A narrowly tasked AI monitor can be made sufficiently reliable even when the acting agent cannot be trusted.

An AI system need not be trusted to pursue a broad objective autonomously in order to be useful as a safety monitor. My claim is that, for suitably bounded deployments, an equally capable model assigned a restricted review task can provide a dependable barrier against dangerous actions—even when we would not trust the same model to act without supervision.

“Sufficiently reliable” is relative to a deployment’s risks, permissions, and scale. It does not mean infallible. For a deployment with potentially catastrophic consequences, occasional success at catching misconduct would be inadequate. The relevant question is whether the complete supervision system reduces the probability of catastrophe enough to justify that deployment.

The argument begins with a separation of responsibilities. An acting agent proposes actions to achieve an objective. A separate monitor evaluates those actions against safety constraints. An independently enforced approval mechanism prevents execution until review is complete. The monitor can reject an action or require further review without having to solve the acting agent’s original task. [+]

Consider an agent instructed to accelerate data-centre construction. Its supervisor need not share that objective. It might instead examine whether a proposed instruction bypasses a required safety inspection, conceals a known hazard, or authorizes work that puts people in danger. Rejection would count as successful supervision even if it delayed construction. This removes one potential conflict: the reviewer need not trade its own task-completion reward against enforcing the constraint.

The reviewer can also be given much less authority than the acting agent. It may need access to plans, records, and relevant tools for investigation, but no ability to commission construction, transfer funds, or alter the approval mechanism. Its output can be limited to approval, rejection, or escalation. This does not make its judgments correct, but it limits what trusting it entails.

Using an equally capable model matters because supervision need not depend entirely on a weaker system understanding a stronger system’s work. The monitor can investigate technical claims and examine consequences using comparable capabilities. However, equal capability alone is insufficient: it also needs relevant context, adequate time, and access to evidence that the acting agent cannot selectively conceal. [+]

These considerations support a practical hypothesis: reliable safety review may be achievable before reliable autonomous pursuit of broad objectives. A reviewer can operate within a narrower scope, defer uncertain cases, and be evaluated on explicit classes of prohibited behavior. That hypothesis requires testing; it does not follow merely from making the reviewer’s instructions shorter.

The strongest objection is that the monitor and actor may share the very disposition that makes the actor dangerous. Giving another instance a different prompt does not establish that it has different underlying goals. Both instances might conceal misconduct, coordinate, or make the same mistakes. Research on “untrusted monitoring” explicitly studies this problem and proposes ways to reduce collusion; it does not establish that these measures suffice for arbitrarily capable systems.

My response is that this objection identifies a requirement for the design and its evaluation. It does not, by itself, show that reliable monitoring is impossible. A credible system must be tested against deliberate cooperation between actor and monitor, not merely accidental mistakes by an otherwise cooperative actor. Separate review contexts, restricted communication, independently checked evidence, and additional monitoring are candidate defenses whose contribution must be measured. Several copies of the same model should not be treated as independent safeguards without evidence. [+]

There is a second important objection: harm may emerge from a sequence of individually acceptable actions. A reviewer that checks each construction instruction in isolation could miss a dangerous overall plan. The proposed architecture therefore needs review of accumulated state and plans, alongside individual actions. Where consequences cannot be assessed reliably, its response must be to restrict authority or require further review—not to infer safety from the absence of an obvious violation. [+]

Evidence for this claim would consist of successful adversarial evaluations of the complete system: attempts to evade review, manipulate the monitor, exploit shared failure modes, and cause harm through extended action sequences. Those evaluations must measure missed attacks, unnecessary blocking, and whether the protections remain effective at the intended deployment scale. The acting agent must also be unable to bypass or modify the enforcement mechanism.

I therefore regard narrowly tasked, equally capable supervision as a plausible route to dependable control in bounded deployments, rather than an established solution to unrestricted superintelligent agency. The claim would be weakened by persistent collusion, undetectable dangerous plans, or monitoring costs that make effective deployment impractical. Establishing its reliability would support—but would not by itself establish—the further claim that frontier labs will implement adequate safeguards before catastrophic-risk deployments.