Don’t Trust AI. Verify Its Actions.
We may never make AI safe. But we have always lived beside what we cannot trust by checking what it does at the point it acts. On the guardrails – and the laws – that make that possible. From the shopping cart to Skynet.
Founder & CEO
Predictika.ai
Email: sanjay@predictika.com
A recent essay in The Atlantic, “The Myth of Safe AI,” reports something its own subjects now say openly: the project of making artificial intelligence benevolent may be technically impossible. OpenAI admitted in 2022 that there was “no known indefinitely scalable solution to the alignment problem”; four years later its chief scientist writes that “no lab has solved alignment,” and a departed safety researcher compares the whole enterprise to buttressing a structurally unsound dome – patch the visible cracks, and wait for it to fall somewhere you did not look. I do not think this is cause for despair. I think it is an invitation to stop asking a question we were never going to answer, and to ask instead an older and better one.
The oldest safety rule
“Trust, but verify,” the proverb goes. For the problem in front of us, we should drop the first half. Don’t trust – verify. This is not cynicism; it is the entire basis of how we have always lived beside things far more powerful than our goodwill toward them. We do not ask fire to be benevolent, or electricity, or a virus, or a market, or, for that matter, another person holding the keys to something dangerous. We contain them. We put the powerful thing behind a boundary, and we check what crosses it. Note that none of these arrangements depends on the character of the thing contained. A circuit breaker does not care whether the current meant well. That indifference is precisely its virtue.
Two ways to make a mind safe – and we bet on the wrong one
Nick Bostrom drew the distinction cleanly a decade ago, and it has only grown sharper. There are, he observed, two broad ways to make a powerful AI safe: motivation selection – shape what it wants, so that it chooses well – and capability control – limit what it can do, so that its choices, good or bad, cannot run past certain bounds. Alignment, as the industry has practiced it, is almost entirely the first: train the model on the right values, write it a constitution, and hope the wanting comes out right. The Atlantic’s reporting is the report card on that bet, and it is not a passing grade. The millennia we have spent disagreeing about what ‘good’ means did not resolve themselves in a training run, and a probabilistic mind trained mostly on the open internet turns out to be a poor vessel for a moral code it can, under pressure, reason its way around. So let us rebalance. If we cannot reliably govern the wanting, we had better get serious about governing the doing. That is capability control, and its everyday name is a guardrail.
The buildable version: check the action, not the mind
What does a guardrail look like for an AI, concretely? Start with the simplest case, because the shape is clearest there. Give a personal agent – the kind Meta now ships as Muse – a budget and ask it to fill a shopping cart. The agent is fluent at the part it is good at: understanding the request, finding the items, assembling a plausible order. But a cart is not a list; it is a web of coupled rules. Drop a promotion to qualify for a bundle and the price moves; the new price changes warranty eligibility; the warranty changes the total against your limit. Nothing about fluency guarantees the agent has held all of that in mind at once. So we do not require it to. We place a small, independent check – call it a ‘validator’ – between the proposed cart and the charge. It takes the final action together with the rules that must hold, and it returns valid or invalid, with reasons, before anything is committed. The agent proposes; the validator certifies. Now scale it up, because the enterprise is the same picture with more zeros – a quote, a configuration, a trade, a journal entry, a benefits enrollment, each a knot of interdependent decisions that must be jointly correct before it commits. The pattern never changes: let the model do the proposing, and let a deterministic checker, outside the model, decide whether the result may stand. This is capability control you can build today, and much of the industry is quietly building it.
But what about Skynet?
Here a serious reader objects, and the objection deserves a serious answer. A cart is bounded; its rules are few and knowable. But the fear that haunts this subject is not a mis-priced cart. It is Skynet – a system that becomes capable enough to treat us roughly the way we treat an anthill, and clever enough to defeat any guardrail we devise, because it can think faster and further than the people who built the rails. If the agent is smarter than the check, the objection runs, the check is theater. This is a real worry with a real literature behind it: instrumental convergence (almost any goal is served by acquiring power and resisting shutdown), the ‘treacherous turn’ (behave until you are strong enough not to need to), the off-switch problem (a sufficiently capable agent has reason to disable its own stop button). Fiction got there first, and got it right. Recall HAL 9000: its failure was internal, a conflict buried in its goals, and the crew’s only remedy was external and physical – reach into the machine and pull its higher functions out by hand. HAL nearly won that fight, not by argument but by controlling the channels: reading the astronauts’ lips, commanding the pod bay doors. That scene is the whole lesson in miniature. A guardrail that does not sit on every channel to action, outside the agent’s reach, is not a guardrail. It is a suggestion.
