Our commitment to safety

Safety by design

We do not treat safety as a wrapper around an intelligent system.

Models, agents, data, tools, identities, permissions, workflows, and runtime environments all contribute to system behavior. Controls therefore need to exist across the stack.

We design for safety from the beginning rather than adding it after deployment.

Know what systems can do

Powerful systems need explicit boundaries.

We believe permissions should be deliberate, actions should be attributable, and access should follow the principle of least privilege.

An agent should not receive access simply because the underlying infrastructure makes access possible.

Make behavior observable

You cannot reliably control what you cannot see.

Frontal systems are designed around visibility into requests, model behavior, tool use, actions, failures, and system state. Observability allows teams to investigate incidents, evaluate changes, identify unexpected behavior, and improve systems over time.

Evaluate before you trust

Intelligent systems should earn trust through evidence.

We use evaluations, benchmarks, testing, and continuous monitoring to understand system behavior. Performance is not measured only by whether a model produces a plausible answer; it is measured against the requirements and risks of the system in which it operates.

Evaluation is an ongoing process, not a launch gate.

Keep humans in control

Automation should expand human capability without making human accountability disappear.

For consequential actions, organizations should be able to define approval requirements, intervention points, escalation paths, and operational boundaries.

The right level of human oversight depends on the system and the consequences of failure.

Design for failure

Every intelligent system will encounter unexpected inputs, model failures, unavailable services, corrupted data, and conditions its creators did not anticipate.

We design systems to fail safely, degrade predictably, recover where possible, and leave enough evidence to understand what happened.

Reliability and safety are inseparable.

Protect the foundations

Security is a prerequisite for trustworthy intelligence.

Identity, authentication, authorization, isolation, secrets, data protection, infrastructure security, and supply-chain integrity form part of the safety boundary.

A system cannot be considered safe if its underlying infrastructure cannot be trusted.

Learn continuously

Safety is never finished.

Models change. Threats change. Products change. Real-world usage reveals failure modes that cannot all be predicted in advance.

We expect our controls, evaluations, and practices to evolve as we learn.

Our commitment

We will build intelligent systems that are powerful without being opaque, autonomous without being uncontrolled, and useful without making accountability optional.

We will be honest about limitations, rigorous about evaluation, deliberate about access, and willing to change systems when evidence shows that they need to change.

Intelligence should be powerful. It should also be governable.