What are the specific guardrails implemented after the verification/testing phase of development?
Is it safe to release such software if it has only been tested in environments where certain major risk areas do not exist?
Is it safe to release such software if it has only been tested in environments where certain major risk areas do not exist?
Appendix C Illustrative safeguards, controls, and efficacy assessments has specific examples like:
- Agent actions are all logged in an uneditable database, and asynchronous monitoring routines review those actions for evidence of harm
- Limiting internet access and other tool access
- Limiting credentials
- Limiting access to system resources or filesystem (e.g., sandboxing)
- Limiting persistence or state