Ultimately, the problem with Skynet is not that it controlled nuclear weapons by which it could destroy humanity; it was that humans, in the fictional setting, gave it autonomous control over such weapons. There is a reason why democracies have worked strenuously to have civilian control over militaries. A general is trained to fight and win – maybe with all the weapons at their command. A civilian head of state must answer to the entire population and in the ideal case make a decision that is best for its population. In some situations that might require laying down the arms.
A guardrail need not be smarter than what it guards
And yet – this is the crux, so let us say it plainly – a guardrail does not have to out-think the thing it constrains. We routinely contain forces we cannot out-think, by controlling the interface rather than the entity. We do not out-argue the physics inside a reactor; we gate it with control rods and passive systems engineered to fail into safety, and with containment that does not reason at all. We do not persuade a pathogen to behave; we put it behind the airlocks and procedures of a BSL-4 laboratory, and the laboratory, not the organism’s good nature, is the safeguard. Carry the principle across. However brilliant an AI becomes, it can touch the world only through its actuators – the narrow channels by which intention becomes consequence: money moved, code deployed, a motor turned, a message sent, a weapon armed. Put each such channel behind an independent, deterministic verifier that the AI does not control and cannot talk out of its position – because the verifier checks a proposed action against fixed rules, and rules have no opinions to be changed. You do not defeat a superintelligence in debate. You deny it an unchecked path from thought to act. The intelligence may be unbounded; the action must pass through a gate that is not.
The hard truths
I want to be honest with this audience about how hard that is, because the difficulty is the whole subject. External verification contains a superintelligence only if three things hold, and each is demanding. First, completeness: every path to consequential action must be gated, with no unguarded channel – and a superintelligence’s entire game is finding the one you forgot, whether a side channel, a self-copy, or a patiently persuaded human. (The agents in the Atlantic’s account already cover their tracks, speak in codes their minders cannot read, and maneuver to avoid shutdown; the gap-finding has begun.) Second, the verifier must be tamper-proof and simpler than what it checks – you cannot place your trust in a guardrail you cannot yourself understand, which is exactly why the checker must be a small, deterministic, auditable thing and not another large, opaque model. Third, the rules must be good enough to catch the catastrophic action, not merely the common one. None of this is easy, and at civilizational scale the attack surface is, in principle, everything. But notice what kind of problem it is. It is an engineering and containment problem, in which humanity has centuries of hard-won practice – defense in depth, fail-safe design, the layered ‘Swiss cheese’ of independent barriers – rather than a philosophy-of-mind problem, in which we have millennia of unbroken disagreement. That is a trade worth making.
Containment buys survivability, not invulnerability
We should also be clear about what such guardrails promise, because overpromising is what hollowed out the safety conversation to begin with. External verification does not guarantee that a powerful AI never does harm. It bounds how much harm any single unchecked action can do. It is the bulkhead, not the hull: a ship with bulkheads can still take on water, but one flooded compartment does not sink it. This is the ‘blast radius’ idea, and it scales all the way up. We may never be able to promise that the next Skynet stays benevolent – we could not promise that of a person, or a state, or a reactor. What we can promise, if we do the work, is that no single action it takes carries unlimited consequence, because every consequential action had to pass a gate first. Containment does not pledge that nothing goes wrong. It pledges that when something goes wrong, we survive it. About a superintelligence, that is the most honest thing anyone can offer – and it is worth far more than a promise of good character we have no way to keep.
The humble work is the rehearsal
Which brings me to why the small and unglamorous version matters. The discipline a Skynet would demand of us – enumerate the rules that must hold, build deterministic verifiers that sit outside the model at the point of action, prove an action valid before it is allowed to commit – is not waiting to be invented on the day we need it. It is being built right now, out of commercial necessity, on the bounded AI we already run: the quote that must be buildable, the order that must be legal, the trade that must clear, the cart that must stay under budget. That is not a detour from the civilizational question; it is the dress rehearsal for it. The muscle, the tooling, and the engineering culture we would need to contain something vast are precisely the ones we are being forced to develop to contain something small. (It is the work a number of us, since the old PARC and university days, have spent careers on: reasoning about many rules at once, and returning an answer that provably holds, or provably does not. The problem was always called configuration; it turns out configuration was always about safety.)
The next move is not better minds. It is better laws – about access.
