What makes an AI system truly safe in practice?

The paper ends on a definition, and the definition changes what counts as a safety result. "A safer AI system is not one that never errs. It is one whose errors remain visible, contestable, containable, and recoverable. That is the operational standard that matters now." The standard names four conditions, and none of them is a property of a single model output. They are properties of the system around the model: whether someone can see the error, whether they can challenge it, whether it can be kept from spreading, and whether the damage can be undone.

That is the shift the abstract announces. The central safety question is "not only whether a model emits a harmful response, but whether the broader socio-technical system preserves the conditions under which errors remain visible, contestable, containable, and recoverable." Read as a critique, this says that safety work aimed only at model behavior will miss some of the most consequential risks, because those risks live in the conditions, not the output.

Two consequences follow. First, an error rate is the wrong headline number when the four conditions are weak: a system with few errors and no way to contest or recover from them can be worse than one with more errors and a working path back. Second, the standard sits beside prevention-focused work, not against it. The paper says explicitly that its claim "does not reject existing safety work"; it adds a layer that prevention cannot supply, because prevention will sometimes fail. A governance paper argues the same about slowing development, which "cannot eliminate the possibility of failure in complex, tightly coupled agentic systems" (Does slowing AI development actually prevent system failures?); it does not cite this standard, and the pairing is the vault's.

Other work in the vault touches the four conditions unevenly. The assignment of each note to a condition below is this vault's reading, not something those papers claim. For the record side, Can external anchoring detect tampering in agentic process logs? proposes a tamper-evident trace so an error can be reconstructed and challenged after the fact. For contestability, Who actually bears the risk when multi-agent workflows fail? notes that a party outside the workflow cannot contest what it cannot observe. For containment, Can memory poisoning compromise decision-making even with authorization layers? reports one pipeline where the error was not prevented and the action was still contained, and How do we stop AI systems once they are already deployed? asks who holds the authority to stop a system already in motion. For recovery, Can multi-agent defenses close attack paths completely? names recovery a key challenge, and a keyword check of six of the vault's defense notes found no mention of it in five. The same posture, bounding what an error can do instead of driving its rate to zero, appears for a single component in Can prompting reduce bias in LLM judges reliably?.

What the excerpt does not give. This is a perspective paper. The standard is argued, not derived from data, and the excerpt names no case where the four conditions held or failed. It also names no measure for any of them, which is the gap How can we measure whether AI errors stay visible and recoverable? carries.