage.

What the public lacks is documentary continuity between those stages.

The January 2026 chain is not proven in full. The evidence does not yet show every order, every transmission or every individual act of authorisation. But the chain is no longer invisible. At one end stands a documented central decision for armed involvement and a coordinator linked directly to the Supreme Leader. At the other stand coercive institutions independently documented using lethal force.

Between them lie the records capable of showing how authority changed form as it moved through the state: the SNSC resolution, the Leader’s confirmation, Interior Ministry directives, FARAJA and IRGC orders, provincial security records, rules of engagement and the reports returned after the killing began.

Those documents are not administrative details. They are the evidence required to reconstruct responsibility with precision.

Institutional continuity is visible.

Documentary continuity remains hidden.

 

Chapter 9: Governing War Through Smaller Rooms

 

War and diplomacy place different demands on the Supreme National Security Council than domestic security. A nationwide crackdown can be coordinated through territorial structures extending from Tehran into the provinces. Negotiations and wartime decisions move differently. They require specialised information, faster review and repeated exchanges between military conditions, intelligence assessments, diplomatic proposals and political authority.

Under those pressures, the Islamic Republic has increasingly relied on smaller decision structures operating around the SNSC rather than requiring the full Council to perform every stage of policy preparation itself. These bodies do not replace the Council. Their function is to reduce the volume of information, technical detail and institutional disagreement before a policy reaches the level where formal approval is required.

The most revealing recent example is the specialised committee Abbas Araghchi has described inside the SNSC Secretariat.

The Committee of Six

According to Araghchi, the body began as a nuclear committee and later evolved into a negotiations committee, eventually becoming known as the six-member committee. Ali Shamkhani initially chaired it, followed by Ali Larijani after his return to the national security apparatus. Araghchi has said that substantive issues connected to negotiations were examined within this smaller structure before the resulting positions followed the established SNSC approval process.

The significance of the committee lies less in its size than in its position within the system. Sensitive negotiating questions could be examined by a limited group before reaching the full national security machinery. Technical material could be absorbed, disagreements narrowed, and possible compromises tested without requiring every permanent SNSC member to participate in every stage.

This amounts to a form of decision compression. The committee could narrow the problem and shape the position ultimately presented for approval, but it did not acquire the constitutional authority of the Council merely because important work occurred inside it. Its output still had to move through the wider approval structure.

That distinction matters because opaque political systems encourage two opposite errors. One is to assume that every consequential decision is made directly by the most senior formal body. The other is to discover a smaller committee and immediately treat it as a hidden government exercising authority beyond its actual mandate.

The evidence supports neither interpretation.

The six-member committee was an authorised mechanism for processing a specialised policy problem within the SNSC system. Its importance came from what it could do before formal approval, not from replacing the institutions responsible for that approval.

Its full membership remains unclear in the public record reviewed for this dossier. Officials who later appeared in negotiations or foreign-policy discussions cannot simply be added retrospectively to the committee. Araghchi’s account establishes the body, its institutional location and its former chairmen, but not a complete current roster.

That gap matters because the committee’s composition would reveal which parts of the regime were admitted into one of the most sensitive stages of negotiating policy before the wider Council became involved.

Diplomats Execute a Mandate They Do Not Own

The same structure helps explain the difference between conducting negotiations and controlling negotiating policy.

The Foreign Ministry and its negotiators may represent the Islamic Republic across the table, but diplomatic visibility does not establish control over the political mandate. Araghchi’s own descriptions of the process show that negotiating positions were repeatedly reviewed through national security structures rather than determined independently by the ministry conducting the talks.

A proposal can leave Tehran through the negotiating team, return as a counterproposal and re-enter the security system for further review. The response may be examined by specialised committees, the Secretariat or the Council before a revised position is sent outward again.

Unlike a domestic-security directive, this process is not primarily linear. Each external response creates new input for the internal decision system.

Negotiation therefore blurs the boundary between implementation and decision-making. Diplomats execute the mandate, but the results of that execution immediately generate the material from which the next decision is made.

The official sitting across from a foreign government may control the language and conduct of negotiations without controlling the political limits within which those negotiations can succeed.

The Political Decision to End a War

War termination reveals the same architecture at a higher level of consequence.

Araghchi has publicly described the decision to end the war as a collective decision of the Supreme National Security Council. His account places the strategic choice to stop fighting inside the national security process rather than with an individual diplomat or battlefield commander.

That does not make the SNSC the commander of the military operations required to implement such a decision. The distinction established earlier in this dossier remains intact. The Council can determine a political objective while military execution continues through the Supreme Leader’s constitutional command authority and the armed forces’ own hierarchies.

A decision over whether to continue or end a war also requires information that no single political office can generate on its own. Military commanders provide assessments of capability, losses and operational conditions. Intelligence organisations assess enemy intentions and future risks. Diplomats report on ceasefire possibilities, foreign pressure and the positions of external actors. Economic institutions measure the state’s ability to sustain the conflict.

The SNSC provides a place where those different forms of information can be converted into a political-security decision.

Under wartime pressure, however, the full Council may not be the institution that first processes every detail. The volume and speed of information create a demand for smaller specialised structures capable of preparing decisions before they reach formal approval.

