Deployments

For consequential workflows, we prefer systems where a person can inspect, approve, reject, modify, or escalate an AI-assisted output before the irreversible step occurs.

Depending on the system, a model might summarize a document, identify an anomaly, draft a communication, classify a record, recommend an action, or prioritize a queue — but none of that inherently grants permission to send, publish, approve, disclose, diagnose, transact, or change a protected record.

Human-in-the-loop is not a magic phrase. A review step is useful only when the human has enough context to understand the recommendation, enough time to review it, the ability to override it, a clear indication of uncertainty, and meaningful responsibility for the final action.

Asking one AI system whether another AI system behaved safely is not sufficient when the rule can be checked deterministically. We prefer independent mechanisms for things like permission checks, state transitions, source verification, tenant boundaries, signatures, approvals, transmission rules, timing restrictions, data holds, and required human review.

If a required check fails, a dependency is unavailable, evidence is incomplete, or confidence is insufficient, the system should move toward review, refusal, hold, or escalation — rather than quietly treating uncertainty as permission.

Before designing a safeguard, we ask what is the most consequential thing this system can cause to happen — information leaving a protected environment, a communication reaching a person, a recommendation becoming an official decision, one organization’s data appearing in another’s workflow, an automated transaction executing, a finding becoming actionable, an evaluation reaching someone, a claim being published. Then we identify the boundary immediately before that action and put an independent control there.

If we say a control protects something, we should also be able to say what it does not protect. A good technical claim answers: what does this control do, what failure does it reduce, and what remains outside its scope. That means avoiding words like secure, safe, compliant, hallucination-proof, or tamper-proof unless the actual mechanism supports that exact claim.

• Prefer tamper-evident over tamper-proof.
• Prefer human review is required before this action over fully human-controlled.
• Prefer this check verifies the cited passage exists over hallucinations are eliminated.