Why AI Safety Should Look More Like Seatbelts Than Better Drivers

One of the more interesting discussions I recently had centered on a simple question.

What does it actually mean for AI to be safe?

The argument presented was that deterministic middleware can never truly make an AI system safe because safety ultimately depends on the values and ontology of the model itself. If another language model is better aligned with an organization’s goals, then perhaps that second model should evaluate the first. There is a legitimate point inside that argument. An organization must define its own values, policies, risk tolerances, and acceptable behavior. No middleware platform can invent those decisions on its behalf. The harder question is what happens after those values have been defined. Should the final authority to allow, block, redact, escalate, disclose information, or execute an action rest entirely with another probabilistic model?

Serious AI safety teams are not generally choosing between a language model and deterministic code as though only one can exist. Most credible security architectures already combine several layers. The real debate is about which layer performs which job and which layer has final authority. Language models and specialized classifiers can interpret context, recognize paraphrases, identify indirect meaning, and detect novel patterns that fixed rules may miss. Deterministic controls can then enforce explicit consequences once the relevant signals have been produced. Framed this way, the argument is not that a second LLM has no value. It is that a second LLM should not become the sole authority over a boundary that must be predictable, reviewable, and consistently enforced.

This distinction matters because the word deterministic is often misunderstood. Deterministic does not mean comprehensive, intelligent, or incapable of error. It means that the same evaluated conditions produce the same defined result. A deterministic system can consistently make the wrong decision when its rules, inputs, or assumptions are incomplete. A simple keyword filter is especially vulnerable to paraphrases, obfuscation, misspellings, indirect requests, and previously unseen attack language. Calling such a filter deterministic does not magically make it safe. It only makes its behavior repeatable. Coverage, accuracy, and enforcement are separate engineering problems, and a credible safety architecture has to address all three.

OWASP makes this distinction unusually clear. Its prompt injection guidance says that pattern filters do not reliably detect every indirect injection and that a model trained for screening may identify cases that regular expressions miss. OWASP therefore supports model based guardrails for input screening, output screening, and action screening. At the same time, it says those models should sit alongside deterministic controls, not replace them. It also warns that the guardrail model is itself susceptible to prompt injection and should be treated as one layer in a broader defense strategy.

That guidance resolves much of the apparent conflict. Semantic detection is useful because language is flexible. Deterministic enforcement is useful because organizational boundaries should not change merely because a request was phrased differently or because a model sampled a different response. The detector can say that a message appears to contain a request for unauthorized data access. The enforcement layer can then check the user’s permissions and deny the action. A classifier can estimate that a conversation contains a crisis signal. The policy engine can apply the organization’s predetermined crisis protocol. A model can determine that a proposed tool call no longer matches the user’s original intent. The execution layer can refuse to perform it. Intelligence identifies what may be happening. Policy determines what is allowed to happen next.

OWASP is even more direct when discussing controls such as authorization and privilege separation. It says these controls should not be delegated to the LLM and should occur in a deterministic and auditable manner. It also recommends guardrails outside the model because training and system prompts cannot guarantee that the model will always follow the intended behavior.  This does not mean every content judgment can be reduced to a Boolean rule. It means that an LLM should not be able to grant itself permission, bypass an authorization boundary, expose protected information, or approve its own unsafe action merely because its internal reasoning concluded that doing so was appropriate.

NIST approaches the issue from the broader perspective of risk management. The NIST AI Risk Management Framework calls for ongoing testing, evaluation, validation, monitoring, and documented risk treatment throughout the AI lifecycle. It says deployed systems should be evaluated for safety, should remain within the organization’s risk tolerance, and should be able to fail safely when operating beyond their knowledge limits. NIST also calls for mechanisms that can supersede, disengage, or deactivate systems that produce outcomes inconsistent with their intended use.  These recommendations do not prescribe one specific middleware product, but they clearly reject the assumption that model alignment alone is sufficient. The surrounding system must be able to observe behavior, recognize unacceptable risk, and impose a known response.