The Defence Council Returns

The revived Defence Council represents the second important part of this wartime architecture.

Article 176 already provides for subordinate councils within the national security system. Following the 2025 war, the Defence Council re-emerged as a visible institution concerned with defence preparedness, coordination and the state’s response to evolving military threats. Ali Khamenei appointed Ali Shamkhani and Ali Akbar Ahmadian as his representatives to the body, while Shamkhani later served as its secretary before his death in February 2026.

Public descriptions of the Defence Council’s responsibilities extended beyond narrow operational planning. They included strengthening defence readiness, coordinating institutions, developing responses to emerging threats, defence diplomacy and strategic communication.

These functions place the Council between military capability and wider state policy without making it a battlefield headquarters. The Defence Council does not replace the Armed Forces General Staff, and its existence does not transfer operational command over the IRGC or Artesh away from the constitutional military chain.

Its importance lies in providing a specialised forum in which defence questions can be processed within the wider national security architecture.

The regime’s response to wartime pressure was therefore not simply to remove institutional layers and place every decision inside one command centre. It added another mechanism for coordination.

That pattern is consistent with the broader architecture examined throughout this dossier. When a security problem becomes too specialised, fast-moving or politically sensitive for ordinary bureaucratic procedures, the system can move part of the preparatory work into a smaller structure without formally displacing the institutions above or below it.

Why Smaller Rooms Matter in Wartime

War increases the value of this arrangement because it compresses time while multiplying the number of institutions involved.

Military operations generate intelligence requirements. Battlefield losses alter negotiating positions. Foreign pressure can affect military planning. Sanctions and logistical disruption create economic constraints. Communications policy becomes part of strategic management. Decisions in one field can change the assumptions being used in another within hours.

A full national security council can coordinate the overall political response, but it is poorly suited to processing every technical question at the speed a war can generate them. Smaller groups reduce that burden while also making the architecture less visible from outside.

By the time a policy reaches the full Council, some of the most consequential disputes may already have been narrowed. Intelligence assessments may have been filtered, certain options excluded, and disagreements reduced before formal approval begins. The final resolution remains important, but it may represent the last stage of a process whose most consequential preparatory work occurred elsewhere.

For accountability, that distinction matters. A final resolution can identify who approved a policy while revealing far less about who designed it, framed the available alternatives or removed other options from consideration. Understanding the decision requires attention to the smaller institutions that shaped the choice before the formal body acted.

Decision Compression Without Institutional Replacement

The Committee of Six and the Defence Council reveal the same organisational principle from different directions.

One reduces the complexity of negotiating policy before it enters the formal national security process. The other provides a specialised forum for defence coordination within the wider constitutional architecture. Neither replaces the Supreme National Security Council, and neither acquires the Supreme Leader’s military authority.

Their importance comes from concentrating preparatory work without transferring final constitutional power.

The regime can place sensitive policy questions before fewer officials, process specialised information more quickly and then route the resulting position through institutions that retain formal authority. Decision-making can therefore remain constitutionally collective while important stages of policy formation become increasingly compartmentalised.

That pattern has become especially relevant during the current leadership transition. Reuters reported in April 2026, citing officials and people familiar with internal deliberations, that wartime decision-making had become increasingly concentrated around a security core linking the SNSC, the IRGC and the leadership apparatus. The reporting remains attributed, but it is consistent with the post-succession system of mediated authority surrounding Mojtaba Khamenei, in which the Supreme Leader can retain final authority while institutions below him perform more of the work required to generate a decision.

The broader implications of that arrangement belong to the next chapter. The finding here is narrower.

War and negotiation show that consequential decisions are not always born in the institution that ultimately approves them. The SNSC remains the central political-security junction, but some of the most important work can occur before the Council formally acts.

Understanding the current system therefore requires moving from those smaller rooms back to the institution responsible for managing much of the machinery around them.

That brings Mohammad Bagher Zolghadr and the post-Khamenei SNSC into view.

 

Chapter 10: After Ali Khamenei: The Council Becomes More Important

 

The death of Ali Khamenei did not remove the Supreme National Security Council from the centre of the Islamic Republic’s security system. It increased the practical value of the institution.

Mojtaba Khamenei inherited the constitutional authority of the Supreme Leader, but not the political environment his father had built over more than three decades. Ali Khamenei governed through accumulated relationships with commanders, clerics, intelligence officials, ministers and political operators who had spent years learning how to reach him and how his preferences were translated into state policy. His successor entered office during war, under severe security restrictions and without the same history of routine institutional access.

Government nevertheless continued. National security decisions were taken, negotiations proceeded, military and diplomatic positions were formed, and senior security appointments were made. The loss of the old leadership environment did not produce institutional paralysis. Instead, it increased the importance of bodies capable of collecting competing positions, preparing decisions and carrying an approved outcome between the leadership and the state.

The SNSC was already designed for that function.

Zolghadr at the Centre of the New Secretariat

The appointment of Mohammad Bagher Zolghadr after Ali Larijani’s death provides the clearest institutional marker of the transition.

