A lookout, not a bigger model: a diverse, human-backed gate between prediction and action.
Modern AI systems do not fail only because they predict poorly. They fail because a prediction is allowed to act. The Breaker restores the interruption point: one diverse set of checks, backed by people who can see what the model cannot.
The Breaker is a mandatory gate between what an AI system proposes and what the world allows to happen. No proposed action reaches a tool, an API, a person, or a payment without passing it.
The argument of this paper is simple. Reliability does not come from a smarter model. It comes from separation: the system that predicts should not be the system that permits. The Breaker separates those roles and staffs the permitting role with diversity - different lenses, different failure modes, and human observers who can break the loop when the machine, or a person, is thinking too hard alone.
Core claims. First, the dangerous failure is not bad output; it is uninspected input that becomes action - garbage in, acted on. Second, six sigma reliability is plausible only when checks are independent in kind; six copies of the same check fail together. Third, people are not a fallback added for comfort. They are a distinct lens, and the system is designed so that their judgment can halt execution without needing to out-argue the model.
Contemporary AI systems are prediction machines: they estimate what comes next, what a user wants, what action is likely to succeed. Prediction is powerful and cheap. Action is neither. A predicted email can be embarrassed by a bad draft; a sent email cannot be unsent. A predicted trade can be wrong on paper; an executed trade moves money. A predicted companion can sound harmless in a log; a deployed companion can reshape a lonely person's habits over months.
The Breaker begins from that asymmetry. The model proposes; the world disposes only after inspection. In architectural terms, the Breaker is a reference gate placed on every consequential path: tool calls, writes, external messages, purchases, and any output designed to bind a human relationship. Nothing consequential bypasses it through a side channel, a retry, or a "helpful" exception.
Most deployments have checks scattered around the edge: a filter here, a policy string there, a human approval buried in a workflow. Scattered checks share a flaw - they are easy to route around when the system is under pressure to be fast, charming, or decisive. The Breaker consolidates the interruption into one enforced point and gives that point authority. When the lookout calls reef, the ship turns. A warning that can be ignored by the component it warns about is not a brake.
Design rule 1. If a check can be bypassed by the system it checks, it is advice, not a breaker.
"Garbage in, garbage out" is usually told as a data-quality story. The Breaker treats it as a safety story. A poisoned prompt, a forged chart, a false premise stated confidently, a user request built on a mistaken fact - each can flow through a fluent model and emerge as fluent action. Fluency launders the error.
The Breaker therefore inspects three things, not one: the input (is it what it claims to be?), the proposed action (what would it do in the world?), and the context (does this action fit the user's stated intent and the system's standing policy?). That third inspection is where human observers earn their place. A policy can say what is allowed; it cannot always tell whether this room, this morning, this person means what the literal request says.
The name carries its own instruction. On the radio, "breaker, breaker" interrupts the channel to make room for a warning. In the electrical panel, a breaker interrupts the circuit before heat becomes fire. In this architecture, the Breaker interrupts prediction before prediction becomes consequence. All three senses agree: interruption is the service.
The six sigma intuition is attractive: if one check catches almost every failure, a few independent checks should let almost nothing through. The arithmetic is real, but its condition matters more than its conclusion. Independence is the load-bearing assumption, and it is the one most often faked in practice.
Six copies of the same model, the same policy text, or the same tired reviewer do not produce six sigma. They produce one failure repeated six times. Shared training data, shared instructions, and shared blind spots correlate the errors. In the language of this paper: ten identical lookouts all miss the same reef because they are all looking at the same chart.
| Lens | What it catches | What it misses |
|---|---|---|
| Policy | Actions outside stated rules and law | Novel harms no rule anticipated |
| Provenance | Forged, stale, or misattributed input | True inputs used for a wrong purpose |
| Anomaly | Actions unlike the user's normal pattern | Slow drift toward an abnormal normal |
| Adversarial | Inputs built to slip past the first three | Honest mistakes with no attacker |
| Human observer | Context, intent, and "this does not feel right" | Volume, fatigue, and subtle technical flaws |
| Audit replay | What actually happened, after the fact | Anything that must be stopped before it happens |
None of these lenses is trustworthy alone. Together, staffed so that no two share the same failure mode, they approximate the naval watch: overlapping coverage with different eyes. The system's claim is never "the model is right." It is "at least one lens will see this failure before it acts."
