In plain English
This page explains why testing AI parts one by one is necessary but incomplete. Safe-looking parts can still produce unsafe behavior when combined.
- Why this matters: AI risk can come from the whole arrangement, not one obvious model.
- What to look for: data, memory, routes, adapters, tools, evaluators, updates, and rollback paths.
- Technical version below: the expert terminology remains available and is linked through the glossary.
The Router Smuggling Boundary
The reports treat the router as a policy engine. A router decides which adapter, model, memory, tool profileThe set of external actions an AI system is allowed to take. Open glossary definition, or evaluator sees a request. That makes router behavior part of the safety boundary.
Router-created risk
A high-risk request routed to a hardened path may be refused, verified, or logged. The same request routed to a utility-focused path may receive a different policy surface. The risk is not only the model. It is the route-selection rule and the metadata that rule sees.
Manifest requirement
Composition manifests should record router version, route labels, routing features, fallback paths, confidence thresholds, and any human-overridden route. A model certificate without router identity is incomplete for routed systems.
Defensive posture
Treat semantic routing as policy enforcement, not simple traffic optimization. Router changes need review, canary release, disagreement monitoring, and rollbackReturning a system to an earlier known state. Open glossary definition alongside model artifacts.