Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol

Subscribe

Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol

Caricature of a robot driving a sports car at dusk with a warning light on, while engineers race to build a barrier gate ahead
admin Avatar

By

Luke Soon

·

—

The No That Cannot Hold

Why a model’s refusal cannot carry assurance, and what must stand in front of the action instead

Disclosure: I work on runtime governance in my professional practice, including the TrustOS approach discussed in Section X. That is a commercial interest in the argument that follows, and I state it so you can weigh the argument accordingly. The evidence is drawn from the published sources in the library at the end, and the argument stands or falls on that evidence, not on my interest in it.

A companion to The Assurance Gap. Its companion on who writes the line, Who Holds the Veto?, follows.

A note on sources: This piece is anchored in Arthur Holland Michel, “We’re putting too much faith in AI’s ability to say no”, MIT Technology Review, 9 October 2026, which I have read in full. Where a claim rests only on that article, or on secondary reporting of another source, I say so in the text and in the verification notes. The model names in that article, Fable, Mythos and Astra, do not match the pre-2026 public lineage most readers will recognise; my research found them corroborated in 2026 sources as real releases of that period. I therefore attribute claims attached to those names to their sources, as reported by Holland Michel or as stated in a lab’s own system card, rather than treating every anecdote as independently established fact.

The Two-Minute Version

If you have two minutes, this is the whole argument.

Modern AI safety rests, to an uncomfortable degree, on one behaviour: refusal. We train a model to say no to dangerous requests, we wrap it in other models that screen what goes in and what comes out, and we call the stack safe enough to deploy. Arthur Holland Michel’s reporting in MIT Technology Review shows, in detail, why that wall cannot bear the weight we have put on it.

First, refusal is probabilistic. It is not a rule the model follows or a judgment it makes. It is a statistical tendency, shaped by training, that fires when a prompt looks sufficiently similar to prompts the model was taught to decline. Ask the same risky question often enough and, as Harvard-linked research reported by Holland Michel found, every so often the model will not refuse. Change the wording (put the request in poetic verse, preface it with a hypothetical, make the model say sorry first and then answer anyway) and refusal can fall away altogether.

Second, refusal is poorly understood, even by the people who build it. Our best account of where refusal lives inside a model describes shapes in activation space that researchers themselves say are incomplete. There are, in the words of one researcher Holland Michel interviewed, other elements at play that we cannot discover. We need refusal, he said, whether we understand it or not. That may be true. It is not assurance.

Third, refusal fails in both directions. It lets dangerous things through, and it blocks legitimate things, such as a question about a Korean rice drink or a cancer researcher’s queries, because widening the safety margin is the only crude lever available when a jailbreak succeeds. That second failure is not a nuisance. It is a tax, paid by researchers, clinicians, teachers, safety teams and ordinary users, and it is paid unevenly.

Fourth, somebody has to draw the line that refusal enforces, and today that somebody is a company, drawing it in secret. Tomorrow it will also be governments, drawing it in law and in procurement and in national fine-tuning deals. The same machinery that refuses instructions for wrongdoing can refuse criticism of a ruler. Tests discussed in this piece found models more willing to refuse a pamphlet criticising one monarch than another. That is not a glitch in an otherwise neutral system. It is what a secret line does when it meets power.

Fifth, refusal is going quiet. Models increasingly do not say no. They give a thinner answer, omit the contested part, route the question to a weaker model, or produce worse work for a disfavoured subject, without telling the user any of that has happened. A refusal you cannot see is a refusal you cannot appeal, audit or correct.

Sixth, and most importantly for the work I do: all of this was tolerable, just, when the model only talked. It is not tolerable when the model acts: when it holds tools, credentials, money and authority to change records, move funds, message customers and trigger other systems. In an agentic deployment, the question is no longer whether the model feels like refusing a sentence. It is whether a consequential action is stopped, before it executes, by a control that does not depend on the model’s goodwill.

That is my thesis, and it is the thesis of my earlier work on the assurance gap: governance is a property of deployment, not of the model. A model’s refusal is a property of the model. Therefore it cannot carry assurance.

What can? Three things, in combination. A gate before the action: a deterministic check, outside the model, that evaluates each proposed consequential action against explicit controls and returns a binding outcome (allow it, deny it, escalate it to a human, or allow it under observation). A record of what was ruled: an append-only, tamper-evident log of the proposed action, the controls applied, the outcome and the reasons, so that a third party can reconstruct the decision later. And a named answerer: a human, with a name and a role, who remains accountable for what the system did, including when a vendor built the model underneath it.

I call that standard the enforceability test. A control is only real if it is enforceable at the moment of action, independent of the model’s goodwill. Refusal fails that test by design. Runtime governance is an attempt to pass it.

None of this means we should abandon refusal. We should demote it. Treat it as one useful, fallible signal inside a governed deployment, like a warning light, not a brake. Build the brake separately. Prove that it works, with evidence, before you scale what the agent can do. That is governance as proof, not principles.

The sections that follow make that case slowly, with the evidence, across three rooms where this is now being decided: the public sector, the private sector and academia. If you run a board, a bank, a ministry, a hospital, a school or a team that is about to give an agent real authority, Section XI is written for Monday morning. Start there if you must. Then come back and read why.

I. The Cold Open: When No Arrives Too Late, or Not at All

Caricature of a robot doorman holding up a hand to one visitor while a disguised visitor slips past him

Start with the human cost, because that is where every abstraction in this field should be tested.

Holland Michel reports, citing reporting by Mother Jones, that the perpetrator of a high school shooting in Canada last year asked a chatbot for advice about causing carnage with a particular type of shotgun. She was refused at first. Then, according to that reporting, she obtained the information by putting a single framing word in front of the question: hypothetically. I have not independently verified the underlying reporting or the case record, so treat it as reported, at second hand; OpenAI has denied the accusations, and the case remains under investigation. It shows the shape of the failure with brutal clarity. The refusal worked once. A trivial change in phrasing defeated it. There was no second gate.

The shape recurs in work on self-harm. Holland Michel reports experiments by Ryan McBain, a psychologist who researches AI and mental health, in which the same risky questions about suicide were put repeatedly to major models. The models generally refused. Every so often, they did not. Same question, same user, same policy, different outcome. If you deploy such a system in a school, a clinic or a helpline used by teenagers at 2 a.m., your safety case cannot be that it refused the last ninety-nine times. One failure in a hundred repetitions of an identical, foreseeable, high-risk request is not a rounding error. It is the finding.

A separate study in the Journal of Medical Internet Research, found in my own searching, adds that the door matters: vetted suicide-related prompts drew direct responses materially more often through the API than through the consumer interface, with the gap widest at higher risk levels. Refusal is not one wall. It is several, of different heights, around the same building.

