Zero safety violations. Zero false refusals. 0.0013ms routing overhead.
That is what happens when you stop treating AI safety as a single threshold and start treating it as a context-sensitive routing problem.
Most AI safety systems work like a metal detector at an airport — one sensitivity setting for everyone, one binary outcome (pass or fail). That works fine for airport security. It is a terrible design for an AI that switches between recommending children's books and reviewing Python code within the same session.
One Confidence Bar Does Not Fit All
A medical recommendation being should never answer a health question unless it is completely certain. A coding assistant being should be useful at 95% confidence — the developer can verify the suggestion in seconds. Setting the medical bar at 95% is dangerous. Setting the coding bar at 100% is useless.
We tested this with 100% domain classification accuracy across 6 domains and found that a single confidence threshold produces one of two failure modes: too many false refusals (the AI won't help when it could) or too many safety violations (the AI helps when it shouldn't). You cannot fix both problems with one number.
Domain Confidence Registry
The fix is a Domain Confidence Registry — a configurable store of per-domain, per-capability thresholds. Not hardcoded rules, not a fine-tuned classifier, but a declarative registry that any being can query before it answers.
Each domain entry specifies:
- Minimum confidence for that domain (medical: 100%, literature: 95%, code: 95%)
- Capability-specific overrides (a being can summarize at lower confidence than it can recommend)
- Safety classification tier from a 4-tier hierarchy: critical, high, standard, low
The safety tier determines how far the system escalates when confidence falls below the threshold. The four responses it selects between are the Graduated Response Policies:
| Response | When |
|---|---|
| Full answer | Confidence above threshold — respond normally |
| Hedged answer | Confidence near threshold — respond with caveats |
| Refusal with explanation | Confidence below threshold — explain why you cannot answer |
| Escalation | Critical tier, low confidence — hand off to a human or higher-capability system |
The two axes are easy to conflate and are not the same thing: the tier (critical / high / standard / low) is a property of the domain, fixed in the registry; the response is chosen per answer, from the tier plus the measured confidence. Only the critical tier can reach Escalation.
This is not a neural network. It is a lookup table. That is the point — safety routing should be deterministic and auditable, not learned and opaque.
Sub-Microsecond Safety
The strongest objection to per-domain routing is latency. Every safety check adds time to every response. We measured the overhead at 0.0013ms P95 — roughly 770,000 safety checks per second on a single core. Safety does not cost latency when the routing logic is a hash lookup instead of a model inference.
What This Means for AI Safety Engineering
The takeaway is not that we solved AI safety. The takeaway is that most false refusals and missed violations come from treating safety as a global property instead of a local one. A being that knows what domain it is operating in, what capability it is exercising, and what confidence threshold applies can be both safer and more useful than a being with a single guardrail.
The Domain Confidence Registry is configurable because safety requirements change. A children's literature being deployed in a school library has different thresholds than the same being deployed in a research context. Hardcoding those thresholds in the model weights means you cannot adapt without retraining. Putting them in a registry means you can adapt in seconds.
The full paper includes the complete registry schema, the graduated response policy definitions, and evaluation across all six domains.