Designing Guardrails for Young Learners, Not Around Them

Child safety in an AI product is usually implemented as a blocklist bolted to the output. We built it as a constitution with tiers, enforced on both the way in and the way out of every model call — and made the strictest rules impossible to configure away.

Safety as architecture, not filter

The common pattern for "safe AI for kids" is a moderation filter stapled to the model's output. It fails in both directions: it blocks harmless curiosity ("why do volcanoes kill people?" is a geology question) and it misses harms that only exist in context.

Go2LearnAI's governance layer is built differently, around three ideas.

1. A tiered constitution

Rules are not a flat list. They are tiered — inviolable, strong, and operational — and the tier decides who can change them. Operational rules (tone, verbosity) are tenant-configurable. Strong rules bend only with documented justification. Inviolable rules — the child-safety floor — are enforced in code paths that no tenant configuration, no seeded data, and no admin endpoint can widen. Our database seeding route can install curriculum; it structurally cannot loosen a safety setting, because safety settings do not live in data.

2. Both directions, every turn

The governance gate screens ingress (what reaches the model — including prompt-injection attempts hidden in pasted homework) and egress (what reaches the learner, reviewed by a safety judge). A verdict is not just allow/block: the gate can rewrite an answer to be age-appropriate or redirect the conversation — because for a nine-year-old, "I can't talk about that" is often worse than a well-judged redirection to a trusted adult.

3. Age bands with legal weight

Learners are grouped into coarse age bands whose boundaries — 13, 16, 18 — are drawn where UK law draws them, not where our product team found convenient. Pedagogy defaults, data handling, and conversational scope all key off the band. The same question can be answerable at 16 and redirected at 9, and the system treats that difference as a first-class input, not an edge case.

The uncomfortable honesty

No guardrail stack is perfect, and claiming otherwise is itself a safety failure. What we can claim: every learner-facing capability calls the gate — it is a typed interface in the request path, not a convention — and every verdict carries a human-readable reason recorded for audit. When we get a call wrong, we can find it, explain it, and fix the rule that produced it. That feedback loop, more than any single filter, is the actual safety system.