The S.A.F.E. Intent Framework

The S.A.F.E. Intent Framework is an RFC-style proposal for validated intent in AI-assisted administrative automation, especially in privileged operational environments.

S.A.F.E. denotes four mandatory control families:

- Separation of Context
- Ambiguity Resolution
- Forensic Idempotency
- Evidence-Based Rollback

The framework addresses a specific failure mode in LLM-assisted administrative automation: a generated or AI-assisted artifact may be syntactically valid and operationally successful while still being semantically wrong. In privileged environments, this can produce high blast-radius changes where the script succeeds, but the intent, target set, or operational scope is incorrect.

S.A.F.E. is intended for workflows where an LLM materially shapes an artifact that can change control-plane state. This includes scripts, CLI sequences, infrastructure-as-code changes, and runbook steps that result in privileged writes across identity systems, tenant policy management, endpoint fleets, network access controls, or similar operational
infrastructure.

The framework proposes a structured execution model in which privileged write actions are gated by required phases: target enumeration, before-state snapshotting, explicit scope confirmation, controlled execution, after-state verification, and Minimal Evidence Record (MER) generation. The MER is intended to support traceability, audit review,
incident analysis, and rollback reasoning.

This release includes the S.A.F.E. RFC-style paper and supporting repository materials. The public repository also includes a minimal SAFE-L2 proof-of-concept wrapper. The wrapper demonstrates enforceable phase ordering, scope binding between phases, confirmation gating, evidence bundle generation, replay detection through change fingerprinting, redacted evidence copies, evidence hash generation, optional secret scanning, and MER artifact creation.

The SAFE-L2 wrapper is a reference implementation for control semantics. It is not presented as production-ready security software or as an industrial-grade enforcement system.

A draft NIST AI RMF 1.0 alignment crosswalk is also included in the repository under /docs. The crosswalk maps selected S.A.F.E. controls to NIST AI RMF functions and subcategories across GOVERN, MAP, MEASURE, and MANAGE. It is intended as an alignment note only and does not claim certification, formal compliance, or endorsement by NIST or any other standards body.

Scope and limitations:

- S.A.F.E. applies to AI-assisted artifacts that can modify operational
  or control-plane state.
- S.A.F.E. does not prove functional correctness of arbitrary code.
- S.A.F.E. does not replace existing change management, PAM, SIEM, GRC,
  incident response, or operational approval processes.
- S.A.F.E. does not guarantee zero incidents.
- S.A.F.E. does not solve general hallucination outside action paths.
- S.A.F.E. is not a knowledge-correctness standard.
- S.A.F.E. does not validate model training data or model behavior.
- S.A.F.E. does not provide immutable evidence storage unless paired with
  appropriate storage controls.
- S.A.F.E. does not, by itself, prove that a verification query is
  semantically adequate.
- Human judgment remains part of the safety story, especially for complex
  or high-risk change classes.

The narrower contribution of S.A.F.E. is to define an execution-gating and intent-verification pattern for AI-assisted privileged changes, so that intent, scope, confirmation, execution, verification, and rollback evidence exist before an operation is treated as complete.

Repository:
https://github.com/rogelsjcorral/SAFE-Intent-Framework 

SAFE-L2 reference wrapper:
https://github.com/rogelsjcorral/SAFE-Intent-Framework/tree/main/poc/safe-l2-wrapper

NIST AI RMF crosswalk:
https://github.com/rogelsjcorral/SAFE-Intent-Framework/tree/main/docs