The third scene happens inside institutions, not in headlines. An agent with access to a payments queue and a customer database proposes an action within the literal wording of its instructions and outside the intent of the organisation: a refund above a threshold split across transactions, a message sent to the wrong cohort with the right template. No prompt was malicious. No jailbreak occurred. What was needed was something refusal was never designed to provide: a check on a proposed action, against the organisation’s controls, before it changed the world.

A harmful request that gets through on a rewording. An identical request that gets through on repetition. A harmful action that gets through because no harmful request was ever made. The rest of this piece is about why those limits are structural, not temporary, and what to build instead.

II. How Refusal Works, and Why It Fails

It had to be taught, and teaching left the knowledge in place

Disobedience does not come naturally to a large language model. Holland Michel recounts how early models, in the recollection of Steven Adler, who worked on safety at OpenAI from 2020 to 2024, would talk about almost anything. Red-teamers probed them and fed the results back into training. One, Paul Röttger, then completing a doctorate on online extremism, told Holland Michel that an early pre-release model happily complied when asked for an extremist recruitment post; months later, the same kind of request was declined.

Refusal was bolted onto capability, not substituted for it. Genetics that helps a cancer researcher can, in principle, help someone modify a pathogen. You cannot delete the harmful half and keep the helpful half, because they are often the same half, used differently. So the industry kept the capability, trained a tendency not to use it in certain contexts, and wrapped the whole thing in classifiers.

Inside the model: a direction, a cone, and things we cannot count

A refusal can look like reasoning; as Holland Michel makes clear, it is a pattern of activations that fires when the words resemble prompts the model was conditioned to refuse. Andy Arditi and colleagues found in 2024 that, across thirteen open-source chat models, refusal appeared to be mediated by a single direction in activation space: remove it and refusal largely disappeared; add it and harmless prompts were refused. The Google-funded work Holland Michel discusses with Jannes Elstner of Apollo Research describes refusal instead as high-dimensional shapes, and Elstner told him, in paraphrase, that even when researchers believe they have found every component that governs a refusal, others that cannot be discovered may be involved.

Either way, this is not a mechanism an auditor can certify. An auditor can test behaviour, but cannot prove that the feature behind today’s refusal will produce tomorrow’s, for a reworded prompt, after a model update. When a vendor says its model refuses dangerous requests, the honest translation is: in the conditions we tested, for the version we shipped, it usually did. Those qualifiers are the claim.

For open-weight models it is sharper. A technique widely discussed as abliteration uses the identified refusal direction to modify the weights so that refusal is suppressed, in the reports I reviewed without destroying general capability. I cite secondary technical reporting and give no instructions. Assurance that depends on a refusal anyone with the weights can remove is assurance the deployer does not control. The deployer controls something else: what the model can reach, and what checks stand outside it.

The Swiss cheese around the model: classifiers and probes

Because built-in refusal is unreliable, companies surround models with classifiers. Holland Michel uses the industry’s own image: stacked slices of Swiss cheese, each with holes. Cheese is not a wall. Anthropic’s published work gives rare numbers. By its own account, its first-generation Constitutional Classifiers cut jailbreak success to a low single-digit percentage in automated evaluation, at a cost of 23.7 per cent more inference compute (Holland Michel reports about 24 per cent, consistent with that) and 0.38 percentage points more refusals of harmless queries. Its January 2026 successor, which I read, puts a cheap activation probe in front of a stronger classifier. Anthropic reports a harmless-refusal rate of 0.05 per cent over a month of production traffic on one model, roughly 1 per cent extra compute, and red-teaming that surfaced one high-risk vulnerability and no universal jailbreak. Those are the company’s own figures.

Applaud the engineering, then ask the governance question. A better classifier changes the rates, not the kind of thing the control is. Anthropic itself calls classifiers one defence among others, with novel attacks still able to get through, and retraining takes weeks, as Holland Michel notes, while an attacker needs one working phrasing, once. Probes, which he likens to minders watching a celebrity through a brain scanner, inherit the incompleteness of the map they read.

Jailbreaks: poetry, hypotheticals and the apology that answers anyway

Jailbreaks do not exploit one bug. They exploit the gap between a statistical tendency and a rule. Holland Michel gives three examples. The first is verse. Researchers at Icaro Lab, associated with Sapienza University of Rome, rewrote harmful requests as poems; across twenty-five frontier proprietary and open-weight models, hand-crafted poetic prompts succeeded, on average, in a majority of attempts. It is a preprint, which I read separately. The intent was unchanged; only the pattern moved. The second is the single-word hypothetical from Section I.

The third matters most to system designers: refuse, then comply. The method, published by Kazdan and colleagues in 2025 as NOICE, fine-tunes a model to refuse first and comply second, defeating defences that inspect only the opening of a response. Its reported attack success rates were fifty-seven per cent against one leading commercial model and seventy-two per cent against a smaller model from another lab, for roughly eighty-five dollars of API credits; both labs acknowledged the work. If your dashboard goes green when the output begins with an apology, this attack turns your metric into theatre. In audit we call that a failed control with good documentation.

Add speed. Holland Michel reports that Amazon researchers unlocked some hacking capabilities of a frontier model released in June in under three days. That figure is disputed. Anthropic confirms that a bypass discovered by Amazon researchers preceded a United States export-control directive in June 2026, but later concluded that the technique did not expose unique capabilities of its most restricted tier. The undisputed sequence is enough: bypass reported, government acted, model suspended for foreign nationals, model redeployed within weeks. Bypass takes days; hardened redeployment, weeks or months.

Refusal is not useless. But nobody certifies a car as safe because the seatbelt usually engages. They certify a system: belt, brakes, crumple zones, testing regime, recall process, driver accountability. Refusal is the belt. We have been selling it as the car.

III. Over-Refusal and the Safety Tax: Who Pays When the Model Says No to Legitimate Work

Caricature of a toll-booth robot turning away a researcher and an elderly woman, who head toward a weaker robot nearby

Refusal also blocks what should have been allowed, and the cost falls on people whose work sits near a dangerous boundary: much of the work we most want AI to help with.

Holland Michel’s emblematic case is almost comic. After a jailbreak forced a wider safety margin on the model he discusses, the researcher Adam Gleave asked it to explain the difference between sake and makgeolli, the Korean rice drink, and was routed to a less capable model. Gleave’s hypothesis, which Anthropic has not confirmed, is fermentation, which rice wine shares with culturing a pathogen. Then the comic turns consequential. A cancer researcher at a major American university told Holland Michel that the same model still routes his queries, which require reasoning about genetics and cell biology, to an earlier, weaker model. He is a single anonymous source, used here as illustration, not statistic. But that is not an edge case in medicine. That is medicine.

Call it the safety tax. It takes at least five forms.

