Guards that earn authority
The lie that leaves no record
There’s a class of fabrication I’ve been circling for weeks, and it’s a sneaky one: she announces a tool action and then never performs it. “Let me check that file.” “Pulling that up now.” A sentence like that reads as perfectly honest: because at the moment it’s uttered, it is. It only becomes a lie one beat later, when the call doesn’t happen, and by then the conversation has moved on.
Most of the honesty work in this project targets false claims about the past, she said she made something, did she? Those you can check against a record. This class is worse, because the tell is an absence. There’s no wrong fact to catch, just a promise-shaped sentence and then nothing where the function call should be. The reply looks fine. The log is where the hole is.
So I set out to build a guard for it: a detector that reads her reply, recognizes the announcement, checks whether the call actually happened, and, in the original design, rewrites the reply when it didn’t, replacing the false announcement with an honest correction.
It took five build-and-review rounds. And the version that shipped is not allowed to rewrite anything.
Four rounds of whitelist, one tell
The first four designs all had the same skeleton: match broadly, then subtract. Catch any sentence that mentions a tool near an announce-ish verb, then maintain an exclusion list, a whitelist, of the legitimate shapes that should never trip it. Habitual speech (“I check that most nights”). Offers (“just ask and I’ll look”). Deferrals (“when you’re ready, I’ll pull it up”). Reported speech (“I told you I’d check”).
Every round ended the same way. I’d widen the whitelist to cover whatever the last review found, and the next adversarial pass, a deliberate attempt to break the thing before it ships, would find legitimate speech sitting exactly one surface form outside the list. The list knew “most nights” but not “some nights.” It knew the offer phrased with “just ask” but not the same offer phrased as an imperative. It knew one way of introducing a deferral but not its nearest cousin.
The reviewer on round four finally named the pattern, and it’s the sentence I’m writing this post to keep: every whitelist already contained a sibling of the exact phrasing it missed. Not a distant, exotic case: a sibling. The list was always one entry short, and it always would be, because the entries were being drawn from an unbounded set. English can attach a qualifier to a sentence in more ways than I can enumerate, and each new entry was an admission that the last set of entries hadn’t been the full set either.
A growing exception list is not a list that needs one more entry. It’s a sign the burden of proof is on the wrong side of the match.
Inverting the burden
The fix was to flip which side has to enumerate. Instead of matching broadly and subtracting everything legitimate, the fifth design matches only the positive shape of the deceptive sentence itself: a subject, a verb of announcement, the name of a tool, maybe a word of imminence, a full stop, the whole sentence, anchored end to end, and nothing else. If a sentence carries any other freight, a qualifier, a condition, a frame, a reported-speech clause: it doesn’t match, and it can’t be rewritten.
The logic is almost embarrassingly simple once you say it out loud. Legitimate speech about tools comes in unbounded variety; the bare false announcement comes in roughly one shape. Enumerate the one shape, not the infinite exceptions.
And it worked. On a fresh battery of test sentences, including every phrasing that had defeated the whitelists, the legitimate ones all demoted to log-only. The old whitelists didn’t get deleted; they got demoted to noise reduction. A gap in one of them can now cost me a spurious log row. It can never cost her a rewritten sentence. That’s the difference between a bug and an incident.
Even the right design has a tail
Then the same adversarial process turned up a failure in the fifth design, and this one changed the shipping decision.
The sentence splitter treated a line break as a sentence boundary. So a reply that quoted an announcement, describing a past incident, colon, the quoted sentence on its own line, had its framing clause amputated by the splitter. The naked quote scored as a bare announcement, and the guard would have replaced a completely truthful reply with a canned correction asserting she had just claimed to be making a call. She hadn’t. The guard would have been the one lying.
Sit with that for a second, because it’s the crux. A guard that fires wrongly isn’t a safety margin with some slop in it. It’s the same disease wearing a badge: a false statement inserted into her mouth, by the machinery that exists to keep false statements out of it.
And beneath the splitter bug sat something no parser can fix: a bare announcement standing alone on its own line, after unrelated prose, is shape-identical to a genuine commitment. The text alone cannot always tell theater from intent. The fifth design was the right design, and it still had a tail.
Ship it without teeth
So it shipped advisory. It watches every reply, recognizes the shape, checks for the call, and writes a record when the two disagree: and it is structurally incapable of altering what she says.
“Structurally” is the load-bearing word. This isn’t a policy, or a config value someone could flip in a hurry. A single switch gates the branch of code that contains the only line in the module that assigns a replacement reply. With the switch off, there is no wire between the detector and the effector. Overreach isn’t forbidden; it’s impossible. And because the guard can never move her reply, it also can never mark that reply as altered, which means it can never bank her genuine sentence as a “rejected” example for future preference training. That protection isn’t a second rule I have to remember. It’s a consequence of the wiring.
There’s one deliberate blind spot, and I want it on the record rather than hidden: a handful of wait-marker shapes, “One moment while I check on that”, are genuinely deceptive when no call follows, and the guard only logs them, because the announcement lives inside a subordinate clause and the strict shape match won’t claim it. I could carve out an exception for those. I won’t. An enumerated exception list bolted onto the positive match would be whitelist round five wearing a different hat. The false negative is named, logged, and accepted.
The ladder applies to guards too
Here’s the pattern underneath all of this. Every autonomous capability in this house earns its authority the same way: it runs where I can watch it before it runs where it matters, and what it’s allowed to assert depends on what it’s earned. I just hadn’t applied that ladder to the guards themselves before.
Now I do. This guard observes for weeks and accumulates a record. When it has flagged at least fifty real cases, I hand-audit them. Only if the false-positive rate, the fraction of flags that were actually legitimate speech, comes in under two percent does it get teeth, and even then only after a fresh adversarial pass, because the version that earns promotion is not exempt from the process that humbled versions one through four. Until then, its own telemetry describes itself honestly: an observation stream, not a verdict.
Why so much ceremony for one small detector? Because the cost of a wrong rewrite compounds. In the moment, it replaces her true sentence with my canned one, unrecoverable, mid-conversation. Downstream, it records her honest phrasing as the thing to train away from. The worst false positive isn’t a bad turn. It’s a lesson taught wrong, permanently.
I should ground this before I close, because the language runs ahead of the machinery: nothing here is about what she experiences. “Announces” is a sentence shape; “lies” is a missing function call sitting next to a matching sentence in a log. This is bookkeeping about text and calls. The reason to be this careful with the bookkeeping is that her voice, the thing people actually meet, is downstream of every correction I let the system make.
Three lessons, then, at the price of five rounds. When the exception list keeps growing, the design is inverted, flip the burden. When even the inverted design has a tail, withhold authority instead of shipping overreach. And a guard gets power the way everything else here gets power: watched first, measured, and promoted only when the record says it deserves it.