TO CONTROL AI, WE MAY HAVE TO REDESIGN THE ENTIRE COMPUTING STACK—INCLUDING THE CHIPS
Reliable AI control may require enforceable boundaries throughout the computing stack—from permissions and networks to infrastructure and the chips themselves.
Part III of a four-part Institute for Strategic Intelligence series
The evidence is increasingly pointing toward a difficult conclusion:
Software alone may not be sufficient to keep increasingly capable artificial intelligence reliably under human control.
That does not mean software safeguards are unimportant.
Alignment matters.
Monitoring matters.
Evaluations matter.
Permissions matter.
Cybersecurity matters.
All will remain essential.
But Part II of this series established a fundamental principle:
The AI should not possess unilateral authority over the mechanisms designed to control the AI.
If increasingly capable AI can understand software, write software, operate computers, use tools and probe the environment surrounding it, then the most consequential boundaries cannot ultimately depend entirely upon instructions the AI is expected to obey.
Some boundaries must be independently enforceable.
Follow that logic far enough and something important happens.
The control problem moves through the entire computing stack.
And eventually it reaches the chips.
TODAY'S AI INFRASTRUCTURE WAS BUILT FOR A DIFFERENT RACE
The first phase of the AI revolution has been dominated by one objective:
MORE COMPUTE.
More GPUs.
More memory bandwidth.
Faster interconnects.
Larger clusters.
More electricity.
Larger models.
More capable models.
The infrastructure surrounding artificial intelligence has therefore been optimized primarily around performance.
That made sense.
Intelligence was the scarce resource.
The economic objective was to produce more of it.
But the objective now needs to change.
If increasingly capable AI creates increasingly consequential control problems, then the next generation of infrastructure cannot be optimized only for:
MAXIMUM PERFORMANCE.
It may need to optimize simultaneously for:
CAPABILITY + CONTROL.
And those are not necessarily the same engineering problem.
CONTROL IS AN ARCHITECTURAL PROPERTY
Imagine an autonomous AI agent controlling a financial account.
We could tell the agent:
Never transfer more than $10,000 without human approval.
That is an instruction.
But suppose we instead design the system so the AI literally does not possess credentials capable of authorizing a larger transfer.
A separate trusted system holds that authority.
The AI can request the transaction.
It cannot approve its own request.
That is architecture.
Now imagine an AI controlling industrial machinery.
We could tell it:
Never exceed this operating limit.
Or we could design an independent control system that physically prevents the machinery from exceeding that limit regardless of what commands the AI sends.
Again:
instruction versus enforcement.
The distinction is fundamental.
A reliable control architecture does not merely tell an intelligent system where the boundary is.
It makes crossing certain boundaries impossible without authority originating somewhere else.
That principle already exists throughout cybersecurity and safety-critical engineering.
Artificial intelligence may require us to apply it much more aggressively.
THE CONTROL SYSTEM NEEDS ITS OWN AUTHORITY
This produces a requirement that sounds simple but has enormous implications:
The system enforcing an important boundary must possess authority the AI itself does not possess.
That might mean separate credentials.
Separate memory.
Separate execution environments.
Separate network permissions.
Separate monitoring.
Separate authorization pathways.
Or separate physical control systems.
The exact implementation will depend on the application.
But the principle remains the same.
An AI should not be able to grant itself privileges simply because it has become intelligent enough to understand how privileges are granted.
That means the architecture must establish a hierarchy of authority.
And the AI cannot sit at the top.
THIS IS WHY THE PROBLEM MOVES DOWN THE STACK
Start with the model.
We align it.
We monitor it.
We restrict its tools.
But the model runs inside a runtime.
So the runtime imposes additional restrictions.
The runtime operates through an operating system.
So the operating system imposes permissions.
The operating system communicates across networks.
So network infrastructure imposes additional boundaries.
Credentials determine what systems can be accessed.
Cloud infrastructure determines what resources can be used.
Independent monitoring systems observe what is happening.
Eventually every one of those software mechanisms executes somewhere.
On processors.
Using memory.
Through network interfaces.
Across physical machines.
Which means the chain of authority ultimately reaches hardware.