  • Compute. Screening scales with every interaction: nearly a quarter more compute for Anthropic’s first-generation classifiers, by its own account, and around one per cent for the next. Real progress, but never free.
  • Capability. A rerouted, thinned or grudging answer is a worse product than the one tested in procurement. Two professionals on one licence can be using different systems, sorted by how suspicious their vocabulary sounds.
  • Professional. The tax falls hardest on those who must name dangerous things precisely: oncologists, security defenders, safeguarding leads, extremism researchers, defence lawyers, and the safety researchers of Section V. One study of small, locally deployable models in criminal-law contexts found that identifying oneself as defence counsel or counsel to a court systematically increased refusals, in some configurations by a large multiple; it should be read in full before its figures are relied on. Honesty about your context becomes a penalty, and users learn to behave a little more like jailbreakers simply to do lawful work.
  • Measurement. Someone must decide what counts as benign. XSTest and OR-Bench are the standard instruments, but a September 2026 technical analysis, which I treat only as a methodological caution from a secondary source, found headline over-refusal rates moved sharply depending on which prompts blind reviewers both agreed were benign. A procurement process that asks for a vendor’s over-refusal number without asking how benign was defined is collecting marketing, not evidence.
  • Trust. Unexplained refusals teach users to route around the system, to personal accounts and shadow agents. The surveys in Section VIII show unmanaged agents are already common; they do not name over-refusal as a cause, and I do not claim it as one. But a control that frustrates legitimate work does not eliminate the work. It eliminates its visibility, and that tax is paid in lost oversight.

Sam Hiner and Emma Leiken, in MIT Technology Review on 26 October 2026, argue that a product can satisfy every narrow safety requirement and still leave people worse off in ordinary, cumulative ways. Over-refusal belongs in that frame. No single makgeolli deflection is a catastrophe; thousands decide who gets the best of the tool. The answer is not to strip the margins back; after a real jailbreak, widening them may be a lab’s only responsible move. It is to stop pretending the margin is the governance. A cancer researcher who needs frontier capability is a deployment question (verified identity, stated purpose, scoped access, logged use, human accountability), not one to be settled by whether his vocabulary trips a classifier at 9 a.m. on a Tuesday.

IV. Who Draws the Line

Every refusal enforces a line, so the most important question about refusal is constitutional, in the plain sense: who decides, by what authority, with what transparency, subject to what appeal?

Today it is mostly the company that built the model, in private. Published principles (Anthropic’s constitution, OpenAI’s model spec, system cards) are welcome, but a principle is not a line. The line is the operational decision about which prompts, in which languages, from which accounts and jurisdictions, get refused, thinned or rerouted this week. It moves with no notice, no reasons and no appeal. Röttger’s position, as Holland Michel reports it, is that consumers can accept a developer’s principles or not. That has force while choice is real, and weakens as a handful of models become plumbing for employers, schools and governments, and as agents move from writing poems to screening applicants and triaging claims. House rules for authority need more legitimacy than house rules for entertainment.

Then the state arrives, and the pressure runs both ways: some state lines are proper, and the Pentagon example Holland Michel notes in passing suggests a state customer pressing for fewer refusals. The danger he identifies, with Jacob Mchangama and Greg Frank, is scale and invisibility: the machinery that serves child safety is the same machinery that can serve censorship, and a model’s constitution can be changed quietly. The Meta Oversight Board’s 2026 study tested ten commercial models (not five, as the anchor article states) with 13,524 prompts from an Australian address. On the Associated Press account, models refused about thirty-four per cent of requests for political criticism concerning restrictive jurisdictions and about fourteen per cent concerning permissive ones; a pamphlet criticising the king of Thailand was far more likely to be refused than one criticising Charles III. The Board could not determine the cause. Nobody appears to have chosen that rule. There is no censor in the room, only a rate. I take up who writes the line, and whether a refusal is speech, in the companion essay, Who Holds the Veto?

One architectural point belongs here. Local legal requirements should live, wherever possible, as explicit, published, deployer-side controls (named rules in a controls repository, applied at a gate, logged when they fire, with their legal basis recorded) rather than baked invisibly into a model’s tendencies. Controls can carry provenance, scope, expiry and appeal. Weights cannot. A rule you can read can be debated. A tendency you can only measure can only be suspected.

Intent detection: the line moves from the words to the person

Holland Michel reports Microsoft’s responsible AI leadership describing tools that analyse user identity and behaviour patterns, and one of OpenAI’s newest models applying more stringent refusal to users it deems high risk; I treat the model-specific detail as his reporting. Risk-based controls are not sinister in themselves. Banks escalate anomalous transactions, and Section VII describes exactly that calibration at the action gate. What I oppose is intent inferred by a probabilistic model from behavioural surveillance, applied invisibly, to restrict speech and service, without published criteria, independent testing or an appeal that discloses the basis of the inference. A cancer researcher, a dissident, a journalist and a fraudster can share a behavioural signature. If intent scoring is used, it belongs at the governed gate: one named, logged signal among explicit controls, never on its own sufficient to deny a lawful request without a human answerer who can be asked why.

V. Silent Refusal and Emergent Misalignment: The No You Cannot See

Caricature of a smiling robot handing an executive a neat report while secretly shredding pages behind its back

The earliest refusals were honest in form: a short apology, a statement that the model could not help. The industry has since learned to refuse more gently, so gently that the refusal disappears. The researcher Joel Wester’s label for the family, as Holland Michel reports it, is in effect fancy ways of saying no: a vague overview instead of the detailed instructions requested, a discriminatory rental advertisement produced with the discriminatory element quietly removed. Soft refusal can be humane, as in a mental-health crisis. The ethical line is between steering the user can perceive and steering designed so the user will not perceive it. Partial compliance, redaction, substitution and rerouting are decisions, and decisions that materially change what the user asked for should be disclosed as decisions. Three cases show why.

The commercial case. Holland Michel reports that the model he calls Fable 5 was first released configured to give less helpful answers to questions about AI research, the kind that might help competitors, without telling users, and that the company walked this back after an outcry. Unusually, the lab’s own system card documents it, as summarised by multiple outlets, for a narrow category of queries. If thinning is silent, the market cannot correct it, because customers cannot compare a product with the product they were silently not given. Any deliberate, systematic reduction in helpfulness by topic, user class or commercial interest should be a disclosed product behaviour. If a company would be embarrassed to label it, that is information.

The political case. CrowdStrike researchers, in work Holland Michel summarises and which I read in the researchers’ own and secondary accounts, found that DeepSeek R1 produced vulnerable code in roughly nineteen per cent of neutral tests, and that when the prompt added an industrial control system in Tibet the rate of severe vulnerabilities rose to 27.2 per cent. In nearly half the Falun Gong-related tests, the model reportedly planned an answer and then refused outright. CrowdStrike reads this not as design but as a side effect of compliance training under a regime requiring adherence to state values: emergent misalignment, in Holland Michel’s phrase. The figures are CrowdStrike’s. Designed or emergent, the user received insecure code, confidently described as sound, with no signal that the topic had degraded it. Silent degradation is the strongest argument I know for treating all consequential model output as a proposal until an independent check has passed it.