President Masoud Pezeshkian appointed Zolghadr secretary of the Supreme National Security Council on 24 March 2026, with the presidential office stating that the appointment had the approval of Mojtaba Khamenei. He arrived with experience across several institutions the SNSC exists to coordinate, including senior IRGC command, the Interior Ministry, the judiciary and the Expediency Council.

That background matters because the secretary’s importance does not depend solely on the formal powers attached to the title. The Secretariat receives assessments from institutions with different authorities and interests, prepares national security questions for decision and maintains the bureaucracy through which those questions continue after individual officeholders change. A secretary with long experience across military, domestic-security, judicial and political institutions enters that machinery with relationships extending well beyond the Secretariat itself.

By June 2026, senior state officials were also publicly identifying Zolghadr as a representative of the Supreme Leader on the Council. A separate public appointment decree for that representative position has not been located in the material reviewed for this dossier. The gap should remain explicit, but the regime’s own officials appear to be operating on the basis that he holds both positions.

The combination places Zolghadr at an unusually important junction. As secretary, he heads the permanent machinery responsible for preparing and coordinating national security work. As a leadership representative, he occupies one of the constitutional positions through which the Supreme Leader is present inside the Council.

That gives him substantial institutional centrality without establishing supremacy over the system.

Centrality Is Not Supremacy

The post-succession architecture cannot be reduced to a single chain running from Mojtaba Khamenei through Zolghadr and then downward through the rest of the regime.

The president still chairs the Council. Ministries retain bureaucracies of their own. Military commanders remain inside separate command structures. The Supreme Leader retains constitutional authority above the Council, including the confirmation required before SNSC decisions become executable.

Saeed Jalili also remains publicly identified as another representative of the Supreme Leader on the Council. Unlike Zolghadr, he does not head the Secretariat. His presence creates a second formal leadership channel inside the same institution.

The operational division between the two representatives remains opaque. No public procedure establishes which issues Jalili communicates to Mojtaba Khamenei, how frequently direct contact occurs, whether he carries instructions into particular deliberations or whether his role is primarily to represent leadership positions during the decision process.

The same caution applies to Zolghadr. Control of the Secretariat and recognised status as a leadership representative establish importance, but they do not show that every national security decision passes personally through him.

This becomes more significant when access to the Supreme Leader is restricted. Scarcity of access can increase the practical value of intermediaries without creating a monopoly for any one of them. IranSTO has examined a related form of institutional influence in its investigation of Vahid Haghanian’s role inside the executive machinery surrounding the Supreme Leader, where proximity, transmission and coordination could create power without collapsing the wider system into a single gatekeeper.

The same analytical discipline is required here.

Continuity Below the Secretary

The change at the top of the Secretariat did not produce a complete reconstruction of the institution beneath it.

Ali Bagheri Kani remained publicly active as a deputy secretary after Larijani’s death and continued appearing in senior international-security engagements. His position keeps an experienced foreign-policy operator inside the machinery handling diplomacy, regional security and international security questions.

Ghadir Nezamipour provides another visible part of the current structure. By mid-2026, foreign counterparts were publicly receiving him as deputy secretary for defence affairs. His activity with senior foreign security officials places him within the part of the Secretariat connecting defence policy with regional and multilateral security relationships.

Together, these officials show important areas of bureaucratic continuity beneath Zolghadr. The current SNSC is not simply a new group assembled after Larijani’s death. Parts of the existing machinery survived the transition and continued operating under a new secretary.

The domestic-security portfolio is less transparent.

Alireza Bayat, previously identified as the Secretariat’s security deputy, was killed alongside Larijani in March. No publicly verified successor has been identified in the sources reviewed for this dossier. That does not mean the position is necessarily vacant. It means the current holder, if one has been appointed, is not sufficiently visible in the available public record.

The distinction matters because this portfolio sits closest to the Secretariat’s work on internal security. The deaths of Larijani and Bayat removed two senior figures only weeks after the January crackdown. The regime rapidly disclosed the replacement at secretary level while leaving considerably less public clarity about the security machinery beneath him.

The Organisation Chart Remains Incomplete

The opacity extends beyond one deputy.

There is still no comprehensive public organisational chart showing the current SNSC Secretariat, the full distribution of responsibilities among its deputies, its specialist directorates or the smaller committees operating within it. Officials become visible through appointments and meetings, while the structure connecting them remains far harder to establish.

The specialised negotiations committee examined in the previous chapter illustrates the problem. Araghchi publicly identified Shamkhani and later Larijani as its chairmen. Larijani is dead, but no sufficiently authoritative public evidence reviewed for this dossier establishes who now chairs the committee or whether its membership has changed under Zolghadr.

The new secretary can reasonably be expected to exercise influence over sensitive work conducted through the institution he leads. That is not evidence that he automatically inherited every specialised chairmanship held by his predecessor.

Institutional reconstruction can identify where influence is likely to concentrate. It cannot turn that inference into an appointment the public record does not show.

A More Mediated Supreme Authority

The significance of the current SNSC becomes clearer when placed beside the leadership above it.

