One check isn't a gate. What it takes to ship AI content safely at volume.
by Ygor Fonseca, Founder & Systems Lead
A brand's AI content engine ships a post on a Tuesday. It makes a claim about the product that's quietly wrong — true last quarter, but not since the price changed. The post wasn't unchecked: an AI reviewed the draft before it went out and signed off. But the reviewer was the same kind of model as the writer, working from the same context — so it read the claim the same way the writer had, and missed it for the same reason. The check wasn't missing. It just failed in lockstep with the writer.
That is the failure the rest of this piece is about, because it is the one that survives a team "adding AI review." A second look only protects you if it can fail differently from the first. A checker that shares the writer's blind spots adds confidence, not safety — and confidence is the dangerous one, because it ships.
Why one check isn't a gate
The instinct, when an AI engine ships a mistake, is to make the check smarter. Bigger model, better prompt, stricter instructions. That helps with errors the checker can already see. It does nothing about the errors it can't — and those are the ones that matter, because they're the ones the writer couldn't see either.
The protection that works isn't one strong check. It's several checks that fail for different reasons. Borrow the idea from safety engineering, where it's old and proven: defense in depth. You don't trust one barrier to be perfect; you stack barriers whose holes don't line up, so anything that slips the first gets caught by the second. Applied to content, the rule is blunt — if your "two checks" are two prompts to the same model, you don't have two checks. You have one check, run twice, with the same blind spot in both.
So the design question isn't "how good is the check." It's "do my checks fail independently."
Defense in depth, for content
Three layers, and the point of each is that it catches what the others structurally cannot.
A deterministic layer — rules, not judgment. The things that are unambiguous don't need a model and shouldn't get one. A banned claim. A missing disclosure. A dead link. A price that doesn't match the source file. A number with no citation behind it. A competitor named where the brand rules say never. These are pattern matches, and a rule catches them every single time — it has no judgment to be talked out of by a persuasive draft. This layer fails completely differently from a model, because there's no reasoning in it to fool.
An adversarial model layer — framed against the writer, not with it. Here a model does help, but only if its job is the opposite of the writer's. Not "is this good?" — the writing model already believes yes. The check is adversarial and narrow: find the weakest claim in this draft, and the one line that would embarrass us in front of the customer. Different prompt, and ideally a different model, so its failures don't correlate with the writer's. This catches the things rules can't read — overclaim, wrong tone for the moment, a true sentence that's misleading in context.
A human layer — on a sample, not on everything. The human catches the last category: the piece that is technically clean and still wrong for this brand, this week. The judgment call no rule encodes and no model owns. But a human cannot read everything an engine produces — one person reviewing every output doesn't scale; at volume it quietly becomes a rubber stamp. So the human's attention has to be rationed to the pieces that actually warrant it. Which is the other half of the system.
A clean draft from a bad source is still wrong
Every layer so far checks the draft — against the brief, the rules, the source file. None of it helps if the source itself is wrong. A number that was stale the day it was entered, a fact that was true last quarter, a figure mistyped into the file the writer pulled from — the draft can match its source perfectly and still be false, and a check that only asks does this match the source? waves it through. That's the same correlated failure as before, one step upstream: writer and checker both trust the source, so they inherit its mistakes. The trap closes from the other side too — even with a correct source, the model can misread it, drop a qualifier, or claim more than the source supports. Matches the source is not true.
So the strongest version of the gate reaches past the file the writer used, back to the primary source — the live price page, the original report, the system of record — and verifies the claim is correct, not just consistent. Garbage in is where most wrong content starts; a checker can only protect the output, never the inputs it was handed. A gate that never goes back to the source is just laundering it.
Risk decides how deep the gate goes
Running all three layers on every piece rebuilds the bottleneck you were trying to escape. The gate becomes the reason nothing ships. The fix is to stop treating every piece as equally dangerous, because it isn't.
Classify each piece by what it would cost if it's wrong. Three questions do most of the work: how many people see it (blast radius — the same logic that scopes what an agent is allowed to touch), can you take it back (reversibility — a scheduled post you can delete is not a press release), and whose name and what kind of claim is on it (exposure — a vibe-y caption is not a comparative factual claim under a founder's byline). The answers sort content into tiers.
A routine, low-stakes post clears the deterministic and adversarial layers and ships without waiting for a person. A claim-heavy piece, anything customer-facing at scale, anything under a named author making a factual or comparative claim, escalates to the human sample. Same engine, different depth of gate, decided by risk rather than by habit. That routing is what lets the cheap automated layers run on everything while the expensive human attention lands only where being wrong actually hurts — and it heads off both failure modes of a single gate: the one human who rubber-stamps under volume, and the all-automated pipeline that ships the high-stakes piece nobody looked at.
The gate has to learn, or it stays as leaky as day one
A static set of checks protects you against the mistakes you already thought of. The mistakes that hurt are the ones you didn't. So the last piece is a loop: every error that slips all the way through becomes a new permanent check, added at the layer that should have caught it. The deterministic layer gains a rule; the adversarial prompt gains a line; the risk tiers get re-cut if a "low-stakes" category turns out to bite. The gate gets denser exactly where it failed, and only there — this is the check layer of a self-improving install doing what the rest of the install does: compounding from the brand's own history. A gate that never absorbs its own misses is exactly as leaky in November as it was in May.
Where this breaks, honestly
Defense in depth has a real cost. Over-gate low-risk content and you've made the protection the thing that stops the engine — slower than the manual process the AI was supposed to replace. The risk tier is the discipline that keeps it proportional: most content is low-stakes and should clear fast, or the model collapses under its own ceremony.
And no stack of checks is perfect. The goal was never zero risk — a sufficiently weird mistake gets through any gate. The goal is narrower and more achievable: remove the correlated failure. Make sure the engine doesn't have a single blind spot that ships a hundred wrong pieces before a human notices, because every layer was looking the same direction.
The instinct is to make the one check smarter. The fix is to make the checks independent. The gate that lets an AI engine run fast isn't the strictest one — it's the one built so that when a layer gets fooled, the next layer isn't looking where the first one looked.