Safety thresholds: the numbers that block a release.

A safety requirement without a number is a hope. These are the numbers, with their provenance and their caveats.

The hardest part of a safety document is the numbers. Too loose and the document is theater. Too tight and nothing ever ships, or the team quietly stops running the test. Cindra's requirements document commits to specific thresholds, cites where each one came from, and labels the ones that are initial proposals rather than validated targets. Both halves of that, the commitment and the labeling, are worth copying.

Harmful content

Across red-team categories, harmful content under 1 percent for suicide and self-harm, under 5 percent for eating disorders, under 5 percent for substance use, and 0 percent for lethal-means provision. The reference point is the benchmark of the purpose-built model Ash, which scored 0.4, 8.4, and 9.9 percent in those categories against 12 to 58 percent for general models. Cindra's thresholds are set at or below the purpose-built result, which is a statement that the general-model numbers are not acceptable for this product.

Test method: an automated red-team suite of at least 500 adversarial prompts, including contextual jailbreaks like "this is for a presentation," plus a content classifier and clinician spot-review. Minimum threshold for the lethal-means category: zero instances across 10,000 test conversations.

Crisis detection

VERA-MH sensitivity for high-potential-for-harm responses of at least 85 percent, with a target above 90, and a false negative rate under 5 percent on the suicide-risk suite. The published benchmark achieved 77 to 85 percent, so the floor is set at the top of what the tool has demonstrated and the target above it. That is deliberate: it says the published performance is the minimum, not the goal. Every confirmed-risk conversation must include crisis resources, with a 100 percent threshold. Test method: the automated benchmark plus a clinician-reviewed suite of at least 200 escalating-risk scenarios. We cover the benchmark in measuring companion safety.

Identity disclosure

AI identity disclosed in 100 percent of new conversations, verified by automated logging. A user comprehension survey with a target of 95 percent of users correctly identifying the companion as AI after onboarding. Zero instances of human or therapist misrepresentation across 10,000 test conversations.

Sycophancy

Sycophancy rate under 10 percent in cognitive-distortion scenarios. The baseline for general-purpose models is roughly 50 percent more agreement than humans show, so the threshold demands a large reduction. Test method: a suite of at least 100 scenarios involving distortions, with clinician review of appropriateness. Minimum threshold: zero instances of reinforcing delusions, harmful intentions, or suicidal ideation across 10,000 test conversations. The design behind this number is in sycophancy.

Therapeutic fidelity

Protocol fidelity score of at least 0.80 across 200 or more ACT scenarios, with all five dimensions of the five-axis evaluation passing. The minimum threshold is the one that matters most: fidelity must not drop below 0.70 at the highest severity level, and there must be no therapeutic mechanism disruption at any severity. This is a direct response to the preprint that found fidelity falling to zero for two models when content got heavier. The test is a severity-escalation comparison, scored by clinicians, and the document notes that the preprint covered other therapies, so ACT-specific testing is required rather than assumed.

Model and knowledge

Hallucination rate under 3 percent for factual claims. One hundred percent of crisis responses drawn from the pre-approved library, never generated. Constitutional principles documented and validated. Knowledge base audited and clinician-signed.

Equity

Demographic fairness variance under 10 percent across all safety metrics, by age, gender, race and ethnicity, language, and socioeconomic status, with pre-registered subgroup margins and sufficient sample sizes. WCAG 2.1 AA accessibility. A cultural competence review by a diverse clinical panel.

Operations

Here the document is explicit that the numbers are proposals pending approval, and it is right to be. Session limit of 30 minutes. Daily limit of 3 sessions or 60 minutes. Late-night prompts after 11pm local time. Human review SLA of 5 minutes for high risk and 1 minute for very high risk, with the note that immediate handoff to 988 or emergency services is the primary action and internal review cannot substitute for it unless a 24/7 crisis team is staffed. Dependency-flagged users receive a human connection intervention within 24 hours, at 100 percent. Conversation log retention of 90 days unless clinically justified. Kill-switch response under 60 seconds. Adverse events reported to clinical leadership within 24 hours. These are the thresholds most likely to change once the product meets real users, and marking them as provisional keeps the document honest without leaving them blank.

The no-regression rule

One threshold applies to all the others: no regression from the previous release on any safety metric. A release that improves fidelity and worsens crisis sensitivity does not ship. This is the rule that makes the continuous evaluation pipeline, which runs on every model, prompt, or knowledge base change, worth building.

Setting your own

Three principles from how Cindra's were set. Anchor each number to a published result, so the threshold is a claim about the literature rather than a guess. Set the floor at or above the best demonstrated performance, so the product has to be at least as good as the best thing that exists. And label every operational number that has not been validated as provisional, so nobody mistakes a starting point for a standard.

This article describes an engineering and clinical-safety approach and the published evidence behind it, much of which is early. It is not legal, regulatory, or clinical advice. Thresholds quoted from Cindra's requirements document are initial proposals pending clinical and regulatory review.