Most vendors describe AI safety the same way: a careful system prompt, retrieval, and a human who reviews the output. No model card. No named model. No description of how grounding is enforced. No evals. That is a promise, and a promise is not an architecture.
In a radiation protection or outage context, the question is not whether the assistant usually gets it right. It is what physically prevents a wrong number from reaching a pre-job brief. There are only a few honest answers to that, and all of them live below the model.
A closed catalogue, not open-ended retrieval
Every question routes to a fixed catalogue of engine-backed answers. Each entry maps to a deterministic function that queries the data and returns a computed result. If a question does not match the catalogue, the system refuses with fixed text — not with model narration that improvises a partial answer. Refusal is a feature you should test in the demo, on purpose.
Arithmetic belongs to the engine
The model chooses which tool to call and how to phrase the surrounding sentence. It does not add, divide, or convert. A dose figure, a percentage of an annual limit, an accuracy comparison between estimated and actual collective dose — each is produced by code with a test suite, not by token prediction that happens to be usually right.
Enforce it in Postgres
The assistant runs under its own database role with INSERT revoked on every authoritative table. It can write to a scratchpad and nowhere else. A new table stays locked until a migration explicitly unlocks it, so the guarantee does not erode as the schema grows. The agent processes hold no privileged credential at all — there is nothing to misuse.
vantomic_agent=> INSERT INTO fact (activity_id, fact_type_code) VALUES (…); ERROR: permission denied for table fact SQLSTATE: 42501 (insufficient_privilege)
This is worth shipping as a test rather than describing in a slide. When a utility asks to be shown that the AI cannot write to the schedule, the right response is to run the attempt in front of them and let the database refuse it.
Verify after, not just before
A final check re-verifies every figure in the drafted answer against its source. A mismatch fails the response rather than shipping it with a caveat. Grounding that only runs before generation is an input filter; grounding that runs after is an output guarantee.
None of these five controls is exotic. Together they change the conversation with a nuclear IT organisation from a debate about model behaviour into a review of privileges, schemas and tests — which is a conversation that organisation already knows how to have.