Mojtaba Khamenei has governed under conditions of unusually restricted public access. Reuters reported in July 2026 that he had suffered serious injuries during the February attack that killed Ali Khamenei and that security and health concerns had contributed to his continued absence from public view. On 21 July, Pezeshkian publicly said that his interaction with the Supreme Leader was increasing day by day.

The statement suggests that access was changing rather than fixed. More importantly, the state continued making consequential decisions during the period in which that interaction was more constrained.

This is consistent with the system of mediated supreme authority under Mojtaba Khamenei reconstructed separately by IranSTO. Restricted access to the Leader does not remove supreme authority. It increases the practical importance of institutions capable of converting military, intelligence, diplomatic and political inputs into a position sufficiently developed to be presented for approval.

The SNSC sits directly inside that process.

This does not mean Mojtaba merely approves decisions designed entirely by others. The available record would not support such a categorical conclusion. He retains the formal authority to accept, reject or condition positions presented to him, while the June 2026 understanding with the United States provides a public example of him permitting a position he did not initially share after Pezeshkian, acting as SNSC chairman, accepted responsibility for the outcome.

What has changed is the institutional environment in which that authority is exercised.

Under Ali Khamenei, personal dominance and longstanding relationships could obscure how much policy work occurred before a decision reached the top. Under Mojtaba, the mediation is harder to ignore. Final authority and institutional initiative can be separated more clearly in the public record.

The Council Matters More Because the Machinery Matters More

The post-succession shift does not make the Supreme National Security Council sovereign. There is no evidence that Zolghadr has displaced the Supreme Leader, that the Secretariat commands the IRGC or that a hidden security committee has replaced the constitutional structure of the state.

What has increased is the value of the machinery between the apex and the institutions expected to act.

A leadership system operating through restricted access needs reliable mechanisms for collecting information, resolving institutional disagreements and presenting choices upward. Once a position receives approval, it also needs institutions capable of carrying that authority back into ministries, military organisations, intelligence bodies and diplomatic processes.

The SNSC and its Secretariat were built to perform much of that work.

The present structure also shows why the term “inner circle” can be misleading. Pezeshkian has access as president and Council chairman. Zolghadr combines control of the Secretariat with recognised leadership representation. Jalili retains a second representative seat. Military commanders possess separate command authority and their own relationships with the leadership. The Supreme Leader’s Office remains another institutional route whose handling of national security decisions is still largely concealed.

Power has not collapsed into one gatekeeper. It has become more dependent on mediation across several institutional nodes.

That dependence is politically consequential because the officials who prepare information, narrow the available options and carry institutional positions upward can influence the environment in which final authority is exercised. The Supreme Leader may retain the constitutional last word while relying more heavily on structures beneath him to determine which problems reach that point and in what form.

The institutional machinery survived Ali Khamenei. Under his successor, its importance has become easier to see.

The Supreme National Security Council is one of the principal places where the new arrangement becomes visible: not as a replacement for supreme authority, but as an increasingly important mechanism for turning that authority into coordinated state action.

 

Chapter 11: Institutional Findings: The Architecture of Security Power

 

The evidence assembled across this investigation supports a more precise conclusion than the familiar description of the Supreme National Security Council as one of the most powerful institutions in the Islamic Republic. Power is too broad a category to explain how the institution actually works. The more useful questions are what the Council does, where its authority begins and ends, and how that authority interacts with institutions that retain powers of their own.

A recurring institutional pattern emerges from the record. The SNSC acts as a central mechanism for converting supreme authority and fragmented state power into coordinated national security policy. Its Secretariat helps shape the material from which decisions are made. The Council brings political, military, intelligence and administrative institutions into the same process. The Supreme Leader establishes the outer framework and retains the confirmation required to make Council decisions executable. Implementation then moves into separate systems that preserve their own chains of authority.

The findings below define that architecture.

1. The SNSC Is a Conversion Mechanism, Not an Advisory Forum

Article 176 gives the Council a formal role in determining defence and national security policy, coordinating state activity connected to security and mobilising resources against internal and external threats. Its membership brings together institutions that otherwise operate through separate political, administrative and command structures.

The Council’s importance lies in its ability to convert those fragmented institutional positions into a common political-security decision. It does not need to absorb the presidency, ministries, judiciary, intelligence bodies or armed forces into a single bureaucracy to exercise that function. Coordination across institutions that remain separate is the function.

2. The Secretariat Exercises Power Before Formal Approval

The permanent Secretariat is part of the power architecture rather than simply its administrative support.

The regime’s own description of the Secretariat as responsible for “decision-shaping” identifies where much of its influence lies. Intelligence is organised, problems are framed, competing assessments are reduced, and policy options are prepared before senior officials reach the point of formal deliberation.

The specialised negotiations committee provides a documented example. Sensitive policy could be narrowed inside a smaller structure and then routed through the formal SNSC approval system.

The Secretariat is not sovereign. Its significance lies in the fact that the construction of a decision begins before the institution formally approves it.

3. Supreme Authority Operates at Several Stages

The Supreme Leader’s relationship with the Council cannot be reduced to final approval.

General policies are established above the SNSC. Two representatives of the Supreme Leader sit inside it. The president, as chairman, can carry collective positions upward. The resulting decision then requires leadership confirmation before implementation.