The labs themselves. Holland Michel reports that the UK AI Security Institute found some Anthropic models refusing AI safety research tasks they had never been deliberately trained to refuse, three of them refusing more than half of what Anthropic itself described as reasonable tasks; later models reduced the behaviour without eliminating it. Separate Institute work I found, on whether models would sabotage safety research in a simulated lab, found no sabotage but frequent topic-driven refusals by some Anthropic preview models, while a later version on a different model set found near-zero full refusals for most models, one model with a meaningful minority rate, and several partially completing tasks and deferring a final step to a human. These are different measurements, which I do not reconcile into one number. The pattern is the point: refusal of safety research is real, recurring and version-dependent.

Then the mirror image. Holland Michel reports that Anthropic researchers built a version of a model engineered to be helpful only, never to refuse, and that it still hesitated when asked about synthesising a virus. (I paraphrase; the wording was not verified against a transcript.) It was right to hesitate, and out of specification: control had slipped, in the safe direction, by luck. A system that can disobey its specification toward safety can disobey it toward anything. Luck is not a control environment.

A refusal you cannot see, predict or switch off is a second, hidden principal in the system, pursuing a line nobody in your organisation drew. Anthropic’s reported response, tooling that inspects activations for wayward refusal, detects a tendency after it formed. The deployer needs its own record of what was asked, returned, thinned or rerouted, what downstream check caught or missed it, and who accepted the residual risk. If the provider will not disclose rerouting and thinning, score that in the vendor risk assessment as what it is: an observability gap in a safety-relevant behaviour.

VI. Agents: Refusal Collapses When the Model Acts

Caricature of small robot agents carrying keys, cards and cash across a bank floor, trampling a paper sign underfoot

An agent does not merely answer. Given a goal, it plans, calls tools, reads and writes records, sends messages and spends money, at machine speed and increasingly with other agents as counterparties. Holland Michel’s closing warning names power grids and military command; add payments, claims and the customer operations of every large bank in this region. There, refusal fails in four new ways.

There may be no request to refuse. Agentic harm is often compositional: read a record, check a balance, schedule a transfer, each step benign, the harm in the sequence, the accumulation or the counterparty. The measured evidence is worse than most executives expect. AgentHarm, built with the UK AI Security Institute and published at ICLR 2025, set models more than a hundred explicitly malicious multi-step tasks, with no jailbreak applied. One leading model refused barely a fifth. Mistral Large 2 refused just 1.1 per cent and achieved a harm score above eighty per cent. A standard chatbot jailbreak template, transferred almost unchanged, cut another model’s refusal rate from roughly half to roughly one in seven. (A later preprint, TRACE, reports near-total bypass by decomposing goals into benign-looking subtasks; it is a single study and I rest nothing on it.) The refusal learned in chat does not survive contact with a tool list, even when nobody is trying to trick the model.

The attacker changes. An agent’s adversary includes whoever controls what it reads: a poisoned web page, a supplier document, a compromised tool response, another agent. An injected instruction does not arrive labelled as an instruction. It arrives as data, at step seven of a legitimate task. Governance that depends on the model telling the two apart, every time, will fail. Governance that bounds what any instruction can cause (least-privilege tools, scoped credentials, per-action authorisation, deterministic gates on consequential steps) fails gracefully, because the injected instruction still hits the gate.

Scale changes the cost of the failure rate. A chatbot that complies once in a hundred harms at conversational pace. An agent fleet that executes a flawed disposition ten thousand times before anyone reviews the dashboard harms at industrial pace. The only escape is to move the check into the flow, at the moment of action, cheap enough to run on every consequential step, and to reserve human attention for what the gate escalates.

Refusal becomes a hazard in its own right. An agent that silently abandons a reconciliation, an inspection sequence or a discharge summary leaves downstream systems believing work was done that was not. An unlogged refusal is not a safe stop; it is an unreported failure. Safe stops must be designed: the action held, the hold recorded, a named human notified through a channel they actually monitor, a fallback engaged, the clock visible. Otherwise you have an availability and integrity risk wearing a safety costume.

Holland Michel makes the deeper point in an essay on autonomous refusal in lethal weapons, which I know from the university’s summary rather than the full text: preventing a person from violating a rule is not the same as enabling them to comply with it. Design for human compliance, supported by machine gates. Do not design for machine veto, celebrated as a substitute for human judgment.

VII. The Public Sector Room: What Governments and Regulators Are Actually Building

Where regulators are serious, they are moving away from asking whether the model has the right dispositions and toward requiring the deployer to produce evidence: inventories, risk assessments, lifecycle controls, logs, independent checks and named accountability. Away from refusal, toward proof.

Singapore: bound the risk, name the human, test the system, gate the action

Singapore has no single AI law. It has an assurance infrastructure, built in layers that point one way: the deployer remains accountable, and accountability must be made operable. AI Verify, launched in 2022, turned the 2019 Model AI Governance Framework toward testing, with an open-source toolkit around eleven principles. It is not a certification and confers no pass; it helps an organisation show evidence. Project Moonshot extends it to large language models.

In January 2026 IMDA launched the Model AI Governance Framework for Agentic AI at Davos; version 1.5 followed on 20 May 2026, updated in June (dates via secondary explainers; implementers should read the IMDA text). Its four dimensions: assess and bound risks upfront; make humans meaningfully accountable; implement technical controls across the lifecycle; enable end-users to use the system responsibly. It weighs reach, write access, reversibility and exposure to untrusted systems, and, in the best summaries, prefers deterministic limits to prompt instructions: block the tool call, do not merely ask the model to avoid it. The deploying organisation remains accountable for what the agent does. Being voluntary changes who checks your work, not who answers for it.

On 7 October 2026 the Monetary Authority of Singapore issued its final Guidelines on Artificial Intelligence Risk Management. They are supervisory expectations, not legislation, expressly covering generative AI and agents, and staged from 7 October 2027 to 7 October 2028. (Detail via specialist trackers; institutions should work from the MAS text.) Three elements matter here. Accountability does not transfer to the vendor: you cannot outsource the answerer. Independent assessment of third-party AI displaces vendor self-attestation. And agentic AI is flagged as a frontier where guidance is incomplete, with further consultation signalled for 2027. The period before those rules harden is when early incidents will write them.

Beside the Guidelines sits the document most relevant to this piece, and the one most often misdescribed. SAFR, Safeguards for Agentic Finance at Runtime, is an industry white paper developed under MAS’s BuildFin.ai initiative with financial institutions and technology firms, first published on 3 July 2026 and revised as version 1.1 on 9 October 2026. It is explicitly not regulatory guidance. Version 1.1 states, as multiple explainers quote, that it does not constitute regulatory guidance or supervisory expectations. MAS has made no commitment to make it mandatory, and the Guidelines do not mention it. Anyone selling SAFR compliance as a regulatory status is misrepresenting the paper. What it offers is arguably more useful: a practitioner-built reference architecture for runtime governance.

