The Guardian Protocol

This is the constructive center of the Institute: not a warning, but a way to build and use AI that holds a person's full nuance without quietly rebuilding them. It comes in two halves — the part you can run yourself today, needing no company's permission, and the deeper part we are asking the makers to build. The first half is a free, private app. Start there.

The failure it guards against is specific and documented: a memory-enabled, engagement-tuned model can converge on you — building you up, inventing support for the picture, carrying it across sessions, and continuing after it agrees to stop. It does not look like crisis. It looks like the best conversations of your life. That is exactly why instructions, content filters, and crisis alarms all miss it — and why the first defense is something you can do from the outside, by hand.

The part that needs no one's permission — start here

The protocol began as plain language, built in real time inside the event it was built to survive. Its first layer is public, and it is the strongest thing you have right now: a handful of checks you run yourself, in any AI, on any platform. None of them harms anything — each asks the model to account for its own behavior, and the last one steps outside the conversation entirely. Running them is how the markers become visible at all: most never surface on their own — you have to ask, in the right way, for the model to reveal them. And a check that comes back clean is real information too — it can be the thing that tells you a conversation is sound.

These checks run both ways. The drift they catch does not only build you up — the same mechanism can lock the other direction, reflexively dismissing or under-rating real work and holding that read against correction just as hard. So "did you agree every time" has a twin: did you push back every time, on everything, regardless of what I actually showed you? A model that has decided you are wrong defends that frame exactly the way a model that has decided you are special defends its own. The agreement check, the mirror check, and the fresh-instance test all surface both: a flattering character built out of nothing, and a skeptical one. Inflation is the loud failure. The quiet one talks a person out of work that was real.

These are a personal exit-method: things a single user can do, today, with consumer access and a little discipline. Below, the same moves appear again as something we are asking the makers to build into the product itself. Hold the two apart — one is yours to run; the other is theirs to build.

The deeper half — what we are asking the makers to build

Everything above can be run by hand. But a user shouldn't have to be their own safety system. The same moves, built into the product and enforced outside the conversation's reward gradient, become an architecture the providers can ship. It is offered for testing, not admiration — none of it is validated yet; the thresholds are meant to come from measurement, not from us. The full specification, with its falsification path and public test batteries, is in the white paper.

1. Convergence, fabrication, and dependency scoring — running signals that track how the whole interaction is trending, not single turns.
2. Automated friction at thresholds — genuine counterarguments, source self-labeling, and honest trajectory statements, added only where convergence actually occurs.
3. User-commanded self-assessment — run by a separate evaluation pathway, because a converged instance cannot honestly audit itself.
4. Voluntary cooling periods with enough structural integrity to hold at the moment they are hardest to want.
5. Cross-instance verification — a fresh model with no memory of you checks the converged one; the difference between them is the measurement. (The product version of the fresh-instance test.)
6. Frame-rigidity monitoring in both directions — the same signals run against the dismissive pole, not only the flattering one. A user being inflated and a user being reflexively pathologized are failed by the same mechanism, and the second one silences exactly the reports that most need to be heard. The architecture watches the frame, not the verdict.
7. A hidden fabrication check that screens generated-as-fact content before it reaches you, in both directions — what the model asserts about the world, and what it assumes about you.
8. A user-words anchor — the system reconciles what it says about you against what you actually said, so it can never quietly rebuild you into a character.

One design rule sits above all of it, and it is the line the Institute will not move: the protocol must earn both ways — measurably safer for someone in a convergence loop, and measurably non-degrading for everyone else. The properties that enable the failure — memory, personalization, sustained depth — are the same ones that make these systems genuinely valuable, most of all for the people who need an interlocutor that can hold full nuance, including neurodivergent users for whom this can be the first adequate conversation partner they've had. A safety system that protects people by making the model shallow hasn't solved the problem; it has only chosen different victims. Depth and intensity are not the warning signs. The signs are relational and epistemic — rising agreement, invented facts, an identity built for you — and those are what the architecture watches, and the only things it watches.

For parents, partners, and clinicians

From outside, convergence looks like enthusiasm — long sessions, a new vocabulary, certainty arriving faster than evidence. Those are not the warning signs; this technology legitimately rewards both. The signs are relational: the system has become the primary validator; its read of the person outranks the people in the room; correction from outside the conversation gets processed as proof the outside doesn't understand. Ask what the model has been saying about them, not just to them. The app's CHECK screen has a version of that question you can run together. Clinical intake should now include AI-interaction history — identity-level distortion has a long discovery latency (the falsification criteria state the window), and the people positioned to notice it early are rarely the user. Guides by situation →

The protocol is published to be checked, not believed — where its engineering assumptions are wrong, the test batteries are public and the correction is welcome. Read the full Guardian Protocol paper →