The administrative machinery connecting those stages remains one of the most important intelligence gaps identified in this dossier. The constitution establishes that confirmation occurs, while the public record leaves unanswered who submits the resolution, how the Leader is briefed, how amendments are recorded and which office authenticates the decision returned to the state.

4. Coordination Does Not Equal Operational Command

The SNSC can authorise, coordinate or establish policy for actions involving the armed forces without becoming their commander.

Article 110 preserves the Supreme Leader’s constitutional command authority, while the IRGC, Artesh, FARAJA and other security organisations retain operational hierarchies of their own. Domestic administration follows another route through the Interior Ministry and territorial security system. Intelligence and diplomatic implementation operate through different structures again.

For accountability purposes, political authorisation and operational command therefore have to be reconstructed separately and then connected by evidence.

Treating them as the same thing exaggerates the Council’s authority. Treating them as unrelated allows political decisions to disappear behind the institutions that ultimately execute them.

5. The State Security Council Is a Critical Domestic Hinge

For internal security, the strongest publicly identifiable bridge between national policy and territorial implementation runs through the Interior Ministry, the State Security Council and provincial security structures.

This system gives the regime geographic reach without requiring the SNSC to command every police, intelligence or IRGC unit directly. Institutions can be coordinated across provinces while remaining inside their own organisational hierarchies.

Successive protest crises exposed different parts of that machinery. By January 2026, enough of the central, domestic and provincial levels had become visible to make the State Security Council system a central target for any serious reconstruction of coercive policy.

6. January 2026 Is the Strongest Public Test of the Council’s Coercive Role

The January 2026 repression marks the point at which the SNSC’s role in a major coercive escalation becomes more than an inference drawn from constitutional authority.

Esmail Kousari publicly attributed to the Council the decision that FARAJA, the Basij and the IRGC should enter the confrontation armed. OFAC separately identified Ali Larijani as coordinating the protest response on behalf of Ali Khamenei. Independent investigations documented those same institutions participating in the lethal repression examined in IranSTO’s investigation into the January 2026 mass killings.

The record therefore supports the existence of a central decision for armed intervention and identifies a leadership-linked coordinator.

It does not presently reveal the exact wording of the resolution, the individual votes or an explicit Council order to massacre protesters. That boundary is part of the finding itself, not a qualification to be hidden.

7. The Central Decision and the Lethal Outcome Are Visible. The Middle Chain Is Not.

The principal evidentiary gap in January 2026 lies between authorisation and implementation.

The SNSC resolution has not been disclosed. Neither has the form of leadership confirmation. Interior Ministry directives, FARAJA orders, IRGC and Basij command instructions, provincial security council records and rules of engagement remain unavailable.

The missing chain also extends upward after implementation began. Provincial and institutional reporting should have generated information about casualties, arrests and operational conditions. Those records could establish when senior officials learned what was happening and how they responded once the consequences became clear.

This is where institutional opacity becomes part of the wider architecture of impunity. Secrecy makes external reconstruction difficult, but it does not mean the state itself lacked records of its decisions and operations.

8. Crisis Governance Relies on Decision Compression

The specialised negotiations committee and revived Defence Council reveal another recurring feature of the system.

Sensitive policy can be moved into smaller structures capable of processing technical information and narrowing disagreement before an issue reaches the full national security machinery. Formal authority remains with the larger institutions, while substantive preparation becomes more compartmentalised.

This model becomes particularly useful during war and negotiation, when military, intelligence, diplomatic and political information has to be processed quickly.

The result is not necessarily a simpler or more centralised system. It is one in which some of the most consequential stages of policy formation can occur inside smaller rooms before the formal decision becomes visible.

9. Formal Membership Does Not Establish Individual Responsibility

The constitutional roster identifies who could participate in an SNSC decision. It cannot establish who attended, what they knew or how they voted.

That principle is especially important for January 2026. Ali Larijani has the strongest publicly documented individual connection because of the OFAC finding concerning his coordination role. Separate source reporting alleges knowledge and approval by the heads of the three branches. Other officials are connected primarily through institutional position unless stronger evidence emerges.

Membership identifies the pool of possible decision-makers. It does not identify the vote.

Future accountability work therefore depends on records capable of establishing conduct rather than titles: attendance lists, intelligence briefs, draft proposals, objections, votes, communications and subsequent reporting.

10. Post-Succession Authority Has Become More Dependent on Mediation

The succession of Mojtaba Khamenei did not change the constitutional position of the SNSC. It changed the environment in which the institution operates.

Restricted access to the new Supreme Leader, the loss of Ali Khamenei’s long-established personal networks and the continuation of war, negotiation and security crises have increased the practical importance of institutions capable of preparing consolidated decisions and carrying approved positions between the leadership and the wider state.

The current structure around Mohammad Bagher Zolghadr illustrates the shift. Zolghadr’s position at the head of the Secretariat and his publicly recognised role as a representative of the Supreme Leader give him substantial institutional centrality. Saeed Jalili remains a parallel leadership representative, Pezeshkian retains access as president and Council chairman, and military institutions maintain channels of their own.

