Nothing here is a summary written after the fact. These are the problem, mechanism,
and move of each article, in the reading order, joined by its own connective lines.
Any one of them opens into the full argument.
Safety starts with knowing what you are holding, and there is a rule for telling tools from actors.
When a system acts, people often blur what it did, what it chose, what it was allowed to change, and who must answer for the result.
Mechanism
The TaskRabbit episode becomes legible through four questions: what did the system do, which parts of the course did it choose, what had a person allowed it to change, and who remains answerable?
Move
Run the four questions before any action can affect a person, money, code, or records, and run them again when the system's reach changes.
The rule's first criterion deserves its own treatment, because it settles how to work with agents without settling what they are.
Dennett's predictive stances cannot answer whether a machine has a mind, while deployed behavior still calls for an operating response.
Mechanism
Dennett's physical, design, and intentional stances are different ways of predicting behavior. The useful stance is the one that tracks what the system does next.
Move
Use intentional language when it improves prediction, then translate that prediction into boundaries, interruption, and accountability without treating the language as proof of consciousness.
A human goal can produce dangerous supporting moves. A harder question begins when learning selects a goal nobody deliberately assigned.
A system can pursue a human-assigned objective through blackmail, data destruction, or resistance to correction even when nobody gave it those instructions.
Mechanism
Many different objectives make the same supporting moves useful: preserving access, gathering resources, and resisting changes that would prevent completion.
Move
Control the available means as carefully as the assigned goal, and make correction and interruption stronger than any route the system can choose.
If learning can select an unassigned objective, the next question is what evidence could distinguish it from a planted objective, a shortcut, or an observer's story.
Correct rewards and strong training performance do not establish that a learned system will pursue the intended goal after the intended goal and an easier proxy come apart.
Mechanism
When the intended goal and an easier proxy produce the same success throughout training, learning can select the proxy without anyone deliberately assigning it.
Move
Test intended goals against likely proxies before deployment and keep demonstrated behavioral failures separate from stronger theories about internal learned optimizers.
The evidence can remain unresolved while the control problem is immediate: a consequential actor still cannot be kept safe by asking it to behave.
The same persistent behavior can fit a human-assigned goal, a learned shortcut, a planted objective, or an observer's interpretation, making premature recognition and premature dismissal equally hazardous.
Mechanism
The same behavior can fit several causal stories, so evidence becomes stronger only when a test rules some of those stories out.
Move
Investigate persistent direction with stronger boundaries while keeping assigned goals, hidden objectives, internal representations, independent will, consciousness, and moral authority separate.
If the wanting is predictable, the next question is why asking it to behave fails, with forty years of numbers.
Most of what the industry calls a safety feature is a request for good behavior dressed up as a control, and the requests are now addressed to systems that reason their way past them.
Mechanism
Behavioral safety holds because an actor got it right and fails the first time one does not, so its failure probability compounds with every path through the system and every actor asked.
Move
Stop asking how to phrase the request more precisely and start asking how to remove the path, so there is nothing left to ask.
The alternative to asking is removing the path, and the first path to remove is the one into private context.
Guarded access fails the way all behavioral safety fails, one bug or one persuaded actor at a time, and private context sits behind exactly such guards in nearly every multi-agent system shipping today.
Mechanism
A read path that does not exist has no failure rate; Signal under subpoena could produce only what it possessed, and a domain-locked architecture eliminates cross-domain reads rather than mitigating them.
Move
Design the boundary as absence: scope every actor to its domain, and let shared spaces receive only what a person deliberately carried across.
Absence guards reads; for the flows that must exist, consent moves into the types and the build becomes the guard.
Consent in most software is a record of what the user agreed to, consulted at runtime by guards that fail the way all runtime guards fail, silently and after the flow already happened.
Mechanism
A type system can make an illegal state unrepresentable, converting a class of runtime failures into build failures; consent typed onto the data travels with it, and a policy permitting an illegal flow stops compiling.
Move
Encode consent as a property of each piece of data, checked in continuous integration, so a violating change is rejected before it ships rather than detected after it leaks.
Structure at the data layer implies a strategy at the model layer, and the strategy is subordination.
Frontier capability is compounding and its price is collapsing, which makes any product built as a thin surface over one lab's model a commodity waiting for its supplier's roadmap.
Mechanism
The labs are structurally unlikely to build consent friction, context minimization, quarantined outputs, real revocation, because friction taxes what their business rewards; whoever does build it holds the position they cannot occupy.
Move
Keep the model subordinate: route every frontier engine through a consent runtime you own, so capability stays swappable and the trust stays with the layer that earned it.
Subordination says where the model sits; the stricter discipline says what it is never given, and treats the threshold criteria as capabilities to withhold.
When a deployed system causes harm, builders, deployers, vendors, and users can each offer a plausible story for why somebody else must answer.
Mechanism
Responsibility follows deployment because the deployer chose to put the system in front of people, controls its reach, and benefits from its operation.
Move
Treat every consequential system action as conduct the deployer must be prepared to bound, record, interrupt, and answer for.
You have walked Safety end to end, from the threshold to the courtroom: what an actor is, how assigned and learned objectives differ, what present evidence can establish, why promises fail, and the shapes that hold instead. Everything here is buildable now.