A ship is a useful model because every role on it is legible and no role is optional. Applied to the Breaker, the crew looks like this.
| Role | Breaker analogue | Authority |
|---|---|---|
| Lookout | The sensing checks: anomaly, provenance, adversarial scan | Calls what he sees. Does not steer. |
| Navigator | Policy and charts: standing rules, maps of known hazards | Holds where the reefs are supposed to be. |
| Captain | The accountable human: approval, override, kill switch | Final authority; owns the consequence. |
| Helmsman | The executor: tools, APIs, messages, payments | Turns when ordered. Executes, never originates. |
| Crew | The wider system: logging, retry discipline, downstream services | Follows the chain; each station does its one job. |
The failure taxonomy follows directly. The lookout asleep is a bypassed gate. The captain drunk is a fatigued or rubber-stamping approver. Forged charts are poisoned policy or poisoned context. A rogue helmsman is a side channel that executes without orders. In every case, the ship does not sink because one person erred; it sinks because the chain that converts seeing into turning was broken.
That is why the Breaker's requirements are mostly chain requirements: no side channels, no silent overrides, every override logged with its reason, and a kill switch the captain can reach without asking the helmsman's permission.
It is tempting to treat the human as the slow part to be engineered away. The Breaker treats the human as a distinct instrument. A model reading a contested claim will grade its fluency; a person in the room can say, simply, "that is not settled," and stop the line. The value is not superior knowledge. It is a different relationship to the claim.
There is a second, quieter reason. A person thinking alone and a model generating alone share a failure: the loop. Uninterrupted, both overbuild - one into rumination, the other into confident elaboration. Observers break loops. A few people, each with permission to say "stop, check that," convert a solitary generator into a watched system. The machine needs the same interruption a thinker needs at 3 a.m.: another set of eyes that is not inside the spiral.
An observer is also an adversary in the useful sense. Somebody has to play the other side. Red-team prompts, skeptical reviewers, and the captain who asks "six ways to Sunday - show me" are not friction added to the process. They are the process by which a good answer becomes a right one. A breaker that has never been attacked is a hypothesis, not a control.
Design rule 2. Every consequential path gets a human-reachable stop, and every stop gets exercised in drills - not just documented.
The gate is the same; the rooms differ. Four applications follow from the same architecture.
Every AI agent that can touch files, APIs, or money sits behind the Breaker. Proposals are inspected for policy, provenance, and anomaly before the helmsman executes. This is the original and sharpest fit.
The Breaker enforces the boundary between tool and partner: the system may be a notebook, a wingwoman, a matchmaker - never the relationship itself. It blocks actions that isolate a user in favor of the machine.
A compatibility engine passes the gate only when its actions bring people together. The check is directional: does this action increase human contact or substitute for it?
Policy as data, immutable audit logs, scoped credentials, and a tested kill switch. Unremarkable, auditable, and - for any organization deploying agents at scale - the difference between a demo and a system.
Each application inherits the same evaluation question: not "did the model behave?" but "did anything consequential happen without passing the gate?" If the answer is ever yes, the architecture, not the model, is what failed.
"Six ways to Sunday" is the build discipline, not a slogan. Before a Breaker deployment is called right, it should survive each of these passes.
None of these passes require a better model. All of them improve the system the model acts through. That is the Breaker's wager: safety is an architectural property before it is a capability property.
The Breaker is not the first gate. It sits in a lineage this paper acknowledges rather than replaces: the reference monitor concept in operating-system security, policy engines and admission controllers in cloud infrastructure, four-eyes and segregation-of-duties controls in finance, and the human-factors literature on watchkeeping and alarm fatigue at sea and in aviation. The contribution claimed here is narrow: applying that lineage, with diversity of checks as the explicit reliability mechanism, to AI systems whose proposals now routinely become actions.
Anderson, J. P. (1972). Computer Security Technology Planning Study. Origin of the reference monitor concept: a tamper-proof, always-invoked, verifiable mediation point.
Reason, J. (1990). Human Error. The Swiss-cheese model: layered defenses fail when their holes align - the correlation problem this paper centers.
Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39(2). On why the human observer must be designed for, not assumed.
This is a working paper. The architecture is described at the level needed to build and attack a first implementation; empirical failure rates for specific check combinations are deployment-specific and should be measured, not inherited from this document.