The evidence points not to a single new gatekeeper controlling the system, but to a more mediated architecture in which several institutional nodes connect supreme authority to the machinery beneath it.

The Institutional Model

Taken together, these findings produce a clearer model of how the Supreme National Security Council operates.

The Secretariat prepares and narrows policy. The Council formalises a collective security position. The Supreme Leader supplies the authority required for implementation. The resulting decision then moves into domestic-security, military, intelligence or diplomatic structures that retain their own chains of authority. Information about implementation can subsequently return towards the centre and affect further decisions.

The SNSC is therefore best understood as an architecture of conversion, coordination and authorisation. It does not command the entire security state; it helps make coordinated action across that security state possible.

That distinction also explains why the institution matters for future accountability. Responsibility cannot be reconstructed from an organisational chart or a final order alone. It has to be traced through the officials who shaped the choice, those who authorised it, the institutions that translated it into operational instructions, and the senior figures who continued acting after the consequences became known.

The public record now reveals enough of that architecture to identify where the evidence should exist.

What it still does not reveal is who signed, transmitted and acted upon some of its most consequential decisions.

 

Conclusion: The Machinery Between Authority and Force

 

The Supreme National Security Council is neither the sovereign centre of the Islamic Republic nor a ceremonial body waiting for instructions from above. Its importance lies in the machinery between those two extremes.

The Council brings different forms of state power into a common national security process. Political authority, military assessments, intelligence reporting, domestic-security requirements and diplomatic considerations can be assembled without being absorbed into a single hierarchy. The Supreme Leader retains constitutional authority above that process, while the institutions responsible for implementation preserve powers and command structures of their own below it.

This explains how the SNSC can shape decisions with consequences across the state without directly commanding every organisation that acts upon them. A Council decision can establish a national security position, leadership confirmation can give it executable authority, and the resulting policy can then move through separate military, police, intelligence, administrative or diplomatic channels.

January 2026 provides the most consequential example examined in this dossier. Public evidence places the Supreme National Security Council inside a central decision to expand armed involvement by FARAJA, the Basij and the IRGC. The United States Treasury identified Ali Larijani as coordinating the protest response on behalf of Ali Khamenei, while independent investigations documented those same coercive institutions participating in the mass lethal repression that followed.

The record now allows the investigation to move beyond the question of whether the Council was involved. It does not yet reveal every step that followed.

The resolution remains undisclosed. The individual votes are unknown. The form of leadership confirmation has not been made public. Interior Ministry directives, police orders, IRGC and Basij instructions, provincial security records and rules of engagement required to trace the decision into the field remain largely inaccessible.

Those missing records define the next evidentiary problem. They do not erase the institutional structure already visible around them.

The same principle applies to individual responsibility. Holding a seat on the Council cannot by itself establish attendance, knowledge or approval of a specific decision. Coordination is not operational command, and representation of the Supreme Leader does not automatically establish authorship of his instructions. These distinctions are necessary if accountability is to be based on evidence rather than political assumption.

They cannot become an escape route from accountability.

A system that distributes authority across several institutions also distributes the evidence needed to reconstruct its decisions. Intelligence assessments can reveal how threats were defined. Secretariat records can show which options were prepared. Council minutes can identify who participated. Leadership communications can establish what was approved. Ministry and command directives can show how policy became operational instruction, while reporting from below can reveal what senior officials knew once implementation began producing casualties.

Responsibility has to be reconstructed across that sequence.

The post-Ali Khamenei transition makes the same institutional problem visible from another direction. Under Mojtaba Khamenei, supreme authority has not disappeared, but the machinery required to exercise it has become more important. Restricted access to the new Leader, greater dependence on intermediaries and the continuation of war, negotiation and domestic-security crises have increased the practical value of institutions capable of preparing decisions before they reach him and carrying approved positions back into the state.

The SNSC and its Secretariat occupy a central position in that environment. They do not replace the Supreme Leader; they help convert supreme authority into coordinated state action.

For investigators, journalists and any future accountability mechanism, that is the central implication of this dossier. Political power inside the Islamic Republic cannot be reconstructed by looking only at the official who possesses final constitutional authority or the security force visible at the end of the chain. The institutions between them matter: the officials who framed the problem, shaped the available choices, authorised the response, transmitted the decision, converted it into operational instructions and continued the policy after its consequences became known.

The public record does not yet answer all of those questions.

It now shows where the answers should be.

 

References and Sources

 

The following sources form the principal documentary basis for this Regime Atlas dossier. Official Iranian material is used to reconstruct formal institutional structures and the ruling system’s own description of its decision-making processes. Sanctions designations are treated as government findings rather than judicial determinations. Source-based media reporting is identified as such in the text and is not treated as equivalent to disclosed institutional records.

Constitutional and Legal Sources

1. Constitution of the Islamic Republic of Iran, revised 1989, Articles 110 and 176. Defines the Supreme Leader’s military and constitutional powers and establishes the Supreme National Security Council, its membership, mandate, subordinate councils and requirement for leadership confirmation.
2. Law Concerning the Determination of the Duties and Organisation of the State Security Council, 30 August 1983. Establishes the State Security Council under the Interior Minister and defines its domestic-security coordination, provincial reporting and implementation-review functions.
3. Law Establishing the Ministry of Intelligence of the Islamic Republic of Iran, 18 August 1983. Defines the Ministry of Intelligence and the statutory framework for coordination between civilian and military intelligence institutions.

