Shifting the Unit of Safety: From Model to System in the Generative and Agentic Era

Abstract

For a decade, responsible AI at internet scale rested on a reassuring assumption: that risk lives primarily in a model, it is a unit you can isolate, and that privacy, fairness and safety is therefore something you certify at model level, before launch. At LinkedIn, where AI shapes access to jobs and economic opportunity for over a billion members, we built our fairness, privacy, and explainability assurance on exactly this foundation, and it worked. Then generative AI dissolved the unit, and agentic AI dissolved the boundary. When a single product's AI harness composes prompts, tools, retrieved context, and multi-turn reasoning, harm no longer announces itself simply at the model layer or at deployment time. It emerges across countless dynamic call patterns at the system level, in context of the product usage, precisely where a pre-launch gate for models cannot see it. This talk is about the architectural and philosophical shift this forces, and how a Responsible AI & Governance organization can navigate the resulting tension: the pressure to ship AI at the speed of competition, against a risk surface that evolves with an expanding suite of AI harness - prompts, tools, memory and orchestration. I will argue that safety must move from a one-time high fidelity gate to a continuous risk management property, and share how we operationalized that conviction. I will cover in-context red-teaming, which stress-tests a model inside the specific task it performs rather than in the abstract; and our move toward agentic safety, where we treat privacy as contextual integrity, enforce fine-grained access control, and push safety checks down to every ingress and egress of a core AI system, not just its final answer. Throughout, an emerging regulatory landscape (the EU AI Act and its post-market monitoring obligations) serves not as a constraint to satisfy but as a design pattern to internalize. My hope is to leave this audience at the intersection of industry-scale challenges and academic rigor with a concrete reframing and a set of open problems: How do we certify a system whose call patterns itself are highly dynamic? What does a meaningful safety guarantee mean for an agent that plans? And how do we measure all of this without collecting the very sensitive data we are trying to protect? These are LinkedIn's daily engineering reality; they are also, I will argue, some of the most consequential open research questions in the field of scalable AI Safety.