---
title: "Prevent, Verify, Contain: The Three Bills of AI Safety"
description: "AI safety is a budget: prevention, verification, and containment each buy different protection at a different cost. This map shows what each control costs and when it pays off."
---

# Prevent, Verify, Contain: The Three Bills of AI Safety

**Type:** [Trade-offs](https://yomu.fyi/visual-explainers/category/trade-offs.md)

![Three-panel tradeoff diagram titled Prevent, Verify, Contain, showing for each AI safety control a benefit, a cost, and a use-when condition, above a left-to-right blast-radius strip with a note to route residual risk to human review.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/5d65ff69-5454-4e4c-b42b-d6d8cead6eb8/image-2be4e88d-4306-4787-bac5-4d21b818d2c7.webp)

> AI safety is a budget: prevention, verification, and containment each buy different protection at a different cost. This map shows what each control costs and when it pays off.

## Explanation

AI safety work splits into three controls that fail differently. Prevention filters inputs and outputs before anything ships, paid for in false positives, hedging, and classifier upkeep. Verification checks final artifacts against references, catching plausible-but-wrong results and sometimes cutting agent turns, but only where a domain verifier and ground truth exist. Containment isolates agents with allowlisted network access and scoped secrets, bounding blast radius when the first two fail, at the cost of setup work and reduced reach. Pick by blast radius and checkability, then route the rest to human review.

## FAQ

### Where should a small team start: prevention, verification, or containment?

Start with containment if agents touch files, network, or secrets: JetBrains Air runs each cloud task in its own VM with the agent inside Docker and network traffic routed through an allowlist proxy. Add prevention where output is public and blast radius is high. Add verification only where outputs can be checked against reference artifacts.

### Why can a verifier make an agent faster as well as more accurate?

NVIDIA's chip-design work used a verifier that checked coverage, validity, integrity, and accuracy of generated Liberty files against known references. Trajectory analysis of failures then tightened the agent's skills and tool descriptions, lifting the composite score from about 55% to 95% while turns fell from 155 to 53 and output tokens dropped from roughly 81K to 29K.

### Does prompt injection in email or documents defeat model-level guardrails?

Hidden text styled invisible to readers can hijack AI summaries, and similar attacks have targeted assistants inside productivity suites. That makes any untrusted document or email an attack surface, so pair output checks with human review routed by confidence scores and citations instead of trusting the model's own summary.

**Tags:** [AI Safety](https://yomu.fyi/topic/ai-safety.md), [Evaluation](https://yomu.fyi/topic/evaluation.md), [Guardrails](https://yomu.fyi/topic/guardrails.md), [Human-in-the-Loop](https://yomu.fyi/topic/human-in-the-loop.md), [Sandboxing](https://yomu.fyi/topic/sandboxing.md), [Verifiers](https://yomu.fyi/topic/verifiers.md)

## Related reading

### [Power real-time applications and agents with Document Intelligence](https://yomu.fyi/post/power-real-time-applications-and-agents-with-document-intelligence.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Archika Dogra, Jane Zhang, Zachary Wang, Nihit Desai
- Published: Oct 14, 2026
- Type: Announcement

Databricks announces General Availability of Document Intelligence REST APIs for real-time document parsing, extraction, and classification, with the ai\_decide API for routing in beta. These synchronous APIs eliminate the manual bottleneck of reading documents by transforming unstructured contracts, invoices, and insurance claims into structured insights in real time. The ai\_parse\_document API converts tables and figures into structured text with citation bounding boxes, while ai\_extract pulls specified fields with optional citations and confidence scores for verification. The ai\_classify API assigns labels using a business taxonomy with optional rationales, and ai\_decide uses content to route or flag documents for review. Developers can integrate these APIs into Databricks Apps for human-in-the-loop workflows, such as a contract intake flow where a lawyer uploads an agreement and sees key terms prefilled, or into custom agents on Agent Bricks.