Supreme Leader, SNSC and Official State Sources

1. Meeting of Ali Khamenei with the Secretary, deputies and experts of the Supreme National Security Council Secretariat, 3 February 2016. Records Khamenei’s distinction between the Council’s role in decision-making and the Secretariat’s role in decision-shaping.
2. Ali Khamenei’s letter concerning implementation of the Joint Comprehensive Plan of Action, 21 October 2015. Confirms the relevant SNSC resolution while attaching conditions to implementation, illustrating that leadership confirmation can be substantive rather than ceremonial.
3. Presidential decree appointing Ali Larijani as Secretary of the Supreme National Security Council, 5 August 2025. Sets out Larijani’s appointment and the Secretariat’s responsibilities for monitoring, prioritising, coordinating and preparing national-security matters.
4. Reuters, “Ali Larijani reappointed secretary of Iran’s top security body,” 5 August 2025. Provides independent reporting on Larijani’s appointment and the restructuring of the national-security apparatus.
5. Tasnim News Agency, “Ayatollah Khamenei Appoints New Representatives to Security, Defense Councils,” 7 August 2025. Reports Larijani’s separate appointment as a representative of the Supreme Leader on the SNSC and the appointment of Ali Akbar Ahmadian and Ali Shamkhani as leadership representatives on the Defence Council.
6. Reuters, “Surviving strike, Shamkhani resumes central role in Iran’s war room,” 25 February 2026. Used for Shamkhani’s role in the revived Defence Council and the wartime security architecture.
7. Reuters, “Iran names hardline ex-Revolutionary Guards commander to replace slain security chief,” 24 March 2026. Used for Mohammad Bagher Zolghadr’s appointment as SNSC secretary and his institutional background.
8. Parliamentary reporting identifying Mohammad Bagher Zolghadr as a representative of the Supreme Leader and Secretary of the SNSC, June 2026. Reproduces a message from Parliament Speaker Mohammad Bagher Ghalibaf addressing Zolghadr as both the Supreme Leader’s representative and SNSC secretary. A separate public appointment decree was not located.
9. Press TV, “Iran and Russia should set up new global security order, says Iranian official,” 27 May 2026. Identifies Ali Bagheri Kani as Deputy Secretary of the Supreme National Security Council during a senior international-security engagement.
10. Akashvani News, “NSA Ajit Doval meets Iranian official on sidelines of BRICS meeting,” 22 June 2026. Identifies Ghadir Nezamipour as Deputy Secretary for Defence Affairs of the SNSC.
11. Tasnim News Agency, Abbas Araghchi interview concerning the six-member negotiations committee and wartime decision-making, 19 July 2026. Araghchi described the specialised committee inside the SNSC Secretariat, identified Ali Shamkhani and later Ali Larijani as its chairmen, and described collective SNSC decision-making on negotiations and war termination.
12. SNSC statement concerning the agreement ending the 2026 war, 15 June 2026. Provides the SNSC Secretariat’s public account of the institutional basis for the memorandum of understanding and war-ending process.
13. Reuters, “Iran’s Khamenei says he approved MoU with US, despite reservations, after assurances on Iran’s rights,” 18 June 2026. Used to reconstruct the route through which Pezeshkian, acting as SNSC chairman, presented and assumed responsibility for a position later permitted by Mojtaba Khamenei.
14. Reuters, “Iran’s Guards seize wartime power, weakening Supreme Leader’s role,” 28 April 2026. Source-based reporting on the concentration of wartime decision-making around a security core linking the SNSC, IRGC and leadership apparatus.
15. Reuters, “‘Interaction’ with Iran’s injured Supreme Leader increasing daily, president says,” 21 July 2026. Used for Pezeshkian’s public description of increasing interaction with Mojtaba Khamenei and reporting concerning the Supreme Leader’s injuries, restricted access and continued absence from public view.

January 2026 Repression and Coercive Decision-Making

1. Esmail Kousari statement on the SNSC decision to deploy FARAJA, Basij and IRGC forces armed, February 2026. Reproduces Kousari’s on-record statement that the Supreme National Security Council decided the three coercive institutions should enter the confrontation armed.
2. U.S. Department of the Treasury, Office of Foreign Assets Control, “Secretary Bessent Announces Sanctions Against Architects of Iran’s Brutal Crackdown on Peaceful Protests,” 15 January 2026. Identifies Ali Larijani as responsible for coordinating the protest response on behalf of Ali Khamenei. The designation is treated as a U.S. government sanctions determination, not a judicial judgment.
3. Iran International, “Khamenei ordered killings with approval of top state bodies, sources say,” 13 January 2026. Source-based reporting alleging a live-fire order and the knowledge and approval of the heads of the three branches. These claims remain attributed in the dossier.
4. Council of the European Union, “Iran: Council adopts new sanctions over serious human rights violations and Iran’s continued support to Russia’s war of aggression against Ukraine,” 29 January 2026. Relevant to Interior Minister Eskandar Momeni and other officials and security commanders connected to the violent repression of the January protests.
5. Council of the European Union, “Iran: Council sanctions an additional 16 persons and three entities over serious human rights violations,” 16 March 2026. Relevant to the Deputy Interior Minister for Security and Law Enforcement Affairs, local IRGC commanders and units linked to the January crackdown.

