Many AI strategies rely on an unspoken assumption that labs will one day release a model sufficiently safe and aligned for direct use in live environments. Improved training, stronger safeguards, and successive iterations are expected to produce reliable behavior.

The assumption overlooks a core limitation. Even an ideally aligned model cannot identify its users, document the data involved, confirm the governing policy, or generate an auditable record. These details concern deployment rather than internal behavior and therefore exist beyond the model parameters.

Regulators, auditors, and security teams seek answers to questions the model itself cannot address. The resulting mismatch creates the primary exposure in current AI systems.

Security engineering identified this issue decades earlier. A 1972 US Air Force analysis introduced the reference monitor concept and required three properties for trust: tamper resistance, universal invocation on every access, and sufficient simplicity for full verification.

Contemporary frontier models satisfy none of these conditions. Alignment attempts to embed rule enforcement within the model, yet no system can serve as its own governor. Oversight must therefore surround the model rather than reside inside it.

Safety Differs from Governance

The distinction rests on terminology. Safety and alignment evaluate whether a model generally behaves appropriately. This trait resides in the weights, and laboratories have made substantial progress in refining it. Governance instead requires records of specific usage: which model processed which data under which policy and with what verifiable trail.

Training can shape behavioral tendencies but cannot, by design, produce deployment records. Conflating the two creates the foundational misunderstanding in most AI risk discussions.

The Challenge Extends Beyond Models and Continues to Expand

The issue affects every organization deploying AI and grows for two reasons. Models now exercise greater agency. Earlier systems generated text only, so errors remained limited to responses. Current models initiate actions via tools and protocols such as MCP, turning each tool call into a decision about identity, data, and authority that multiplies across tasks and users.

OWASP tracking for 2026 shows most agentic projects involve coding agents, with prompt injection linked to six of the ten leading risks. The unprotected surface expands alongside adoption.

Accountability has also become legally binding. California SB 53 and EU rules impose duties on labs, while the EU AI Act and data-protection statutes assign separate responsibilities to deployers. Regulators inquiring about AI activity will not accept claims of using an aligned model as sufficient evidence, nor will vendor reports reveal internal data flows.

Public benchmarks such as StrongREJECT, HarmBench, and AgentHarm evaluate models on standardized prompts rather than organizational data or policies. High scores reflect model properties, not audit trails.

The scope therefore covers every deploying organization, an expanding surface driven by new agents, and enforceable liability. None of these elements constitute a model-quality issue.

Alignment Cannot Resolve the Underlying Problem

Returning to the 1972 criteria clarifies why the solution cannot reside in the model. Models remain vulnerable to tampering because prompt injection exploits the shared text channel between instructions and data. Four years after its identification the technique persists, and recent analyses suggest agents may stay susceptible. A control that input can rewrite fails its purpose.

Models also fail reliable invocation as gates. Equipped with tools they become confused deputies, unable to distinguish instructions from data. Finally, models resist verification because billions of opaque parameters cannot be inspected like a compact enforcement kernel.

Failing all three tests indicates that enforcement must move outside the model.

Control Must Surround the Model

The required response is a lightweight control layer that treats the model as untrusted and mediates every proposed action. This architecture revives the 1972 reference monitor for agentic settings.

A request reaches the model, which proposes an action such as an API call or file write. The proposal travels as a request to an external policy engine positioned between the agent and the target resource, consistent with zero-trust separation of decision and execution points.

The engine evaluates the action against organizational policy and the specific capabilities granted for the task. Approved actions execute; others are blocked. In every case the engine records the actor, model, data, policy, and outcome.

This arrangement supplies the three missing properties. The external engine resists tampering, activation is mandatory, and the compact enforcement point permits verification. Research systems such as CaMeL demonstrate that provable security arises from this containment even when the underlying model remains vulnerable. The assurance stems from architecture rather than weights.

The approach does not enhance model safety; it establishes system accountability, a narrower and attainable objective aligned with actual deployment requirements.

Selecting the Appropriate Layer

This perspective does not oppose alignment efforts, which remain valuable and continue to advance. Alignment simply addresses a different question from the one posed by regulators, auditors, and users. The answer has existed since 1972, yet the industry repeatedly reconstructs it at greater cost.

Future models will exhibit improved safety characteristics. They still will not record usage details or policy context. Bridging that gap constitutes the essential task ahead.