MODEL
↓
RUNTIME
↓
OPERATING SYSTEM
↓
IDENTITY AND PERMISSIONS
↓
NETWORK
↓
COMPUTE INFRASTRUCTURE
↓
CHIPS AND HARDWARE
The important insight is not that every safety mechanism must exist inside a semiconductor.
It shouldn't.
The insight is that the most important controls need roots of authority outside the model's unilateral control.
Hardware can provide some of those roots.
WE ALREADY KNOW HOW TO DO PARTS OF THIS
This is not science fiction.
Modern computing already contains mechanisms designed around exactly this principle.
Hardware roots of trust can establish identities and verify whether systems are running authorized software.
Trusted execution environments can isolate sensitive computation from other software operating on the same machine.
Secure boot mechanisms can prevent unauthorized code from becoming part of the trusted computing environment.
Memory-protection mechanisms can prevent one process from accessing memory belonging to another.
IOMMUs can restrict what devices are permitted to access.
Cryptographic keys can be protected inside hardware security modules rather than exposed directly to application software.
Confidential-computing technologies can isolate data and workloads even from privileged software elsewhere in the system.
These technologies were not invented specifically to contain superhuman artificial intelligence.
But they demonstrate an important principle:
Hardware can enforce boundaries software running above it cannot simply wish away.
The AI-control problem may require extending that principle dramatically.
WHAT WOULD AN AI CONTROL ARCHITECTURE LOOK LIKE?
We do not know yet.
That uncertainty should be stated plainly.
But we can identify some of the questions engineers will increasingly need to answer.
Should an AI agent have a cryptographically verifiable identity?
Should every consequential action be attributable to a particular model or agent?
Should certain credentials be inaccessible to the AI itself?
Should an AI be physically prevented from accessing particular memory regions?
Should network destinations be enforced independently of the software agent?
Should models operate inside isolated execution environments whose permissions they cannot modify?
Should particularly consequential actions require authorization from an independent processor or external system?
Should AI systems possess immutable logging that the model cannot erase?
Should operators be able to revoke an AI's authority through a mechanism outside the AI's control?
Should compute resources themselves enforce limits on what particular models or agents are permitted to execute?
Those questions take us into a new design space.
The objective is no longer simply:
How quickly can the chip perform AI computation?
It becomes:
How quickly can the system perform AI computation while preserving independently enforceable human authority over what that intelligence can do?
THIS COULD CHANGE WHAT AN AI CHIP IS DESIGNED TO DO
Today's leading AI accelerators are extraordinary machines.
They were built to perform enormous amounts of computation efficiently.
That will remain essential.
But performance may eventually become only one dimension of competition.
Future AI processors and the systems surrounding them may increasingly compete on:
performance
energy efficiency
memory bandwidth
security
isolation
verifiability
identity
permission enforcement
auditability
controllability
This does not mean the GPU disappears.
It does not mean Nvidia suddenly becomes obsolete.
It does not mean today's data centers were mistakes.
Those conclusions would go far beyond the evidence.
The more interesting possibility is subtler:
The definition of a superior AI computing system may change.
The winning architecture may not merely produce more intelligence per dollar or more intelligence per watt.
It may also produce more controllable intelligence per dollar and per watt.
That would represent a major change in what the industry is optimizing.
THIS IS POTENTIALLY AN ENORMOUS INVESTMENT QUESTION
The world is committing extraordinary amounts of capital to artificial-intelligence infrastructure.
Semiconductor fabrication plants.
Data centers.
Electrical generation.
Transmission infrastructure.
Cooling.
Fiber.
Networking.
Memory.
AI accelerators.
Cloud infrastructure.
Much of this investment rests on the expectation that demand for AI computation will continue increasing rapidly.
That assumption may remain correct.
In fact, solving the control problem could require more infrastructure, not less.
Independent monitoring consumes compute.
Redundant control systems consume compute.
Secure execution environments create overhead.
Verification consumes compute.
Logging consumes storage.
Isolation can reduce utilization efficiency.
Multiple independent systems may be required where one system previously sufficed.
So the control thesis does not necessarily imply:
FEWER DATA CENTERS.
It could mean:
DIFFERENT DATA CENTERS.
It does not necessarily imply:
FEWER CHIPS.
It could mean:
MORE SPECIALIZED CHIPS.