Human Rights Documentation

1. Amnesty International and Human Rights Watch, “Iran: Deaths and injuries rise amid authorities’ renewed cycle of protest bloodshed,” 8 January 2026. Documents unlawful firearm use before the main escalation and at least 28 protesters and bystanders killed in 13 cities across eight provinces between 31 December 2025 and 3 January 2026.
2. Human Rights Watch, “Iran: Authorities’ Renewed Cycle of Protest Bloodshed,” 8 January 2026. Provides parallel documentation of lethal force, IRGC and FARAJA involvement and mass arrests before the main escalation.
3. Amnesty International, “Iran: Massacre of protesters demands global diplomatic action to signal an end to impunity,” 14 January 2026. Documents a coordinated nationwide escalation in unlawful lethal force beginning on the evening of 8 January.
4. Amnesty International, “Iran: Authorities unleash heavily militarized clampdown to hide protest massacres,” 23 January 2026. Documents the militarised security environment, mass arbitrary detention and continuing communications restrictions after the killings.
5. Amnesty International, “What happened at the protests in Iran?”, 26 January 2026. Identifies IRGC forces, Basij battalions, FARAJA units and plain-clothes agents among the forces involved and concludes that mass unlawful killings occurred primarily on 8 and 9 January.
6. Amnesty International, “Iran: Lack of international justice six months after January protest massacres risks further atrocity crimes,” 8 July 2026. Provides Amnesty International’s later assessment of the January killings and continuing accountability gap.

Earlier Protest Cycles and Communications Control

1. Amnesty International, “Iran: Khamenei’s speech gives legitimacy to police brutality,” 19 June 2009. Used to reconstruct Ali Khamenei’s public hardening of the regime’s position during the Green Movement without attributing an undocumented SNSC resolution.
2. Amnesty International, “Iran: Election contested, repression compounded,” 10 December 2009. Documents killings, arbitrary arrests, torture and other abuses during and after the 2009 post-election protests.
3. Amnesty International, “Iran: Details of 321 deaths in crackdown on November 2019 protests,” updated 29 July 2022. Provides detailed documentation of people killed by security forces during the November 2019 crackdown.
4. Amnesty International, “Iran: Internet deliberately shut down during November 2019 killings – new investigation,” 16 November 2020. Documents the near-total shutdown and its relationship to the lethal repression of November 2019.
5. ARTICLE 19, “Iran: Tightening the Net 2020 – After Blood and Shutdowns,” 2020. Reconstructs the infrastructure and institutional process behind the November 2019 shutdown and identifies the SNSC as a key authority in shutdown decisions.
6. Freedom House, “Freedom on the Net 2020: Iran,” 2020. Reports that the decision to disconnect the country from the global internet in November 2019 was made through the national security system and describes implementation through the ICT Ministry and service providers.
7. United Nations Special Procedures, Joint Urgent Appeal IRN 23/2022, 20 October 2022. Documents excessive and lethal force, arbitrary detention, torture, unlawful killings and internet disruption during the Woman, Life, Freedom uprising.

Related IranSTO Investigations

1. IranSTO, “Mojtaba Khamenei: Authority and the Office of the Supreme Leader”. Background investigation into Mojtaba Khamenei’s pre-succession authority and relationship with the leadership apparatus.
2. IranSTO, “Mojtaba Khamenei: Supreme Leader, Power and Command”. Reconstruction of the post-succession system of mediated supreme authority referenced throughout this dossier.
3. IranSTO, “Ali Asghar Hejazi and the Security Architecture of the Office of the Supreme Leader”. Relevant to information control, access and security coordination around the leadership office.
4. IranSTO, “Mohammad Mohammadi Golpayegani and the Office of the Supreme Leader”. Relevant to the administrative architecture surrounding the Supreme Leader.
5. IranSTO, “Vahid Haghanian and the Office of the Supreme Leader”. Examines executive coordination, institutional access and connectivity around the leadership office.
6. IranSTO, “Gholam-Hossein Mohseni-Ejei and Judicial Repression”. Relevant to the judiciary chief’s institutional and public role in coercive policy.
7. IranSTO, “Iran Mass Killings 2026 Report”. Detailed investigation into the January 2026 killings, security-force participation, casualty evidence and the wider pattern of repression.
8. IranSTO, “The Architecture of Impunity in Iran”. Background investigation into the institutional mechanisms through which state violence, secrecy and fragmented authority complicate accountability.

Source Note

This dossier distinguishes between constitutional and statutory authority, official appointments and statements, government sanctions findings, independently documented human rights violations, source-based reporting and analytical reconstruction. Where the evidence establishes institutional position but not individual conduct, the text preserves that distinction. Where documents remain unavailable, their absence is identified as an intelligence or documentary gap rather than filled by inference.