An Alternative to Big Tech AI · Essay 2 of 7

AI That Stays in Its Lane

The premium is a machine that cannot cross the line into the judgements that are yours to make.

Précis. The unease about AI is usually filed under privacy. Half of it lies elsewhere, and it is harder to switch off: the worry that a machine is deciding things it has no business deciding — ranking what matters, settling a question of values, acting before a person has thought. An off-switch answers the privacy half and none of the rest. Our answer to both is a machine built to know its place, where the line between what it may do and what it may not is drawn by architecture, not by the vendor’s good manners. Some judgements can be handed to software. Others cannot, and must return to the people whose judgements they are. This essay is about that line: why a boundary you only hope for is no boundary, and why a machine that cannot take the wheel is the more useful one.

Download PDF Present as Slides Briefing PDF

Key messages — tap any line to read the section

The unease isn't only about privacyWhat people fear is a machine deciding things it has no business deciding.

An off-switch answers surveillance — and nothing of overreach.
On a Big Tech stack there is no lane, only a model that reaches as far as it's allowed.
The organising question: which decisions must never leave human hands?

Some discomfort with AI never gets near privacy. You can be satisfied your data is not harvested and still uneasy that the thing is making calls it should not make:

sorting your applicants
nudging a decision
drafting the reason you will later be held to
settling, by default, a question a person was meant to weigh.

The off-switch crowd is reacting to this too, even when they call it a privacy problem. They want the machine to stay in its lane. On a Big Tech stack there is no lane, only a model that does whatever it is prompted to do, as far as it is allowed to reach.

We began at this end of the problem, not at privacy. One question organised everything, simple to ask and hard to honour: which decisions can a machine be trusted with, which must never leave human hands, and how do you hold that line when no one is watching?

The line that isn't a matter of tasteSome judgements can be systematised; values, meaning and agency cannot.

Automating a value smuggles in someone else's value as the default.
The boundaries, plainly: values verified not automated; agency respected not simulated.
The decisions a community most needs help with sit right on this line.

The line follows the shape of the decisions themselves, not wherever a company happens to draw its product boundaries. Some things can be systematised and safely delegated: reduced to a rule, a procedure, a model. Others cannot, because systematising them destroys the thing. You cannot automate a judgement of value without smuggling someone else’s values in as the default. Meaning can be recognised, not computed; purpose preserved, not generated.

We wrote these down as boundaries, in a plain register: values cannot be automated, only verified. Agency cannot be simulated, only respected. And the one that does most of the work: whereof one cannot systematise, thereof one must trust human judgement. They are an engineering specification, written to be built rather than admired. Each says, of a class of decision, this does not get delegated to the model, and that has to be built into how the system behaves or it is a nice sentence on a page.

The decisions a community most needs help with sit right on the line:

a board weighing a conflict of interest
a clinic deciding what to disclose
a trust ruling on a member’s standing.

These are where a fluent model is most tempting and most dangerous: it will produce a confident answer to a question that was never its to answer.

A weathered bench beside a wire fence over rolling farmland, Aotearoa New Zealand

A boundary you only hope for is not a boundaryA guardrail written as a wish doesn't constrain what the system actually does.

Most 'responsible AI' is a sign asking you not to cross, not a fence.
We built the line as architecture: reserved decisions are gated to humans by the code path.
A check runs before an action takes effect — and can't be talked out of its job by a prompt.

Most “responsible AI” is a boundary you hope for. The model is asked to stay within bounds; a policy says it must; everyone agrees it should. None of that constrains what the system does when prompted sideways, because the constraint lives in language the model is free to ignore. A guardrail written as a wish is just a hope with good intentions.

We built the line as architecture. A decision that crosses into the reserved domains — values, agency, the things that must not be automated — cannot be carried out by the model alone; it must stop and return to a person. The check runs before an action takes effect, not as advice afterwards. Decisions reserved to humans are gated to humans in the code path, so “the AI decided” is not a sentence the system can produce about the things that matter. What holds the line is not the model, and no clever prompt can talk it round. It is not having a conversation. It is checking a boundary.