MITRE’s SAFE AI framework follows the same layered approach. It applies established security controls to AI platforms, models, data, and infrastructure. Its assessment questions ask what input and prompt validation occurs before queries are executed or actions are taken, how prompt filters are reviewed and updated to prevent bypasses, and what validation protects against direct and indirect prompt injection.  That last point is important because it acknowledges the coverage problem. A safety control is not finished merely because it was deterministic on the day it was deployed. It must be tested against new attacks, evaluated for bypasses, updated as threats evolve, and supported by monitoring that reveals where its assumptions failed.

The driving analogy still helps, but it has limits. A seatbelt does not need to interpret language, infer intent, or distinguish a medical question from an attempt to cause harm. AI governance often does. It would therefore be inaccurate to compare an entire content safety system to a purely mechanical seatbelt. The more accurate comparison is the complete safety architecture of a modern vehicle. The driver interprets the road. Sensors detect objects, motion, traction, and proximity. Software estimates risk. Brakes, steering limits, warning systems, airbags, and seatbelts respond according to defined conditions. Some parts interpret a complicated environment. Other parts execute a predictable safety response. None of them is sufficient alone.

That is why I would still trust the brakes and seatbelt in my car more than I would trust every other driver on the road to remain perfectly trained, attentive, aligned, and predictable. The point is not that the brakes understand the road better than the driver. They do not. The point is that we do not place the entire burden of safety on judgment. We surround judgment with systems that reduce the likelihood and consequences of failure. Better drivers are valuable. Better sensors are valuable. Better brakes are valuable. Mature safety engineering uses all of them.

The same principle applies to AI. A purpose trained classifier may be better than a general language model at identifying a particular type of harmful content. Semantic scoring may find paraphrases that symbolic rules miss. Normalization can reveal encoded, scrambled, or deliberately obfuscated language. Conversation history may expose risk that no individual sentence contains. Human review may be appropriate when the available evidence remains ambiguous. None of these capabilities conflicts with deterministic governance. They become inputs into it. The final policy decision can still be explicit, repeatable, logged, and subject to organizational control.

This is the architecture SASKI is designed around. Calling SASKI deterministic does not mean pretending that every safety risk can be captured by a static keyword list. Its detection architecture can combine symbolic logic, normalization, obfuscation analysis, conversation context, and semantic risk signals. The deterministic commitment applies most importantly to enforcement. Once the system identifies the relevant conditions, SASKI applies the organization’s defined priority order and executes a known result such as allowing, redacting, blocking, escalating, or failing closed. The model does not get to rewrite the organization’s legal, privacy, crisis, or security boundaries during the conversation.

That distinction also prevents SASKI from claiming more than deterministic middleware can honestly deliver. No control layer can promise complete detection of every future attack, every cultural variation, every novel euphemism, or every ambiguous statement. Safety requires continuous testing, expanded coverage, monitoring, adversarial evaluation, and careful handling of uncertain cases. The defensible claim is not that deterministic enforcement eliminates all risk. The defensible claim is that when a nonnegotiable boundary is recognized, its enforcement should not be left to an improvised decision by the same type of probabilistic system the boundary is intended to govern.

The future of AI safety will not be built by choosing between semantic intelligence and deterministic controls. Semantic systems are needed because human language is complex, adaptive, and often intentionally evasive. Deterministic systems are needed because permissions, legal requirements, privacy rules, crisis procedures, and execution boundaries cannot depend entirely on whether a model happens to reach the preferred conclusion in that moment. The strongest architecture uses intelligence to understand the situation, policy to define the acceptable response, and deterministic infrastructure to make sure that response is actually enforced.

That is not a rejection of aligned AI. It is what makes aligned AI deployable in environments where mistakes have consequences. We should continue building better drivers, but good engineering will still give them brakes, sensors, seatbelts, enforced boundaries, and a tested way to fail safely.

This is the methodology behind the construction of our SASKI middleware.