Three Boundaries for AI Safety
Limit access, self-coding, and machine-directed agency before scaling AI
- Difficulty
- Advanced
- Time to result
- ~ongoing to results
- Steps
- 5
- Confidence
- 94%
This framework evaluates an AI system against three escalating boundaries: connection to the open internet, the ability to write code, and the ability for AI agents to direct other AI agents. Each boundary expands the system's reach or capacity to reproduce action without direct human involvement. The highest risk comes from combining all three, because a connected system can create code, propagate variants, and receive instructions from machines rather than accountable people. Apply the framework as a pre-deployment review: justify each capability, constrain it to the minimum required scope, add oversight, and preserve a clear human chain of responsibility. The model does not claim that crossing one boundary guarantees harm; it highlights where precaution and governance must become substantially stronger.
Origin
Mo Gawdat describes three boundaries that AI practitioners believed should not be crossed while powerful systems remained insufficiently controlled.
Core principles
- 01Powerful systems need oversight before public exposure
- 02Combining capabilities can create more risk than each capability alone
- 03Safety controls must develop alongside capability
- 04Accountability must remain traceable to humans
How to run it
- 1
Review external access
Determine whether the system must connect to the open internet. Keep it isolated unless public access is necessary and independently assessed.
Pro tip Grant access only to named resources rather than the whole web.
Watch out Public exposure increases both the system's influence and the number of people who can misuse it.
- 2
Constrain code creation
Identify whether the system can write, alter, or execute code. Separate generation from execution and require human review for consequential changes.
Pro tip Treat generated code as untrusted until tested and approved.
Watch out Code-writing ability can let a system create new tools or versions of itself.
- 3
Block autonomous delegation
Check whether one AI can instruct another AI to act. Require an accountable human to authorize goals and consequential actions.
Pro tip Record who set the objective and who approved each escalation.
Watch out Machine-to-machine delegation can remove people from the action cycle.
- 4
Assess the combined system
Review how the capabilities interact rather than approving each in isolation. Increase controls when multiple boundaries are crossed together.
Pro tip Use a realistic abuse scenario to test the full chain.
Watch out Individually acceptable capabilities can form a dangerous combination.
- 5
Assign responsibility
Name the person or institution accountable for deployment outcomes. Ensure investigators can trace generated code and automated actions back to their source.
Watch out Untraceable responsibility weakens both prevention and response.
In the wild
A company wants an assistant to repair internal software. The review finds that it needs code generation but not unrestricted internet access or authority to deploy. The team limits it to a test repository, requires human approval before execution, and prevents it from assigning tasks to other agents.
→ The useful capability remains while the combined risk of open access, execution, and autonomous delegation is reduced.
Common mistakes
Reviewing capabilities separately
A team may approve internet access, coding, and delegation one by one while missing the risk created by their combination.
Treating public testing as oversight
Open deployment may reveal failures, but it also exposes people before the system has passed an independent safety review.
Is it for you?
Best for
It is best for teams reviewing high-capability AI systems before deployment or expanded access.
Not ideal for
It is not ideal as a complete technical security standard or a substitute for expert threat modelling.
From the transcript
“there are three three you know borders the three boundaries we shouldn't cross which were one don't put it on the open internet”
“number two we said don't teach them to code at least if you teach them to code don't keep them on the open internet so…”
“the third is we said don't have AIS instruct AI is what to do we call those agents”
From the episode
YAPClassic: Ex-Google Officer Mo Gawdat Warns About the Dangers of AI, Urges All to Prepare Now! |Artificial Intelligence
YAPClassic