I use AI heavily. The machine still can't hurt you.
3 Aug 2026
I use AI heavily in my work — and every time I ask it to review its own code, it finds new bugs. Sit with that for a second: probability-based AI, enormous coding power, and a physical world where one bug is a human–machine risk. Not using AI means being generationally crushed on productivity. Using it carries risk on every pass. How do you weigh that?
The realization: I will never finish fixing bugs
I fix bugs because I know they're there. The things I don't know — I have no way to know them. Which means I will never finish fixing bugs. Neither will AI: it just finds a different unfinished subset. So the answer can't live in anyone's vigilance — mine or a model's.
The answer: gates, like a type system
Don't fix bugs with your own cognition. Instead, classify what the machine can do wrong:
- UI-level — annoying, harmless.
- Machine won't move.
- Damages the machine.
- Hurts a person.
- Catastrophic loss.
Class by class, build hard checks the way Java, Go or Rust type systems work: wrong type, you don't get to move. The software will be wrong someday — the design's job is to make sure "wrong" has no capability to become "harm."
What this unlocks about AI
Once the gates exist in a layer neither I nor the model can author or bypass, AI's productivity becomes safe to harvest: I use it heavily, on the non-core, after my decisions. The division of labor is explicit — AI generates, I decide, the gates enforce. Safety stops depending on how careful anyone was on a given Tuesday.
What you're actually buying
Not "AI or no AI." A person who carries responsibility for the result: which risks get called out loud up front, which ones the design strips of the capability to do harm, which aren't worth fixing yet — a UI flicker gets its impact scope stated and a slot after delivery. My name is on the work.
The gates aren't a metaphor — here they are, running. A public repo implements exactly this layer: commands classified by consequence, hard preconditions per class, and an actuator kept private behind it so the caller has nothing to bypass. Eight attempts to break it, eight refusals, enforced in CI on every push. This is the thing that makes it safe for me to use AI heavily on everything else. Code →
Written from real force-controlled robotics work; all client, vendor, and product specifics removed. And in the spirit of the piece: AI helped me write this page — the thinking is mine.
This is the personal-practice piece of a trilogy. The method in full: Industrial reliability: change the denominator. The macro argument: Where value goes when building is free.
If a machine you build needs an interface, a device connection, or data that has to land somewhere else, tell me what it's costing you now. You'll get an honest read on whether it's solvable, and usually something running to look at. Start here →