Governance, safety and risk — reference

A decision-table companion. Each table names a decision, the documented input that settles it, and the claim it does not license.

1. The three rows (LO1)

Strict mode delivers row one only: it guarantees the tool inputs match your JSON Schema by constraining sampling to schema-valid outputs. Without it, the model might return incompatible types or omit required fields, breaking your functions.

⚠ The decision that stops an action must live outside the model, on the resolved call. Content returned from tools, documents and searches is untrusted data and must never override the original request — so a check inside the prompt is a check the injected text gets to argue with.

Untrusted content

JSON-encode third-party strings rather than concatenating them: the escaping gives unambiguous delimiters, so an attacker cannot close a quote or tag to break out. Underneath everything, least privilege — no secrets the agent does not need, sandboxed tools, permissions scoped as narrowly as possible — bounds what a successful injection reaches.

⚠ Strict tool use is eligible for protected health information, but that information must not appear in tool schema definitions (property names, enum, const, pattern). Compiled schemas are cached separately for up to 24 hours since last use and do not carry the same protections. Such data belongs in message content.

2. Failure taxonomy (LO2)

Abstention is a design element, not a failure: explicitly give the model permission to admit uncertainty, and to state when no relevant quotes were found. Both convert a gap the system would paper over into one it reports.

⚠ The mitigations significantly reduce hallucinations without eliminating them, and critical information should always be validated, especially for high-stakes decisions. If an action is irreversible, the design needs a check that does not depend on the model having been right.

3. Human-in-the-loop (LO3)

Gate matrix (house, built on the documented permission control and the instruction to validate high-stakes decisions):

A gate is only real if it carries evidence — quotes and sources for the claims the recommendation rests on — and a recommended action to approve or reject, with nothing applied until approval. Reduce the volume reaching a reviewer with an adversarial verification pass before surfacing, which the documentation credits with more real issues reported and fewer false positives.

4. Regulatory compliance (LO4)

The addendum is automatically incorporated into the commercial terms, so accepting those accepts it. ⚠ Access through a third-party platform is governed by that platform's terms of service — eligibility is a per-access-path check.

Global endpoints route dynamically for maximum uptime with no pricing premium — a good default without a residency requirement, and the wrong one with. By default, customer data from commercial deployments is not used to train models.

⚠ An audit trail starts when you switch it on. Activity feed retention is six years forward; recording is not retroactive, earlier activity is not backfilled, and a gap while recording was off cannot be recovered. Feed retention is independent of the content retention policy.

5. Ethics, bias and transparency (LO5)

Even hazy topics such as ethics and safety can be quantified. A criterion needs three things:

Most use cases need multidimensional evaluation along several success criteria — the documented point is about criteria, not groups. Scoring per slice rather than blended is the house step layered on it, together with an evaluation set that mirrors the real distribution and its named edge cases. Binary classification suits a present-or-absent judgement such as whether a response contains protected information.

Publish the right-hand column as excluded, and give users an appeal path. Criteria must align with the application's purpose and users, so a threshold copied from another system carries a justification nobody made for this one.