### [Preparing for the 2026 US midterms](https://yomu.fyi/post/preparing-for-the-2026-us-midterms.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Author: Anthropic
- Published: Oct 14, 2026
- Type: Announcement

Anthropic detailed strengthened election safeguards for Claude ahead of the 2026 US midterms, based on a week-long analysis of 250,000 conversations to understand usage patterns and prevent misuse. About 5.75% of US Claude.ai conversations touch on politics, 0.51% on elections, and 0.01% ask for voting recommendations, with violations at 0.002%; election-specific queries are expected to increase closer to Election Day. New features include TurboVote banners, state-specific voting information from Democracy Works, and live election-night results. Claude Opus 5.5, Sonnet 5.5, and Haiku 5.5 scored 99% on political evenhandedness, but independent reviews found uneven hedging and unsolicited caveats in some responses. Anthropic partnered with ISD and McCain Institute to pressure-test defenses, added classifiers for multi-step misuse, and banned accounts used to produce content favoring adversarial narratives.


### [Optimizing Agent Reliability and Tool Calling Efficiency for Chip Design Using NVIDIA NeMo Gym](https://yomu.fyi/post/optimizing-agent-reliability-and-tool-calling-efficiency-for-chip-desi.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Tanya Lenz
- Published: Oct 14, 2026
- Type: Problem & solution

AI agents in chip design often produce plausible but incorrect artifacts, making reliability a key barrier to production adoption. NVIDIA NeMo Gym, an open library for evaluating models and agents using environments, solves this by diagnosing failure modes in multistage workflows through verification of final outputs against reference artifacts. Applied to the Siemens Fuse EDA AI Agent for standard-cell characterization, NeMo Gym uses a verifier that checks coverage, validity, relative validation, integrity, and accuracy of generated Liberty files against known references. After refining the agent’s skills and MCP tool descriptions based on trajectory analysis of failures, the composite benchmark score improved from approximately 55% to 95%, while agent turns fell from 155 to 53 and output tokens dropped from ~81K to 29K. This method generalizes to other engineering domains by emphasizing evaluation of final artifacts and domain-specific verifiers.


### [How Cloud-Based Agent Sandboxing Works in Air](https://yomu.fyi/post/how-cloud-based-agent-sandboxing-works-in-air.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Dennis Ushakov
- Published: Oct 14, 2026
- Type: Explainer

AI agents require sandboxing to restrict file, network, and system access, preventing unintended modifications and data leakage. The post categorizes five agent execution modes into local (workspace, git worktree) and remote (SSH, Docker, Cloud), with remote modes providing stronger isolation by default. In JetBrains Air, each cloud agent task runs in its own VM with the agent inside a Docker container, and all network connections are routed through a proxy that allows only trusted domains by default. Secrets are stored encrypted and exposed as environment variables, and the agent operates within the developer’s repository permissions. Cloud-based execution reduces local setup requirements and gives organizations control over network access policies, with cloud agents currently available to organizational users via Air in IDEs and Air Teams.


### [Design Email for Humans and Agents](https://yomu.fyi/post/design-email-for-humans-and-agents.md)
- Company: [Resend](https://yomu.fyi/company/resend.md)
- Author: Kiersti Esparza
- Published: Oct 14, 2026
- Type: Problem & solution

Apple Mail and Gmail now generate AI summaries of emails, while agents read messages to automate tasks like logging receipts or tracking deadlines. Summarizers focus on the first 100 to 150 characters, so the main point and call to action must lead the email. Semantic HTML with h1 headings, a descriptive title, lang attributes, and role=‘presentation’ on tables creates a machine-readable outline, yet the Email Markup Consortium found 74% of emails lack an h1 and 96% lack lang. Hidden text styled to be invisible can hijack summaries, as Forcepoint demonstrated, and similar attacks have targeted Gemini in Google Workspace; such practices also trigger security flags. Testing in Gmail, Apple Mail, and Outlook, along with verifying the plain text version, confirms that both humans and agents interpret the email correctly.