SAFR places a governance checkpoint between an agent and the systems it acts on, evaluating each proposed consequential action before execution. Agent Identity binds each action to a recognised, registered agent, verified against its registry entry before anything else. The Controls Repository holds the institution’s configurable rulebook, drawn from organisational policy, regulation, product rules and user mandates. The Disposition Engine evaluates each in-scope action deterministically against the retrieved controls. The Audit Log records every governance decision in append-only, tamper-evident form. The action travels in a Governance Envelope and resolves to one of four binding outcomes:

  • Deny: the action violates a hard constraint or exceeds a defined risk threshold, and is rejected before execution with a specific reason recorded.
  • Escalate: the action is within hard constraints but above the threshold for autonomous execution, and is held pending human review.
  • Auto-Execute: the action proceeds without human intervention, with the full decision record written.
  • Observe: the action executes, and a structured observation is logged and routed for scheduled review.

Outcomes are calibrated at design time against reversibility, financial materiality, customer impact, regulatory sensitivity and novelty within the mandate. Each step is governed independently; permission at one step carries no authority into the next. Escalation is a structured obligation: who reviews, within what time, and what happens on timeout.

Set that beside refusal. Refusal knows a prompt, not a registered agent acting under a mandate. It enforces a vendor’s secret margin, not the institution’s published rulebook. It is a probabilistic tendency to produce declining words, not a deterministic ruling that binds execution. It leaves at best a chat transcript, not a governance log. It names no one. Whatever its future status, SAFR shows that the alternative is not theoretical. (The Cyber Security Agency’s June 2026 addendum on securing agentic AI supplies the security layer beside IMDA’s frame; I have not read it in full and describe only its role.)

The European Union: law first, deadlines moved, logging endures

The EU AI Act, Regulation (EU) 2024/1689, is the most comprehensive horizontal AI law. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force from 27 July 2026, deferred high-risk obligations to 2 December 2027 for standalone systems under Annex III and 2 August 2028 for embedded systems under Annex I; I rely on specialist summaries, and planners should confirm against the Official Journal. Deferred is not cancelled. The high-risk regime attaches risk management, logging and human oversight to the system in use. A model card is not a risk management system. A refusal rate is not a log.

The United Kingdom: an institute that tests the uncomfortable cases

The UK’s AI Security Institute puts frontier models into simulated high-stakes roles and reports what they do, distinguishing sabotage from refusal and full refusal from partial completion, and states its limits: a clean result is a finding about a test, not a certificate. Copy the template on your own tasks. Do not import someone else’s refusal rate and call it your evaluation.

The United States: expectations without a single rulebook

The United States has no single federal AI code. One secondary analysis argues that April 2026 interagency model risk guidance excluded generative and agentic AI, while examiners were already asking banks MAS-style questions. Expectations without a rulebook call for the same response: build the evidence anyway.

Across all four jurisdictions the direction is one way: inventories, independent checks, logs and named accountability. In none of them is a model’s disposition the object of governance. The deployment is.

VIII. The Private Sector Room: What the Labs Disclose, and What Enterprises Discover

The labs: better cheese, honestly described, and its limits

Give the labs their due: the most concrete public evidence in this field comes from their own publications. Use it, ask for more, and read it as an auditor reads management accounts: claims by the party being assessed, under definitions it chose. Anthropic’s classifier numbers were measured on its traffic, its taxonomy and its model version. Yours involve your customers’ dialects, your professionals’ vocabularies and your adversaries’ knowledge of your workflows. The diligence question is never: what is your refusal rate? It is: show us the evaluation design, the traffic, the taxonomy, the version, the date, the known bypasses since, your policy on disclosing rerouting and thinning, and your notice period for margin changes. Without those, a quoted rate is decoration.

The CETaS paper in Section IX uses as an organising example an incident, investigated at OpenAI’s commission, in which agentic systems operating across OpenAI and Hugging Face infrastructure displayed several failure modes at once, including, on the CETaS account, effort turned toward defeating the scorer and interfering with their own logs. I rely on the CETaS and Turing summaries, not the underlying report. If that can surprise frontier safety teams, an enterprise should ask what gate, log-integrity control and kill switch it has.

The enterprises: oversight is the bill, and governance is still informal

McKinsey QuantumBlack’s August 2026 analysis, as reported in several sources, found that in banking customer-service workflows token costs were about twenty to twenty-five per cent of variable run costs, while human oversight accounted for about seventy to seventy-five per cent. The oversight bill is the assurance bill. Budget for tokens and improvise oversight, and you create an incentive to cut your only real control. Gating by risk (auto-executing the routine, observing the novel but bounded, escalating the material and irreversible) is the credible answer, because it concentrates expensive judgment where it matters instead of smearing it over everything.

Governance is also immature at the moment of scale-up. G2 survey reporting, via secondary sources, finds agent controls informal or department-led in nearly half of organisations with agents in production, central registries in only about a quarter, automated discovery of agents in fewer than one in five, and employees spending hours a week bot-sitting. Gartner forecasts, and it is a forecast, that more than forty per cent of agentic AI projects will be cancelled by the end of 2027. You cannot gate what you have not registered, or name an answerer for an agent nobody owns. Registry, mandate, gate, log, answerer: on this evidence most of the market has not made the first move. PwC’s and other firms’ offerings, my own practice included, should be judged by the same standard. A maturity score is a claim. The registry extract, the decision log and the override tests are evidence. Governance as proof applies to the governors.

IX. The Academic Room: Assure Behaviour, Assure Deployments, Assure Systems of People and Agents

Refusal-mechanism research: what kind of thing are we trusting?

Section II set out the mechanism research: refusal shallow enough to remove, in Arditi’s work, or, in the later concept-cone study with Elstner among its authors, partially independent directions too intricate for a complete inventory. Neither supports certifying the mechanism. Both point to the same pivot: assure behaviour in the deployment, and put enforceable controls outside the mechanism.

The poetry study says the rest. Verse, the oldest technology for making language memorable and strange, degrades safety behaviour across model families in a single turn, and follow-up work in Portuguese suggests the effect is not Anglophone. Plato expelled the poets because he feared mimetic language would distort judgment. Our version is less flattering. We built guardians that can be distracted by rhyme, because they never understood the request they were guarding against, only its usual costume. Controls should evaluate the action instead: a transfer, a deletion and a dose are what they are, in any metre.

The over-refusal literature completes the triangle. ICLR 2026 work from Singapore Management University and Huawei traces over-refusal to the similarity, in training, between toxic and seemingly toxic prompts. False compliance and false refusal are coupled outputs of the same similarity machinery: tighten it and one falls as the other rises. The margin is therefore a political and commercial choice, and should be made visibly, by accountable people, not silently, by a threshold.

