> Make it so the model can't misbehave.

How do you figure? I haven't met anyone who thinks that's possible. It seems clear to me that it is not possible.