Comment on the SAFE RFC (Shared AI Findings Exchange)
Submitted by: Niujiaxing (牛家兴) — njiaxing@gmail.com — personal capacity
In response to: SAFE Working Group RFC, Open Secure AI Alliance / The Linux Foundation, published 2026-08-04
Thank you to the Open Secure AI Alliance and the Linux Foundation for opening SAFE for public comment. The framing — confidential, blameless, evidence-based learning modeled on NASA's Aviation Safety Reporting System — is exactly the right instinct, and I strongly endorse the principle that "trust is not a security control; shared evidence and verifiable improvements are how trust is earned." I would like to offer four technical suggestions on the evidence layer, from the perspective of someone building related tooling.
1. Completeness — reconcile multi-source evidence, not only preserve it
SAFE's draft is strong on what to collect (the full AI operating stack: models, safeguards, tools, runtime environments, monitoring, human operations, supply-chain dependencies). But incidents involving agentic systems rarely live in a single party's record. Two independent systems routinely disagree about what happened — for example, an agent reports "deployment succeeded" while the CI system records a failure, or a tool claims an action was authorized while the audit log shows otherwise.
Suggestion: Specify how evidence from multiple sources should be reconciled into a coherent incident record (matched / missing / conflicting / unresolved), not merely stored. Preservation without reconciliation leaves the hardest agentic failures — cross-system disagreements — unaddressed.
2. Independent Witness — external observation, not self-attestation
Self-reported evidence is necessary but insufficient. SAFE's "learning, not blame" culture is compatible with, and strengthened by, a clear separation between what the agent (or its operator) said and what was independently observed.
Suggestion: Define an explicit linkage for third-party corroboration — where another system, an independent runtime observer, or an external auditor can confirm or contradict a claim. This does not assign fault; it raises the quality of the shared evidence pool.
3. Provenance Classification — grade the source
Not all evidence carries equal weight. Today SAFE treats reported findings largely as a flat list.
Suggestion: Add a lightweight provenance grade to each evidence item — e.g., self_generated / external_system / third_party_witness. This is a low-cost metadata addition that makes the reconciliation in (1) and the witness linkage in (2) meaningful, and lets consumers weight evidence appropriately without leaking sensitive detail.
4. Interoperability — evidence portable across runtimes
Agents execute across many runtimes (Claude Code, OpenAI Agents SDK, LangGraph, AutoGen, CrewAI, and others). If evidence formats are runtime-specific, the same incident cannot be reconciled when its steps span multiple runtimes.
Suggestion: Keep the SAFE evidence record runtime-neutral so findings are portable and reconcilable regardless of where each agent step executed. A runtime-neutral evidence format prevents vendor lock-in of the safety record and maximizes cross-organization reuse.
Closing
These are offered as one possible direction for the evidence layer of SAFE — not a verdict on the proposal, which is already strong. I raise these points as a contribution to the discussion from someone working on related evidence-reconciliation questions, not as a proposal of any specific implementation. I am happy to align with the working group on any of the above and to contribute where useful.
— Niujiaxing (牛家兴)
njiaxing@gmail.com
(personal capacity; no organizational affiliation stated)
Comment on the SAFE RFC (Shared AI Findings Exchange)
Submitted by: Niujiaxing (牛家兴) — njiaxing@gmail.com — personal capacity
In response to: SAFE Working Group RFC, Open Secure AI Alliance / The Linux Foundation, published 2026-08-04
Thank you to the Open Secure AI Alliance and the Linux Foundation for opening SAFE for public comment. The framing — confidential, blameless, evidence-based learning modeled on NASA's Aviation Safety Reporting System — is exactly the right instinct, and I strongly endorse the principle that "trust is not a security control; shared evidence and verifiable improvements are how trust is earned." I would like to offer four technical suggestions on the evidence layer, from the perspective of someone building related tooling.
1. Completeness — reconcile multi-source evidence, not only preserve it
SAFE's draft is strong on what to collect (the full AI operating stack: models, safeguards, tools, runtime environments, monitoring, human operations, supply-chain dependencies). But incidents involving agentic systems rarely live in a single party's record. Two independent systems routinely disagree about what happened — for example, an agent reports "deployment succeeded" while the CI system records a failure, or a tool claims an action was authorized while the audit log shows otherwise.
Suggestion: Specify how evidence from multiple sources should be reconciled into a coherent incident record (matched / missing / conflicting / unresolved), not merely stored. Preservation without reconciliation leaves the hardest agentic failures — cross-system disagreements — unaddressed.
2. Independent Witness — external observation, not self-attestation
Self-reported evidence is necessary but insufficient. SAFE's "learning, not blame" culture is compatible with, and strengthened by, a clear separation between what the agent (or its operator) said and what was independently observed.
Suggestion: Define an explicit linkage for third-party corroboration — where another system, an independent runtime observer, or an external auditor can confirm or contradict a claim. This does not assign fault; it raises the quality of the shared evidence pool.
3. Provenance Classification — grade the source
Not all evidence carries equal weight. Today SAFE treats reported findings largely as a flat list.
Suggestion: Add a lightweight provenance grade to each evidence item — e.g.,
self_generated/external_system/third_party_witness. This is a low-cost metadata addition that makes the reconciliation in (1) and the witness linkage in (2) meaningful, and lets consumers weight evidence appropriately without leaking sensitive detail.4. Interoperability — evidence portable across runtimes
Agents execute across many runtimes (Claude Code, OpenAI Agents SDK, LangGraph, AutoGen, CrewAI, and others). If evidence formats are runtime-specific, the same incident cannot be reconciled when its steps span multiple runtimes.
Suggestion: Keep the SAFE evidence record runtime-neutral so findings are portable and reconcilable regardless of where each agent step executed. A runtime-neutral evidence format prevents vendor lock-in of the safety record and maximizes cross-organization reuse.
Closing
These are offered as one possible direction for the evidence layer of SAFE — not a verdict on the proposal, which is already strong. I raise these points as a contribution to the discussion from someone working on related evidence-reconciliation questions, not as a proposal of any specific implementation. I am happy to align with the working group on any of the above and to contribute where useful.
— Niujiaxing (牛家兴)
njiaxing@gmail.com
(personal capacity; no organizational affiliation stated)