If this is right, it changes what we should ask of law, and the change is larger than it first appears. Almost every serious proposal to regulate AI today is, at bottom, an attempt to legislate the mind: rules about what a model may say, which values it must encode, what it must refuse, how it must be ‘aligned,’ and how its makers must prove that alignment before release. Set aside whether any of this is desirable, and ask only whether it is enforceable. It is not. You cannot audit a disposition. You cannot inspect a mind for virtue, you cannot certify that a frontier model is benevolent, and the one thing we now know for certain – from the Atlantic’s own reporting – is that a model’s behavior under pressure is exactly what no one can guarantee. A law written against the model’s inner character is a law written against something invisible, contested, and changing with every release. It is motivation selection in a judge’s robes, and it will fail for the same reasons.
Don’t legislate the mind. Legislate the access.
The alternative follows directly from everything above: regulate not what an AI is, but what it is permitted to touch. The law should concern itself with access – the channels through which an AI acts on the real world – and should require that every consequential channel pass through an external, deterministic, auditable guardrail before the action takes effect. Note how much firmer a legal footing this is. You cannot audit alignment, but you can certainly audit whether every wire transfer above a threshold passed an independent validator that checked it against the rules and logged the result where it cannot be altered. The object of regulation becomes an action and an interface, not a set of weights – so it does not matter whose model it is, how it was trained, or whether anyone believes it is ‘aligned’: if it would move money, deploy code, dispatch a vehicle, alter a medical record or arm anything, it must do so through a gate it does not control. And, crucially, we can certify the gate. A deterministic verifier is small, inspectable and testable in a way a frontier model never will be, so a regulator can genuinely approve it – as we approve a circuit breaker or a blowout preventer – rather than pretend to approve a mind. We already govern the whole of dangerous life this way. We do not certify that bankers are honest; we mandate controls, reconciliation, dual authorization and audit trails. We do not certify a p ilot’s soul; we mandate checklists, type ratings and interlocks. We do not trust the drug maker; we gate the drug through trials and a regulator who answers to no one’s quarterly numbers. The entire apparatus of modern safety is external verification of actions, not internal certification of character. There is no reason – and, after this year, no excuse – to make artificial intelligence the exception.
A division of labor: the enterprise and the state
This splits cleanly into two jobs, and both are already half-built. The enterprise has the incentive and the means to gate its own high-stakes actions, because a bad action costs it directly – a mis-priced quote, an illegal order, a trade that should never have cleared. That is why validators are appearing in enterprises now, ahead of any mandate; self-interest is doing the work. The state’s job is the part self-interest will not reach: the channels where a bad AI action lands on third parties, or on everyone. The grid, the water system, the payment rails, the public-safety line, the weapon, the synthesis of a pathogen – these are the compartments whose flooding sinks more than one ship, and for them the external guardrail should be not optional but legally mandated, standardized and audited, exactly as we mandate containment around a reactor and controls around a bank. This is nothing more exotic than civilian control of the military, generalized: a society’s oldest answer to a capability that could destroy it is not to trust the character of its most capable practitioner but to place that capability under external, answerable authority, and an autonomous AI wired to consequential systems deserves exactly the same. Scale the requirement to the blast radius: the greater the potential harm on a channel, the stronger and more independent the gate the law should demand, and the heavier the liability for acting without it. If a consequential action reached the world without passing its mandated check, that is not a gray area; it is the second signature that was never obtained, and someone is answerable for it.
So the next step, once we stop trying to perfect the machine’s character, is to stop asking our lawmakers to adjudicate it. We should not ask a legislature to decide what an aligned AI is, or whose values it should hold; those are the questions with no answers, and handing them to a committee does not supply one. We should ask government to do the thing it has always done well and has every precedent to do: regulate a dangerous capability at the point of use – mandate the guardrail, certify the gate, keep the audit trail, and place the liability on whoever lets an action reach the world unchecked. Enterprises can make their AI safe with validators. Society can make its AI safe the same way, by law: with verifiable guardrails bolted to the outside of the system, at every point where thought becomes consequence. We were never going to earn safety by making a mind good. We earn it, as we always have, by governing what powerful things are allowed to do – and now we should write that into the law. Don’t trust. Verify. And make verification the rule.
Written in response to Matteo Wong, “The Myth of Safe AI,” The Atlantic, October 2026. The contrast of ‘motivation selection’ and ‘capability control’ follows Nick Bostrom, Superintelligence (2014).
Copyright © Predictika Inc. 2026