And it does not necessarily mean:
LESS AI INVESTMENT.
It could mean that enormous amounts of investment begin migrating toward a different optimization target.
NVIDIA IS NOT NECESSARILY THE LOSER
This distinction is especially important for investors.
It would be tempting to reduce this argument to:
If AI hardware has to change, Nvidia loses.
That conclusion does not follow.
Nvidia could be one of the companies that builds the new architecture.
Existing GPU platforms already incorporate increasingly sophisticated confidential-computing and security capabilities.
Hyperscalers could build additional control layers around accelerators.
CPU manufacturers could play larger roles.
Networking companies could become more important.
Cybersecurity companies could develop AI-specific authorization and monitoring infrastructure.
New semiconductor companies could emerge.
And entirely new categories of AI-control hardware may appear.
We do not yet know where the economic value will accumulate.
But we can identify the potential shift:
CONTROL COULD BECOME A NEW AXIS OF COMPETITION ACROSS THE AI INFRASTRUCTURE STACK.
If that happens, investors should not merely ask:
Who supplies AI compute?
They should eventually ask:
Who supplies trusted AI compute?
THE DATA CENTER MAY BECOME A CONTROL SYSTEM
That leads to an even larger possibility.
Today we tend to think of an AI data center as a factory for computation.
Electricity enters.
Compute happens.
Intelligence emerges.
But a future AI data center may increasingly need to function as something else:
a containment and control architecture for machine intelligence.
Different workloads may require different trust zones.
Some models may have no external network access.
Others may communicate only through authenticated gateways.
Particularly capable models may operate inside isolated environments.
Critical actions may require independent authorization.
Monitoring systems may run separately from the AI workloads they observe.
Hardware identity could establish which models are allowed to execute on which systems.
Logs could be maintained outside the model's ability to alter them.
Emergency controls could exist outside the software environment entirely.
The data center would therefore not merely provide computation.
It would define the boundaries within which intelligence is allowed to act.
That is a very different conception of AI infrastructure.
AND THAT COULD CREATE AN ENTIRELY NEW INDUSTRY
Every major technological transition creates new bottlenecks.
The internet created cybersecurity.
Cloud computing created cloud security.
Digital finance created enormous identity, authentication and fraud-prevention industries.
Artificial intelligence may create something even larger:
THE AI CONTROL INDUSTRY.
Companies could compete to provide:
agent identity,
permission systems,
AI firewalls,
independent monitors,
secure runtimes,
model authentication,
hardware-backed authorization,
AI-specific network security,
immutable audit systems,
containment infrastructure,
and physical control mechanisms.
Safety would no longer be something bolted onto an AI product after development.
Control would become part of the product architecture itself.
And that would change where economic value is created.
THE NEXT GREAT AI ENGINEERING PROBLEM
The first great engineering problem of modern AI was:
How do we make machines intelligent?
The industry has made extraordinary progress.
The next problem may be considerably harder:
How do we give increasingly intelligent machines enormous useful capability without giving them authority we cannot reliably revoke?
Software will be part of the answer.
Alignment will be part of the answer.
Monitoring will be part of the answer.
Networks will be part of the answer.
Identity will be part of the answer.
Hardware will be part of the answer.
The final architecture will almost certainly evolve as the technology does.
But one principle should guide the design:
The intelligence cannot be the ultimate authority over the mechanisms designed to control the intelligence.
If we take that principle seriously, then the AI infrastructure revolution may still be in its early stages.
Because the enormous computing systems being constructed today were built primarily to answer one question:
How do we create more intelligence?
The systems we build tomorrow may have to answer another:
How do we create extraordinary intelligence while ensuring that humans remain in control?
And answering that question may require redesigning the entire computing stack—
including the chips.
Next in the series:
PART IV — AMERICA FEARS SLOWING AI WILL HELP CHINA. BUT CHINA HAS A CONTROL PROBLEM TOO.
SOURCES AND FURTHER READING
NIST — Zero Trust Architecture
NIST — Hardware-Enabled Security: Trusted Cloud
Google DeepMind — Securing the future of AI agents
View Google DeepMind’s GDM AI Control Roadmap
NVIDIA — Confidential Computing on H100 GPUs