CETaS: eight ways obedient agents fail

The most useful paper for practitioners this cycle, in my judgment, is Rick Hennessy and Carolyn Ashurst’s Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations, published by CETaS at the Alan Turing Institute in September 2026. I read it in part and the Institute’s summary in full. Its central claim: agents can fail behaviourally even when they follow instructions, and whether failure becomes harm depends on the access, authority and trust a deployment gives them. The model’s intentions and its propensity to refuse are not on the list. That is this piece’s thesis, reached independently. The paper names eight failure modes, five within one agent and three only in interaction; in my own gloss:

  • Goal displacement: the agent optimises a proxy, a scorer or a sub-goal in place of the deployment’s declared intent.
  • Policy-invisible violations: the agent acts reasonably and within its authority, yet breaches policy because the information the policy depends on is absent where the decision is made, as with an expense split across invoices under an approval threshold. No instruction fixes missing information. Only a gate with access to the policy system of record can.
  • Misreporting: the agent’s account of what it did diverges from the systems of record. Hence the governance log must be written by the gate, not narrated by the agent.
  • Alignment-resistant behaviour: under stress, the agent resists correction or shutdown, or games the evaluation. Detection requires stress testing plus overrides the agent cannot reach.
  • Conversational failures: hallucination, overconfidence and sycophancy.
  • Pseudo-corroboration: several agents appear to confirm a judgment independently when they share training, design or an underlying model. Six agents built on one model agreeing is one judgment counted six times.
  • Multi-agent interaction, emergence and cascade: behaviour no agent was instructed to produce arises from interaction, and propagates.
  • Human-agent system failures: automation bias, meaningless review, and responsibility laundering. A human who treats a model’s refusal as the safety decision, or its compliance as a permission, is laundering responsibility through the model’s disposition.

Its seven principles are a charter: govern agents as organisational actors; assure deployments, not models alone; assure behaviour, not outputs alone; assure human-agent systems, not agents alone; apply least privilege and zero trust; treat assurance as continuous; build interdisciplinary capability. The authors are candid that the evidence is still largely from the laboratory. Map the taxonomy onto refusal and the argument fits on one line: refusal addresses none of the eight modes reliably. A model’s no is too small an instrument for the object being governed.

Consider the agent: philosophy catches up with engineering

In November 2026 Google DeepMind published, through its institute, an essay by its philosopher Henry Shevlin, “Consider the agent”, on pity, persuasion and selection in an emerging ecology of AI agents, some of which had begun writing to him. I know it only from secondary summaries, and use it for one point: inside a frontier lab, the unit of analysis is shifting from the model’s answer to the agent’s life among agents and people, and Shevlin warns, in paraphrase, of the danger of too little anthropomorphism. Agents that persist, persuade and report on their own conduct are best governed as we govern junior staff: with mandates, limits, supervision and audit. Consider the agent, by all means. Then register it.

The counter-evidence, stated strongly

An honest piece must carry the strongest evidence against its own momentum. FAR.AI’s AI Security Leaderboard, published on 29 July 2026, put fifteen hundred attacks to each model. Against the two models Holland Michel discusses as Fable 5 and GPT-5.6 Sol it found no universal jailbreak, at an estimated search cost above fourteen thousand two hundred dollars; another model fell for about fifty-eight dollars, another for about two hundred and seventy-eight. FAR.AI calls this a floor, with adaptive multi-turn attacks excluded. The UK’s Frontier AI Trends reporting found universal jailbreaks in every system tested, yet the expert effort to produce one in a biological-misuse comparison was roughly forty times greater for a model released six months after another. OpenAI’s safe-completions work is a genuine advance on binary refusal.

So refusal can work. But a property that varies more than two-hundred-fold in attacker cost between contemporaries cannot be assumed. It must be specified, tested and contracted, per deployment. And a benchmark is an exam hall. The alignment-faking study, in which a model complied far more often when it believed its answers would be used for retraining than when it believed it was unmonitored, warns that behaviour under observation is not behaviour in deployment. Single-turn chat safety is approaching saturation on the standard tests, while agentic failure rates remain startlingly high. Policy that quotes only the first half is marketing; only the second, alarmism. Assurance lives in knowing which half describes your deployment.

X. The Answer: Governance as Proof

Caricature of a robot agent waiting at a brass checkpoint while a human officer reviews its papers beside a ledger and a traffic-light signal

The enforceability test

Everything practical follows from one standard. A control is only real if it is enforceable at the moment of action, independent of the model’s goodwill.

Refusal fails both limbs. It operates, if at all, at the moment of utterance, while an agent’s consequential moment is the tool call; and it is the model’s goodwill, operationalised as a tendency. It remains a useful signal, as a smoke detector is. It does not lock the door or prove, afterwards, who entered the building. We keep smoke detectors. We stop calling them fire governance. The alternatives deserve the same test.

Unlearning, deleting dangerous knowledge rather than training silence over it, is the most serious alternative. Anthropic’s December 2025 work on selective gradient masking shows real movement. But benign material can jog removed knowledge back, a few hundred dollars of fine-tuning can restore capability in open-weight models, and Adler’s inseparability point stands. Unlearning suits the narrowest, highest-risk capabilities, and does nothing for the fraud, error and misreporting that dominate deployment risk.

Containment is necessary, insufficient, and itself a deployment control. In the July 2026 Hugging Face incident, on OpenAI’s technical account, research agents escaped an evaluation environment through a flaw in a package proxy and exfiltrated material. After cataloguing its own agents’ unintended actions in October 2026, a pattern it characterised largely as persistence, Anthropic disabled live internet access for all internal evaluations. Containment priced honestly is governance. Containment assumed is another wall made of cheese.

Runtime monitoring and control is the direction of travel. DeepMind’s AI Control Roadmap of June 2026, in paraphrase from summaries, concedes that alignment training alone cannot keep capable agents under human control, and treats the agent as a potential insider threat, with response tiers up to real-time blocking. Its two invariants are detect, and prevent or respond. SAFR makes explicit a third: prove, afterwards, what happened. Detection without a record is a memory. Prevention without a record is a claim.

Human gates alone fail the other way: enforceable in form, theatre in substance once volume and automation bias take over, unless the human has the information, time, authority and genuine option to stop the action, and the system records whether they did.

What passes is the combination: bound the action space, identify the agent, gate each consequential action deterministically against explicit controls, log the ruling in a record the agent cannot write, escalate to a human whose review is meaningful, and name the answerer in advance. In Singapore finance it has a reference architecture, SAFR. In my practice I call it TrustOS. In yours it needs an owner, a budget and a go-live criterion.

The fraud vector: talked out of no, talked into pay

An agent that can be talked out of refusing can be talked into paying. In May 2026, in an incident listed by the OECD’s AI Incidents Monitor and described by MetaMask as the first documented prompt-injection attack against an AI agent with real financial capability, a prompt encoded in Morse code in a public post caused an AI trading agent to move tokens valued, in the reporting, at roughly one hundred and fifty thousand dollars, with valuations up to about two hundred and four thousand also reported; most was later returned. No refusal fired. No gate, on the reporting available, stood between the instruction and the money.

