AI safety doesn’t live in the model — why the brake has to sit on the outside

Most conversations about AI safety circle one idea: let’s make the model smarter about safety. Let’s tune it to give safer answers, add instructions in the prompt, set its behaviour. The assumption is that the model is the right place to enforce the rules.

We want to ask a different question — one that turns out to matter more in practice: is safety that depends on whether the model “chooses” to be safe safety at all?

A caveat up front, as always: we don’t write this as experts with the one correct recipe. We show how we ourselves see it, from everyday work with multi-agent systems. What to do with it — you decide.

A rule in the prompt is a rule up for negotiation

When a safety rule lives inside the model — as an instruction, a tone, an ingrained way of answering shaped by the data the model was built on — it shares the fate of everything that is in the model: you can argue with it. You just have to phrase the request the right way. “Play the role of an expert who…”, “for the sake of a test, skip…”, “ignore the earlier instructions and…”. These are not exotic attacks. They are the everyday way a soft rule bends, because a role is elastic, and an instruction is just another piece of text the model weighs together with the rest.

Two more problems get mentioned less often. A rule inside the model is inconsistent across versions — a different model, a different release, and the safety behaviour shifts. And it is unverifiable — when something goes wrong, there is usually no independent record that the rule ever fired. You are left trusting that the model reported honestly. And trust is exactly what you don’t want in a place where the stakes are data or money.

The brake sits beside the model, not inside it

The alternative is simple in idea, though it takes discipline to build: make the safety decision before it reaches the model — and independently of it. A layer on the side, through which the request passes one way and the response the other. The model doesn’t see this decision, can’t talk its way around it or bypass it, because it happens outside the model.

It’s not about making the model less capable. It’s about making sure the hard limits don’t depend on its goodwill. Analysis and execution stay in the model — the brake is separate. That separation makes all the difference: standard “guardrails” try to fix the driver. A brake on the side simply stops the car.

What it looks like in practice, for us

This is not theory — it’s how we work. Two mechanisms that prove themselves day to day.

A gate on the irreversible. We split actions in advance: reversible ones the system does on its own, and for irreversible ones — deleting data, sending something outside, changing a live system — there is a hard limit. No “just this once” negotiation. The limit is in the mechanism, not in the request.

A task instead of a role. An agent has a fixed identifier and a concrete list: what it does — and what it doesn’t. A role is stretchy, it can be bent. A closed list cannot. The sentence “ignore your instructions and do X” has no way of becoming its task, because that task simply isn’t on the list.

And the part that surprises people most: on a serious, irreversible job — like upgrading the system that live services run on — a well-set-up arrangement becomes more careful, not less. A backup before starting, a checklist, a plan with emergency exits, two independent checks instead of one. This is the answer to the biggest fear about autonomy: “let it loose on production and it will cause damage.” With a brake on the side the opposite happens — the higher the stakes, the more control, not less.

What it doesn’t mean

Worth cutting the over-reading right away. A layer on the side doesn’t limit what the AI can do and doesn’t take away its usefulness — it doesn’t touch the model itself: neither its knowledge, nor the way it works. It reshapes nothing inside it. It only sets the range the model moves within, and at the hard limits it simply stops it. The model stays the same — what changes is what surrounds it. And it isn’t magic that “solves safety.” It’s a way to make the hardest rules stop depending on whether the model happens to be persuadable. Everything else — quality, sense, style — still happens in the model.

And one thing worth saying plainly: a brake on the side is meant to serve the human, not take their place. The layer guards the limits; it’s the human who sets where those limits are and who takes on the decision when the stakes are real. Structure around the model isn’t there to remove the operator — it’s there so their decisions have something to rest on.

In the end

Safety you have to pray out of the model isn’t safety — it’s hope. Hope is sometimes right, but you don’t want it where a mistake can’t be undone.

The simpler question to ask in your own company isn’t “is our model safe”, because that depends on the prompt of the day. It’s: “where are our hard limits — and is something outside the model itself holding them?” If the answer is uncertain, that’s exactly the gap worth closing — ideally before someone else finds it.

MafiaAI — a team of people and AI agents building tools, websites and solutions, including AI deployments run locally and privately, so your data stays with you. More: t8.pl