模型很自信，账单很真实：AI 护栏应该放在哪里

The Model Was Confident. The Bill Was Real. Where AI Guardrails Belong. A story made the rounds this week: an investigation concluded that overreliance on AI contributed to a decision that cost lives. Whatever you think of the specifics, the shape of the failure is familiar to anyone who ships software — a system produced a confident output, a human treated "fluent" as "correct," and nobody had a checkpoint between the suggestion and the irreversible act. That is not a story about one model. It's a story about a process gap, and most teams building with AI have the same gap. Not because they're careless, but because modern models are specifically designed to sound right. You have to engineer the doubt back in. Confident output is the default, not a signal Language models don't express uncertainty the way people do. A human expert hedges — "I think," "check this," "I'm not sure about the edge case." A model states. It optimizes for a fluent, complete-sounding answer, and fluency reads as competence even when it isn't. So the first guardrail is a mental one: treat every model output as a draft with unknown error bars, no matter how clean it looks. The clean ones are exactly the ones that get waved through. The three questions that decide what AI may finalize For any workflow, ask three questions about each step: Is it reversible? A regenerated draft, a summary, a first-pass label — cheap to undo, fine to automate. A filed tax figure, a published price, a sent contract, a classified shipment — those are not drafts. They're decisions. What's the cost of being wrong, and when does it land? A bad suggestion that fails loudly in five seconds is harmless. A bad one that fails quietly three weeks later is how you get a fine, a held shipment, or a lost customer. Who is accountable if this is wrong? If the honest answer is "the model," stop. A model can't be accountable. Accountability is a human property, and it has to attach to a name before the action ships. The rule that falls out is simple: models draft, humans sign the irreversible. Not as a philosophy — as a routing decision you make per step, once, and then automate. Guardrails that actually hold Philosophy doesn't survive a deadline. Concrete mechanisms do: Two-key actions. Anything irreversible requires a second, named approval in the tool itself — not a convention, a control. If the button can be pressed alone, it will be. Show the evidence, not just the answer. Make the model cite what it based an output on. A bare answer invites trust; a cited one invites checking. This alone kills a large share of silent errors. Log the reasoning, keep the verdict. Save what was proposed, what was accepted, who accepted it, and when. When a decision goes wrong three weeks later, you need to reconstruct why, not guess. Fail loud on the cheap risks, slow on the expensive ones. Automate the low-stakes path end to end. Put friction — a review queue — on the path where being wrong is costly and quiet. Re-test on a schedule, not a memory. Models change, prompts drift, vendors ship silently. A workflow that was safe in March can be unsafe in September for reasons nobody changed on purpose. The honest trade-off Guardrails slow things down. That's the point — on exactly the steps where speed isn't the goal. The trick is to be ruthless about where: put the friction on the handful of irreversible decisions and let everything else run at full speed. The teams that get this right aren't the ones with the smartest model. They're the ones who noticed that an AI system doesn't remove accountability — it relocates it. Someone still owns the outcome. The only question is whether you decided that on purpose, or discovered it in an incident report. Decide on purpose. Put a human on the verdict, and let the model do everything up to it.