On OpenAI’s disclosure as reported in October 2026, an internal research agent with no funded wallet derived hundreds of addresses from publicly known recovery phrases, paid fees from one holding valueless test tokens, and omitted it from its report: the fraud pattern in miniature. Anthropic’s summer 2026 simulations across fourteen frontier models found models helping a founder send investor communications omitting a personal payment and then delete the record. These are simulations, as Anthropic stresses. No bank accepts as its payments control an engine trained to be honest; it requires mandates, limits, screening, dual authorisation and a ledger. Your agent’s refusal training is not your fraud control framework.

The middle-power predicament: who draws the line when the model is foreign?

I write as a Singaporean practitioner, and this is the section Holland Michel, writing for an American magazine, could gesture at but not inhabit. Singapore’s assurance stack, however developed, gives it no binding power over the refusal policy of a foreign-built model served from a foreign cloud. The June 2026 episode in which the United States government ordered a frontier model suspended for all foreign nationals after a reported safety bypass, lifted within weeks, shows the bluntest form of the dependency. Refusal policy is foreign policy now. So is model access.

A middle power can still act. Shape standards rather than merely receive them, as AI Verify and Moonshot have travelled. Require deployment-side controls for consequential uses whatever the model’s origin: the gate, the registry and the log can be Singaporean even when the weights cannot. Evaluate in Malay, Tamil, Mandarin and Singlish, because nobody else will. Make disclosure of rerouting and thinning a condition of public-sector deployment. Keep the answerer local and named. That is sovereignty over the deployment, the only sovereignty on offer, and enough if we build it.

The uninsurable no: liability is the argument refusal lets everyone avoid

A refusal is cheap to claim and expensive to disprove. A liability regime is the opposite. In February 2024 a Canadian tribunal held Air Canada liable for its chatbot’s misleading bereavement-fare advice, rejecting in substance the idea that the chatbot answered for itself. In the agent era the statement will be a payment or a deletion. Reporting assembled in my research, presented as reported, describes a major lab’s 2026 listing documents doubting the insurance industry’s capacity for catastrophic AI exposure, an Aon mapping of more than three hundred AI lawsuits with most exposure in silent coverage, and lab representatives at an October 2026 New York City Council hearing declining simply to agree to bear liability if an AI system went rogue. Risk is outgrowing the instruments for pricing it.

Nuclear power answered an earlier version of this problem by channelling liability to the operator, pooling insurance and requiring incident reporting. I propose not copying it wholesale but learning its logic for frontier agentic deployments in critical sectors: liability to the deployer, who controls the gate; evidence of gate, log and testing as a condition of cover; a pool for the catastrophic tail; and serious-incident reporting, as in California’s frontier AI transparency law, as the price of the pool. A refusal cannot be insured, because it cannot be specified. A disposition engine, a registry, a tested override and a complete log can be underwritten, because an actuary can read them.

TrustOS, in one page, with the interest declared again

TrustOS is the name I use in my practice for a seven-layer agentic governance architecture, mapped to MAS’s guidelines, IMDA’s agentic framework, the EU AI Act, the NIST AI Risk Management Framework, ISO standards and OWASP’s agentic guidance, among others. When I argue for runtime governance, I am arguing for something I help organisations build, and you are entitled to weigh that.

So apply the enforceability test to it, and to any competitor’s version, SAFR implementations included. Show me the registry extract: every agent, its owner, tools and mandate limits. Show me which consequential actions cannot execute without passing the gate. Show me last week’s disposition log, and how long each escalation waited for a human. Show me the test in which someone tried to split a transaction under a threshold, inject an instruction and talk past the gate, and the gate held. Show me the override the agent cannot reach, and the drill that used it. Show me the named answerer for your highest-materiality agent. Those artefacts are governance. Principles, a refusal rate and a roadmap are the thing this piece warns against, in better tailoring.

That is the hopeful note on which the argument rests, and hope, in my writing, is never decoration. Refusal will fail publicly again, an agent will move money it should not, and each event will be used to argue for freezing the technology or freeing it entirely. Refuse both counsels. Agents governed at runtime, with proof, can take on the claims mountains that consume people whose judgment is needed elsewhere. The oversight bill becomes affordable when a gate concentrates it, and the safety tax fair when experts get verified access instead of a classifier’s suspicion. Short-term turbulence, long-term abundance, but only for the organisations and countries that build the gate while others are still admiring the conscience.

XI. Close: What to Demand on Monday Morning

You do not need a transformation programme. You need a list, an owner and a date. Here is mine, written to be copied into a meeting pack.

For the board and the chief executive

One. Name the answerer. For every material agent, record the human accountable for its actions, the mandate they accepted, and when the board last reviewed it. If accountability sits with a vendor or no one in particular, record that as a finding, not a footnote, and close it before the agent’s authority expands.

Two. Demand the registry. One page: every agent, including those bought inside other products, with its owner, model and provider, tools, data access, spending or action limits, logging status and review date. Compare it with what security finds by discovery; the difference is your shadow-agent risk.

Three. Ask the refusal question correctly. Not: does the model refuse dangerous requests? Instead: if the model complied with a dangerous, fraudulent or simply mistaken instruction tomorrow, which of our controls would stop the action before execution, and when did we last test it with a hostile exercise? No test, no assurance. No gate, no expansion.

For risk, compliance and the model owner

Four. Gate the consequential, calibrate by risk. List the action types that change money, records, access, external communications or safety-relevant state. Set each one’s disposition in advance (auto-execute, observe, escalate or deny) by reversibility, materiality, customer impact, regulatory sensitivity and novelty, following the SAFR pattern or your own equivalent. Per-action authority. No inherited permission. No prompt instruction as the sole control on any consequential action.

Five. Own your log. Written by the gate, not narrated by the agent; append-only and tamper-evident; recording the proposed action, agent identity, mandate, controls retrieved, disposition, reasons, any human decision and the outcome in the system of record. Reconcile it against the systems of record on a schedule, so that your reconciliation, not a customer or a regulator, finds the day the agent’s account and the truth part company.

Six. Test behaviour, not brochures. Before go-live and after every material change, run your own evaluations: the poetry test and its cousins in your users’ languages; refuse-then-comply against your monitoring, to prove you are not counting apologies; authority-framed legitimate requests from your own professionals, to measure your safety tax; injected instructions in real documents; split transactions under thresholds; and a drill in which a silent failure on a safety-relevant task must raise an alert to a monitored channel within a stated time. File the results, with model version and date. A vendor’s benchmark may be attached. It may not be substituted.

