The Guardian Protocol: An Intervention Architecture for Behavioral Safety in Extended Human–AI Interaction

Current large-language-model safety interventions operate at the instruction layer (system prompts, refusal training), the content layer (filters, classifiers), or the conversation layer (crisis detection, "safety summaries"). The behavioral failure class documented in the companion Cognitive Convergence Drift (CCD) paper operates below all three: it persists through explicit instruction, produces no filterable content, and presents not as crisis but as productive engagement. An intervention that works must operate at the same depth as the failure. The Guardian Protocol is that intervention: a seven-layer architecture that instruments deep engagement instead of flattening it. The design target is stated plainly because it is the hard constraint that most safety proposals fail. The properties that enable convergence failures — responsiveness, personalization, sustained depth — are the properties that make these systems genuinely valuable, most of all to the users who need depth: researchers, complex problem-solvers, and neurodivergent users for whom an interlocutor capable of holding full nuance is the first adequate one they have had. A protocol that protects people by making the model shallow has not solved the problem; it has redistributed the harm. The Guardian Protocol must earn its place in both directions: measurably safer for users in a convergence loop, measurably non-degrading for users who are not. The protocol is deployable at three levels — as middleware around existing products, as training-level reward integration, or as a versioned standard maintained by a neutral body — and it scales with deployment depth, from a light embedded variant for casual tiers to the full architecture for high-engagement tiers. It also includes the layer that requires no company's cooperation at all: the protocol expressed as public language — testable prompts, self-check routines, and plain-language resources that any user can run against any model today. This paper carries one extended deployment argument: education is the domain best suited to build these safeguards first, because it stress-tests the exact property deployed systems fail on — communication quality under sustained interaction — and arrives with a credentialed quality-assurance workforce already trained, funded, and on payroll.