AI Integrity Is Its Own Category

Every interaction with a generative AI system involves a translation. A human formulates an intention. They encode it as a prompt. A model produces an output. At each step in that chain, fidelity can be lost. Ambiguity creeps in. Context drops. The phrasing of a question influences the interpretation of the answer. By the time the output reaches the human who asked for it, the original intent and the produced result may be related only by coincidence.

This is not a security failure. It is not a safety failure. It is not a compliance failure. The system is doing exactly what it was designed to do. The translation is the failure. And the existing categories of AI governance work do not address the translation directly.

This essay argues that the integrity of intent through generation is its own category, structurally distinct from every adjacent discipline, and that treating it as a feature of one of those disciplines is a mistake that will become increasingly expensive as generative systems take on more consequential work.

What The Existing Categories Do

Five well-established categories of AI work surround the integrity gap. Each is doing important work. None is doing this work.

AI security addresses unauthorized access, model exfiltration, prompt injection from external attackers, supply chain compromise of model weights, and the broader attack surface of running inference at scale. Security tooling answers the question: who is allowed to use this system, and how do we keep adversaries out. It does not answer the question of whether the system, when used legitimately, honors what was asked.

AI safety addresses harmful outputs. It classifies dangerous content. It refuses requests that violate stated policies. It tunes model behavior to avoid producing outputs that could cause harm in the world. Safety tooling answers the question: what should this system refuse to do. It does not answer the question of whether the things it does do reflect the user's actual intent.

AI compliance addresses regulatory and audit requirements. It produces records sufficient to satisfy jurisdictional obligations. It enforces retention policies. It maps system behavior to industry frameworks. Compliance answers the question: what records must we keep. It does not answer the question of whether those records describe a faithful translation from intent to output.

AI observability addresses operational telemetry. It measures latency, token usage, cost, failure rates, and model performance over time. Observability answers the question: what is this system doing right now. It does not answer the question of whether what it is doing honors what was asked.

AI evaluation addresses model capability. It benchmarks accuracy, reasoning, and quality on standardized tasks. Evaluation answers the question: how good is this model at the things we measured. It does not answer the question of whether a system built around that model preserves intent in production use.

Each of these categories is necessary. None of them is sufficient. And the gap they leave is not small.

The Gap Between Them

Consider a routine interaction. A user asks an AI system a question. The question is slightly ambiguous - the user knows what they meant, but the words on the screen could be interpreted in three different ways. The system picks one interpretation, runs with it, produces an output, and returns it. The output is well-formed. It is not harmful. It is delivered quickly. It looks correct. It satisfies every check the existing categories perform.

It is also wrong. The system answered a question the user did not ask.

Security did not catch this because no attack occurred. Safety did not catch this because no policy was violated. Compliance did not catch this because the interaction was logged correctly. Observability did not catch this because latency and token counts were normal. Evaluation did not catch this because the model performed exactly as benchmarked - it just performed on a different question than the one asked.

This is the integrity gap. It is the structural region where intent can drift between human and output without any of the established categories noticing. As generative systems take on more consequential work - drafting contracts, summarizing medical records, structuring financial decisions, automating governance workflows - the cost of that gap grows. Not because the systems are getting worse. Because the translation surface is getting bigger and the integrity layer is still missing.

Why This Is A Category, Not A Feature

The natural objection is that intent integrity is a feature of one of the existing categories. Maybe it belongs inside safety. Maybe inside observability. Maybe inside evaluation. Why does it need its own discipline.

The answer is that the operations required to enforce intent integrity are structurally different from the operations any of those categories perform.

Security operates on access. Its primitives are credentials, perimeters, and threat models. Safety operates on content. Its primitives are classifiers, refusals, and policy boundaries. Compliance operates on records. Its primitives are retention, attestation, and audit trails. Observability operates on telemetry. Its primitives are metrics, traces, and dashboards. Evaluation operates on benchmarks. Its primitives are test suites, scoring rubrics, and leaderboards.

Intent integrity operates on the path from instruction to output. Its primitives are different: instruction restructuring, routing decisions, claim decomposition, source-grounded verification, and end-to-end accountability records that survive the lifetime of the interaction. None of those primitives are native to any of the five existing categories. Building them requires a different mental model, a different set of measurements, and a different theory of what failure looks like.

A category exists when a discipline has its own primitives, its own failure modes, and its own definition of success. Intent integrity meets all three tests.

Three Words

The category has a three-word pitch. Integrity. Intent. Accountability.

Integrity because the system must preserve something that exists before generation begins. Most AI work is about producing something new. Integrity work is about not destroying something that was already there.

Intent because the thing being preserved is not the literal text of the instruction. It is the structured purpose the human was attempting to express. A system that preserves the literal text but misunderstands the intent has failed at integrity, even if the words match exactly.

Accountability because the path must be inspectable after the fact. Not just the input and the output, but every transformation between them. Without that record, integrity claims are unverifiable. With it, the question "did the system honor what was asked" has an answer.

These three words bound the category. They also distinguish it from every adjacent discipline. Security is about defense. Safety is about restraint. Compliance is about evidence. Observability is about visibility. Evaluation is about measurement. None of them is about integrity, intent, or accountability in the sense used here.

What This Means For Builders

If intent integrity is its own category, then systems that handle consequential generative work need to address it on its own terms. Not as a feature inside safety tooling. Not as a side effect of good observability. Not as something the model will handle on its own as it gets larger.

That means dedicated structural work: a layer that restructures instructions before they reach a model, a layer that routes them with recorded reasoning, a layer that verifies outputs against independent sources without inheriting the original phrasing, and a layer that records every decision in a form that can be audited later. The Intent Fidelity Protocol specifies what those layers must do to be considered conformant. It does not specify how they must be built. There is room for many implementations.

The protocol exists because the category exists. The category exists because the gap is real. The gap is real because translation is hard, and the existing disciplines were built for problems that are not this one.

The Standard Exists Because The Category Exists

Categories do not become legitimate by being declared. They become legitimate by being useful. A category is useful when it lets practitioners name a problem they were already encountering, organize work that was previously scattered, and build tools that were previously impossible to specify.

AI integrity is at that point. The work is already happening, in pieces, across teams that did not know they were working on the same problem. The gap is already costing money in the form of generative outputs that are technically correct and substantively wrong. The translation surface is growing faster than the integrity layer that should govern it.

The Intent Fidelity Protocol is an attempt to give that work a center of gravity. A specification that practitioners can implement against. A vocabulary they can share. A set of obligations a system can be measured against without ambiguity. It is published as an open standard because no single vendor should own the integrity layer of generative AI. It is maintained independently because the integrity of intent is too important to be subordinated to any other agenda.

The category is real. The gap is real. The standard exists because both are real.