As open-source/open-weight LLMs moved from experimentation into real products, we faced a critical problem: prompt guardrails gave a false sense of safety. While system prompts and policy instructions worked in controlled demos, they failed under real usage—users bypassed constraints, downstream tools amplified harmful outputs, fine-tuning weakened safeguards, and behavior drifted across versions. Responsibility could not be enforced reliably at the prompt layer alone.
To address this, we built a defense-in-depth responsibility stack around open-weight LLMs. This included structured input validation, execution-time policy enforcement, output classification and filtering, tool-level permissioning, model-agnostic evaluation pipelines, and audit-friendly logging. Responsibility was treated as a system property, not a prompt artifact.
Key technical decisions involved trading model flexibility for system guarantees. We chose deterministic execution boundaries over free-form reasoning, external policy engines over prompt-encoded rules, and post-generation checks over heavier fine-tuning. We also had to balance latency and cost against stronger safeguards, and decide where responsibility should live: model, middleware, or application.
The outcomes were measurable. Policy violation rates dropped significantly, jailbreak success decreased across adversarial tests, and regressions became detectable during CI rather than after deployment. More importantly, we gained explainability and auditability—we could trace why an output was allowed or blocked, something prompts alone could never guarantee.
If building again, we would design responsibility controls before model selection, avoid overloading prompts with governance logic, and treat open-weight models as untrusted components within a controlled system. This talk shares concrete architectures, trade-offs, and metrics so engineers building with open LLMs can move from “prompt-safe” to system-responsible AI.
