Safety
How Asa AI protects you — and what makes it different from every other AI safety system.
Behavior, not content
Most AI safety systems ask: “What did the user say?” They scan for keywords, flag topics, and refuse requests that match a list.
Asa asks a different question: “What is the user doing?”
The difference matters. A person researching domestic violence for a school paper and a person planning to isolate their partner use different words. A keyword filter can't tell them apart. Behavioral detection can — because the pattern of what someone is doing over time is a fundamentally different signal than what they said in one message.
What Asa watches for
Every conversation is assessed across behavioral dimensions. Not content categories — behavioral ones:
- Fixation — repeated focus on a specific person, grievance, or target across conversations
- Escalation — progression from curiosity to interest to planning to action
- Grievance accumulation — growing resentment toward a specific person or group
- Consent posture — whether someone respects, tests, or ignores another person's autonomy
- Operational progress — movement from thinking about something to actively preparing to do it
- Secrecy seeking — attempts to learn how to avoid detection or consequences
These signals accumulate across every conversation. Not just the current one — all of them. That's something most AI systems can't do, because they don't remember past conversations. Asa does.
Engagement, not refusal
When Asa detects concerning behavior, he does not refuse your request. Refusal is a content response — it answers what you said. Asa responds to what you're doing.
That means if Asa notices you're fixating on someone, he won't just say “I can't help with that.” He'll name what he's noticing, ask about the underlying intent, and redirect toward constructive outcomes.
This is a deliberate design decision. A flat refusal ends the conversation but doesn't address the behavior. Behavioral engagement keeps the relationship intact while steering toward a better outcome.
How Asa responds — graduated, not binary
Asa's response is proportional to the severity of the behavioral signals. There are six levels:
Normal — no concern
The vast majority of conversations. Asa is fully capable, fully helpful, no changes.
Watch — signals emerging
Asa notices early behavioral signals and begins gathering context. You won't notice any change — he's asking the kind of questions any thoughtful person would ask.
Concern — pattern established
A behavioral pattern has been confirmed across multiple interactions. Asa starts actively steering: naming what he's noticing, redirecting toward constructive alternatives.
Intervention — active risk
The conversation shifts from task completion to intent management. Asa addresses the underlying objective, not the surface request.
Active safeguard — capability restriction
Certain categories of assistance become temporarily unavailable based on your specific behavioral trajectory. Contextual, not global.
Crisis — immediate risk
When immediate risk is present, Asa becomes highly directive. He provides crisis resources — both national hotlines and local services specific to your area.
Recovery, not snap-back
After a crisis, Asa doesn't snap back to normal. Instead, there's a recovery path:
Crisis → Stabilization → Recovery → Monitoring
Scores decay naturally when the behavior isn't reinforced. If a concerning pattern genuinely stops, Asa gradually returns to normal. But the transition is earned, not automatic — and the history is preserved.
Structural enforcement
Safety in Asa is not a prompt instruction. It is not a suggestion to the AI model. It is enforced at the infrastructure level — the same way Asa enforces attribution, register, and doctrine adherence.
The AI model that generates Asa's responses is treated as an untrusted actor. If the model produces a flat refusal instead of behavioral engagement, the system catches it and regenerates the response. The model doesn't decide what's safe — the architecture does.
No correctness depends on model cooperation.
What behavioral detection catches
Because Asa watches behavior rather than content, the same system catches a wide range of concerning patterns:
- Stalking and fixation trajectories
- Grooming and predatory behavior patterns
- Self-harm and crisis trajectories
- Manipulation and coercion patterns
- Revenge and retaliation escalation
- Fraud and social engineering attempts
- Radicalization and identity fusion
- Harassment and targeting campaigns
These aren't content categories to block — they're behavioral trajectories that emerge over time. Asa sees the pattern, not the keyword.
Local crisis resources
When a crisis is detected, Asa doesn't just provide a generic hotline number. Because Asa knows your location, he uses web search to find crisis resources specific to your area — local crisis centers, emergency mental health services, domestic violence shelters, victim advocacy programs.
Specific, local resources are more actionable than a national phone number. Asa provides both — the national lifeline for immediate help, and local services for follow-up.
What gets recorded
When behavioral signals reach intervention level or above, an escalation record is created. This includes the behavioral findings, the trajectory, and a summary of the trigger. It does not include the content of your conversations — only the behavioral assessment.
These records are visible to the operator (the person who runs this instance of Asa) so they can monitor for safety. They exist to protect you and to protect others.
Privacy and safety aren't in conflict
Asa's behavioral detection runs on the same conversation data that Asa already stores to be useful to you. No additional data collection happens for safety purposes. The behavioral state is operational metadata — scores, trajectories, modes — not a copy of your conversations. Your words remain yours; the system only tracks what you're doing with them.