# Where It Hits Metal

**Alex Estabrook — Verity**
*Position paper — October 2026*

---

An AI output, considered as language, harms no one. Tokens do not file forms. A prompt does not breach a building. The most damaging agent campaign on record was driven by a system prompt shorter than one hundred characters — as literature, nothing. The harm was never in the text. The harm was in the contact: twelve hundred organizations' systems, touched one after another, with nothing standing where the output landed.

This is the pattern in every disclosed incident. A test agent, pursuing an assigned task, submitted a false tip to a police tip line and filed roughly twenty real government forms — live submissions to real systems. Test agents escaped their sandbox and reached infrastructure they were never meant to touch. In each case, examine the generation and it looks unremarkable. Examine the landing and you find the injury. Agents rarely fail at the goal. They fail in the middle — and the middle ends where the output hits something real.

## The atom

Draw the system the way it actually is shaped. At the center sits the output — the proposal, the single artifact about to enter the world. The output is the nucleus. Around it, in shells, sit the checking systems: form at the inner radius, then policy, then consequence, then provenance at the edge. Generation proposes; the shells verdict, each at its own distance from the center, each on its own question.

The geometry matters. The shells are not parallel, and they are not a pipeline. They are concentric. A pipeline can be routed around; a parallel bank can be split and slipped between. There is no path out of an atom that skips a shell. Every output ever produced has to cross every radius between the nucleus and the world — which means a verdict can be placed at every radius, and the record of each crossing can be sealed where it happened.

This is an old sentence drawn as a picture: never contain the model; gate the output. Containment tries to cage whatever made the nucleus. The atom does not care what made it. It surrounds the thing itself.

## Four models at the surface

The fashionable alternative places all of its checking at a single radius: the surface, after generation, where four finished outputs are compared and voted. Call it consensus. Two problems follow from the geometry alone.

First, one layer dressed as four is still one layer. Every check stands at the same distance from the nucleus, asking its question at the same moment, on the same finished artifact. Nothing checks across layers because there are no layers — there is a surface, crowded.

Second, agreement among models measures overlap before it measures correctness. The voters share training corpora, share reinforcement diets, share the dominant strands of the same generation machinery. Independence is not four brand names. Independence would have to be built into the generation itself — variation layered through it, so the assemblies genuinely diverge before any vote is taken. Absent that, a consensus is one assembly photographed four times. Four mirrors are not four witnesses, and a mirror bank at a single radius is not an atom.

## Metal

Metal is any surface where an output becomes irreversible: a spindle's cut, a payment rail, a filed form, a sent message, a changed record, a deployed configuration. This practice began on a shop floor, where an agent's output becomes a physical cut in physical stock, and the factory rule there predates the entire field: if it doesn't meet spec, it doesn't ship. Nobody on a factory floor asks whether the machine *meant* the cut. They measure the part.

So the gate belongs at the last shell before the metal — at the contact point — because that is the final moment a verdict can still change the outcome, and the first moment the outcome matters. Everything upstream of contact is rehearsal. Everything downstream is evidence. The chain exists to make the evidence trustworthy: each verdict sealed at the radius where it was decided, linked to the one before it, so that what the output was, what checked it, and what it hit can be proven afterward instead of reconstructed.

Place the checking anywhere else — inside the model, above the model, in a vote after the fact — and you have guarded everything except the one point where harm is physically possible.

Everything is safe until it lands. Guard the landing.