(I am copying a prior post of mine, but I think it bears repeating)
A flight officer should be able to engage a "defer to ground" mode from anywhere on the plane, at any time. Once "defer to ground" mode is engaged the autopilot cannot be disabled without the approval of an air traffic controller, or the consent of more than one (or more than two) flight officer(s). The air traffic controllers can then issue instructions to the autopilot or remotely control the plane or disable the "defer to ground" autopilot.
If the plane is out of range of air traffic control, the autopilot would (in addition to attempting to stabilize any descent) change trajectory to either a.) the closest known safe ground relay or b.) the closest known safe landing site.
In the ordinary course the pilots are in control, with "defer to ground" off by default, and can only be enabled by flight officers on the plane, so the plane cannot be compromised by malicious ATC.