It is the difference between a fence and a sign that asks you not to cross. On someone else’s cloud you get the sign: the model is the product, and bounding it tightly bounds the thing they sell. When the community owns the system, the fence can be real, because no one’s revenue depends on the model reaching further than it should.

Walkers crossing tussock toward a high-country mountain pass, Aotearoa New Zealand

What the machine does insteadIt proposes; a person disposes — and the seam between them is visible on purpose.

Surfaces history, summarises threads, drafts routine text — real work taken off the plate.
Stops at the judgement itself; never crosses into what's reserved.
Every assist is logged: what was used, which model, where it ran.

None of this makes the AI useless. It makes it an instrument, which is what an instrument is for. Inside the line it does real work, and does it well:

surfaces the relevant history before a meeting
summarises a long, tangled thread
drafts a first pass of routine text
helps a newcomer find where things are
points out what a decision resembles in the record.

Every one of those is work taken off a volunteer’s plate.

What it does not do is cross the line. It proposes; the person decides. When it has assisted, the assistance is logged: what was used, which model, where it ran. A human reading the record afterwards can see where the machine helped and where the person decided. The seam between them is visible on purpose, so you are never left guessing how much of a decision was really yours. How the Village’s AI is built to stay inside that line, and how each assist is logged, is set out in plain terms at village-ai.html and ai-transparency.html.

A high-country lake below snow peaks at dusk, Aotearoa New Zealand

Why bounded is the more useful machineA machine bounded by construction can be trusted close, not kept at arm's length.

The bound is what lets you relax and hand it the tedious work unsupervised.
We don't claim it out-thinks the biggest models — we claim a better arrangement.
A community needs a capable assistant it can trust not to govern it. That's shipped.

Read this as a sacrifice, safety bought with capability, and you have it backwards. A machine you must keep at arm’s length, because you cannot tell what it will take on, is one you use timidly. A machine bounded in its construction can be brought in close, handed the tedious work unsupervised, trusted in the room, because its reach is fixed and does not depend on your vigilance. The bound is what lets you relax.

This is the deal the series keeps returning to. We are not claiming the Village’s model out-thinks the largest models in the world. It is a modest model, and we say so plainly. The claim is a better arrangement: an instrument that is yours, that stays in its lane, that cannot quietly take authority it was never given. A community does not need the cleverest oracle. It needs a capable assistant it can trust not to govern it. The first is a race no small organisation can win. The second is shipped.

Who needs the boundary mostThe people who carry responsibility they cannot delegate.

Boards, where a decision blamed on 'the system' is a decision no one is accountable for.
Clinicians and caseworkers, where overreach is harm, not inconvenience.
The principled — who wanted not the machine's absence but the certainty it stays in place.

The people who feel this first already carry responsibility they cannot delegate:

a board, where a decision blamed on “the system” is a decision no one is accountable for
a clinician or caseworker, where a machine that oversteps is not an inconvenience but a harm
a governing body with duties in law, which knows the difference between being assisted and being replaced
the principled readers this series keeps meeting, who reached for the off-switch and will recognise that what they wanted was never the absence of the machine, only the certainty it would stay where it belongs.

For all of them the promise is the same. The AI carries what can be carried and does not touch what is yours to weigh, and you can see the line, because it is built into the thing rather than printed on a page about it.

The principle the rest of the series stands onKnowing its place is the design discipline that makes everything else safe to own.

The unrewritable record works because the AI can't author a director's reasons.
The in-house model is governed by the same line about what it may decide.
A system worth trusting knows which of the two it is: instrument, not authority.

Everything that follows applies this one idea:

the record that cannot be quietly rewritten works because the machine is barred from authoring a director’s reasons
the model that stays inside your walls is governed by the same line
the control tower for operators respects the boundaries it watches over.

Knowing its place is not one feature among others. It is the design discipline that makes all the others safe to own.

A model can assist; a person must judge. A system worth trusting knows which of the two it is — in its construction, not its terms of service.

The Village is a running system, not a brochure — see it at mysovereignty.digital. The boundaries described here are the framework’s stated design discipline, enforced architecturally rather than promised in prose. — John G. Stroh, My Digital Sovereignty Ltd., June 2026.