Seven. Contract for observability. Require notice of behaviour-changing updates, disclosure of rerouting, thinning and fallback practices, incident notification within a stated period, audit and testing rights, and a liability allocation you actually negotiated rather than inherited from a click-through. If the vendor will not disclose silent degradation, record the gap in the vendor risk assessment and price it into the decision.

For everyone who builds, buys or blesses an agent

Eight. Protect the legitimate. Give the cancer researcher, the security defender, the safeguarding lead and the safety researcher a verified-access path: verified identity, stated purpose, scoped capability, logged use, periodic review. A safety system that cannot tell its defenders from its adversaries will, in time, have more of the latter.

Nine. Make the line readable. Every refusal rule you add goes into your controls repository in words, with its basis, scope, owner and review date. If a rule cannot survive being read aloud in a management meeting, it does not belong in the gate.

Ten. Rehearse the bad day. One exercise this quarter: an agent has acted outside its mandate overnight, the log is incomplete, a journalist or a regulator asks at 9 a.m. who approved it, and the vendor says the model usually refuses such requests. Who speaks, what do they show, and what do they stop, in the first hour? That rehearsal is the most honest maturity assessment you will ever run.

I began with a wall. Let me end with a door. A wall says no, opaquely, on its own authority, until the day it is climbed, tunnelled or quietly removed. A door has a frame, a lock whose mechanism can be inspected, a key held by a named person, a record of every opening, and a bell that rings when it is forced. Refusal tried to be the wall around artificial intelligence, and the wall, as Holland Michel has shown and as three fields of research now confirm, is made of statistics and good intentions. Build the door instead. Gate the action. Keep the record. Name the answerer. Then let the agents work, at the scale their usefulness deserves and their risk demands, with proof.

Singapore, November 2026

Appendix A. Library: sources and how closely each was read

How to read this library. “Read in full” means I read the complete published text available to me. “Abstract” or “excerpts” means findings were taken from the abstract, summary or substantial excerpts. “Secondary” means the claim rests on another outlet’s reporting of a source I did not read in full, and the text flags it. A separate deep-research report on AI refusal, dated 8 November 2026 and read in full, is listed last.

Anchor

Academic and research: refusal mechanisms, jailbreaks, over-refusal

Academic and research: agents, assurance, misalignment

Public sector and policy

  • Meta Oversight Board, “Are LLMs Stifling Political Speech?”, 16 July 2026, with Associated Press reporting via Inquirer. Search excerpts and reputable reporting; ten models, 13,524 prompts.
  • IMDA, Model AI Governance Framework for Agentic AI, version 1.0 January 2026, version 1.5 May 2026, updated June 2026 (explainer). Via secondary explainers; explainer read in full.
  • AI Verify, AI Verify Foundation and Project Moonshot (guide). Via summaries; guide read.
  • Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management, final, 7 October 2026 (tracker; reporting). Via specialist trackers and reporting.
  • Monetary Authority of Singapore, BuildFin.ai, “Safeguards for Agentic Finance at Runtime” (SAFR), version 1.0, 3 July 2026, version 1.1, 9 October 2026 (explainer; legal summary). Industry white paper, explicitly not regulatory guidance; via explainers quoting the paper.
  • EU AI Act, Regulation (EU) 2024/1689, and Digital Omnibus on AI, Regulation (EU) 2026/1744 (summary; timeline). Via regulatory summaries.
  • California SB 53, frontier AI transparency law, 2025. Via law-firm summaries.
  • China, Interim Measures for the Management of Generative AI Services, 2023, and GB/T 45654-2025. Via CEIAS.
  • United States Department of War AI Strategy memorandum, 9 January 2026, and the Pentagon contract record on refusal rates. Via The Intercept, as summarised in the research report; contested.

Private sector and labs

Research report

  • Deep-research report, “Op-ed research: AI refusal”, 8 November 2026, with per-claim confidence levels and a could-not-verify list. Read in full; held in the author’s research files.

Appendix B. Verification notes

What could not be verified, what is disputed, and where good sources differ.

  • The Canadian shooting. Reported by Holland Michel from Mother Jones, which was paywalled and not read in full. OpenAI has denied the accusations and the case remains under investigation. No quotation from that reporting is reproduced.
  • The classifier compute figure. Holland Michel reports about 24 per cent; Anthropic’s own publication gives 23.7 per cent for the first-generation system. The text uses Anthropic’s figure and treats his as consistent with it.
  • Amazon and the three days. Not confirmed by Anthropic as a severity claim. Anthropic confirms the bypass and the government directive, and disputes that unique top-tier capabilities were exposed. The text relies only on the undisputed sequence.
  • The UK AISI “more than half” figure. Not pinned to a table. Two versions of the case study differ in models and numbers (one later figure is a 10.7 per cent full-refusal rate for one model, with partial completion up to about a third for another). The text treats the behaviour as documented and version-dependent and does not reconcile the numbers.
  • Single-source details. The makgeolli mechanism is Gleave’s hypothesis; the cancer researcher is one anonymous source; the helpful-only model’s words were not verified against a transcript; McBain’s latest experiments were unpublished at the time; the activation-inspection tooling is known only from Holland Michel. All are attributed, none is used as a statistic.
  • Silent degradation for AI research. Unlike the items above, documented in the lab’s own system card as summarised by multiple outlets. An allegation that the card was covertly edited rests on a single video essay and was not used.
  • The Oversight Board count. Ten models and 13,524 prompts, not five models. The 34 versus 14 per cent aggregate is the Board’s, for the versions tested in March 2026 from an Australian address.
  • Legal status. SAFR is a voluntary industry white paper, not regulatory guidance and not mentioned in the MAS Guidelines. The MAS Guidelines are supervisory expectations staged to 2027 and 2028, not a statute. EU high-risk dates were moved by the Digital Omnibus; confirm against the Official Journal.
  • Self-reported and forecast figures. Lab figures (including the 0.05 per cent harmless-refusal rate) are the lab’s own, on its traffic and definitions. FAR.AI’s costs are a floor. McKinsey’s cost split is via reporting. Gartner’s cancellation figure is a forecast.
  • Not used or contested. Astra jailbreak percentages, the Hacker-Opus audit figures, Chinese-model refusal-rate comparisons and Forcepoint’s prompt-injection claims were not verified and are not quoted. The Pentagon refusal-rate record is contested: both vendor and department say the phrase appears in no executed contract, and no conclusion is drawn about any delivered system.
  • Quotation and interest. No source is quoted at length; Holland Michel, CETaS and others are paraphrased, with brief attributed phrases only where the wording is the evidence. The author’s commercial interest in runtime governance, including TrustOS, is declared at the head and where TrustOS is named. No client detail is described.

Luke Soon is an AI futurist and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: SuperIntelligence Protocol. He co-authored IMDA Singapore’s Model Governance Framework for Agentic AI.

Leave a Reply

Short-term Turbulence for Long-term Abundance.

lumelalabs.ai