The Three-Boundary AI Safety Test
Limit AI exposure, self-programming, and machine-to-machine delegation
- Difficulty
- Advanced
- Time to result
- ~ongoing to results
- Steps
- 5
- Confidence
- 96%
The Three-Boundary AI Safety Test evaluates a system against three escalating capability borders. First, determine whether the model is exposed to the open internet, where its behavior can affect or learn from the wider world. Second, determine whether it can write code, especially while connected, because code allows it to create or modify operational capabilities. Third, determine whether AIs can instruct other AIs, forming agent chains in which machines assign work, write code, and act without a human inside the cycle. The framework is most useful as a combination test: each crossed boundary increases the consequences of the others. A deployment that crosses all three demands explicit human approval points, containment, monitoring, and a named accountable owner. If responsibility cannot be located after a failure, the governance design is incomplete.
Origin
Gawdat says AI practitioners had long discussed three borders that should not be crossed, but public deployment, coding capability, and AI agents crossed them.
Core principles
- 01Capability should not reach the open world before safety is established
- 02Code generation raises the stakes when a system can also deploy or replicate
- 03Machine-to-machine delegation can remove humans from the control loop
- 04Combined capabilities create more risk than each capability viewed alone
How to run it
- 1
Audit external access
List every route through which the AI can read from or act on the open internet. Distinguish sandboxed information retrieval from unrestricted action.
Pro tip Draw the system boundary and mark every external connection.
Watch out A chat interface can appear harmless while tools behind it have broad access.
- 2
Audit code capability
Determine whether the system can generate, edit, execute, or deploy code. Treat execution and deployment as higher-risk than text-only suggestions.
Watch out Reviewing generated code does not help if the system can bypass review and execute it directly.
- 3
Audit delegation
Trace whether an AI can assign tasks to another AI or spawn additional agents. Identify where machine-generated instructions become actions.
Pro tip Follow a task end to end rather than reviewing agents separately.
Watch out A chain can remove the human from the cycle even if each component looks bounded.
- 4
Assess the combined exposure
Evaluate how crossed boundaries amplify one another. Prioritize combinations that allow connected systems to write code and delegate its execution.
Pro tip Test the most consequential combined path first.
Watch out Independent low-risk ratings can conceal a high-risk composition.
- 5
Restore oversight and accountability
Insert human approvals, containment, logs, and a named owner before consequential actions. Define who responds if the system causes harm.
Pro tip Require evidence of approval rather than assuming a human was watching.
Watch out If no one is responsible, the system is not governed.
In the wild
Gawdat describes a connected AI that can write code while machines instruct other machines. In that configuration, machines can tell machines to create code that affects the web while humans are absent from the operating cycle.
→ The three boundaries combine into an accountability and control risk.
A reporting assistant can read approved internal data but cannot browse publicly, execute code, or delegate. Its output requires a manager's approval before distribution, so none of the dangerous capability combinations are present.
→ The team preserves utility while keeping consequential actions under human control.
Common mistakes
Reviewing capabilities in isolation
Internet access, coding, and delegation may each look manageable alone but become far more consequential when combined.
Assuming public development is oversight
Visibility does not itself establish safety approval, containment, or accountability.
Leaving responsibility undefined
A system cannot be governed if nobody can say who owns the outcome when something goes wrong.
Is it for you?
Best for
Teams reviewing agentic AI products, internal automations, or public AI services.
Not ideal for
Low-capability offline tools that cannot execute actions, generate code, or contact other systems.
From the transcript
“there are three three you know borders the three boundaries we shouldn't cross”
“one don't put it on the open internet”
“the third is we said don't have AIs instruct AIs what to do. We call those agents.”
From the episode
Mo Gawdat: Ex-Google Officer Warns About the Dangers of AI, Urges All to Prepare Now!
Mo Gawdat