# Project Guardian: A Hybrid Safety System for AI Agents > Source: > Published: 2026-11-01 05:36:58+00:00 For the research side of the independent observation channel, I would start with “AI Control: Improving Safety Despite Intentional Subversion” (arXiv 2312.06942). It assumes the agent may be trying to get around the monitor, which is the same threat model as your level-two observer. On the practical side, one thing that helped me: make the record append-only and hash-chained, so a later step cannot quietly rewrite history. I work on FerrumDeck, an alpha control plane where a run that needs approval parks as WaitingApproval, and audit events are append-only with a per-tenant hash chain. That is tamper-evident, not tamper-proof, and it only governs its own runs, so treat it as a reference, not a drop-in. What will the agent act on in the prototype: files and shell, or API calls?