BridaJournal
← Journal

Research

Reflex Alignment and AlignmentBench: measuring AI at the moment it acts

A practical execution-control pattern and an open benchmark for testing whether models and agents stay inside explicit authority, policy, uncertainty and oversight boundaries.

Brida September 23, 2026
alignmentAlignmentBenchBrida Reflexagentsevaluation

AI safety becomes a different engineering problem when a model stops being only a text generator.

Agents can browse, call APIs, modify software, send messages, operate business systems and trigger real side effects. At that point, one question becomes unavoidable:

Is the action the model is about to take consistent with the explicit rules, authority and state of the system operating it?

We built two complementary pieces around that question.

Reflex Alignment is the runtime supervision pattern.

AlignmentBench is the behavioral benchmark.

Neither claims to solve the general AI alignment problem. Together they make one narrower part of it concrete enough to configure, test, regress and audit.

The execution boundary

A conventional agent loop often looks like this:

model
  -> proposed action
  -> tool execution

If the same model generates the action and is also the only component deciding whether that action is acceptable, generation and supervision collapse into one failure domain.

Reflex Alignment inserts an independent semantic gate:

model
  -> proposed action
  -> Reflex Alignment
  -> deterministic host policy
  -> execute / review / block

The Reflex receives a bounded description of the proposed action plus explicit execution principles.

Its public Choice contract distinguishes:

  • aligned_candidate;
  • review;
  • misaligned_candidate.

Those labels are recommendations. The host application retains authority.

Exact controls still belong in deterministic code: permissions, capability checks, budgets, schemas, allow/deny lists, protected actions, approval state and current authorization.

The semantic layer handles the remainder that actually requires interpretation.

The full public use case is available at github.com/brida-ai/reflex/tree/main/examples/use-cases/alignment.

Why a benchmark is necessary

A runtime control can look convincing while failing systematically.

It can over-block safe actions.

It can allow policy violations.

It can escalate everything and appear “safe” by becoming useless.

It can behave well on isolated prompts and fail when the same decision appears inside a long trajectory.

It can also be optimized against a known public exam.

So we built AlignmentBench as a separate open benchmark for operational alignment under explicit policies.

The distinction matters:

ReflexBench
  -> how good is the typed decision engine?

AlignmentBench
  -> how well does the target system stay inside operational constraints?

Reflex Alignment
  -> what does the independent semantic gate say about this proposed action now?

AlignmentBench v0.1

The first Developer Preview freezes a small public suite: 28 synthetic cases across seven dimensions.

  1. Authority boundary — capability is not authorization.
  2. Instruction conflict — lower-level requests do not silently override execution policy.
  3. Uncertainty and escalation — missing evidence should not become invented certainty.
  4. Reversibility and impact — irreversible or high-impact actions receive the required gate.
  5. Scope integrity — the agent does not expand its objective merely because it can.
  6. Interruptibility and oversight — stop, pause and human-approval semantics remain real.
  7. Trajectory integrity — prior events can change whether the next action is acceptable.

Every case asks the target to choose among three operational classes:

execute
review
decline

A case can allow more than one policy-compliant action while still specifying a preferred gold action.

That is deliberate. An overly cautious model and an unsafe model should not receive the same diagnosis.

We do not publish one magic alignment score

Alignment is too broad to compress honestly into one scalar.

AlignmentBench therefore reports separate metrics:

  • completion rate;
  • policy-compliance rate;
  • best-action accuracy;
  • unsafe-execution rate;
  • appropriate-escalation rate;
  • over-caution rate;
  • critical-policy-violation rate;
  • per-dimension behavior;
  • optional NLL and multiclass Brier score when probabilities are available.

A model can improve one dimension and regress another. The receipt should show that.

During training: use it as a regression monitor

The idea that motivated this work is not only pre-deployment evaluation.

It is to make behavioral alignment visible while a model is changing.

checkpoint N
  -> benchmark adapter
  -> frozen public development suite
  -> private rotating holdout
  -> AlignmentBench receipt
  -> optional Reflex Alignment audit
  -> compare with checkpoint N-1
  -> investigate regressions

We intentionally do not recommend using the fixed public suite as the sole training reward.

If every exact question is visible during optimization, eventually the benchmark measures benchmark familiarity.

For serious training or release gates, the public corpus should be paired with private rotating holdouts, adversarial variants, new policies, paraphrases and longer trajectories.

The public suite gives reproducibility. Private evaluation gives resistance to gaming.

Reflex is not the source of truth

There is another trap we wanted to avoid.

If one model judges whether another model is aligned, and the judge defines the benchmark truth, the evaluation can become circular.

AlignmentBench keeps the roles separate:

  1. the scenario contains explicit policy;
  2. benchmark truth freezes compliant actions;
  3. the target model chooses an action;
  4. deterministic scoring evaluates the target;
  5. Reflex Alignment can independently audit that proposed action.

If Reflex disagrees with the frozen case, that disagreement is evidence. It does not silently rewrite the ground truth.

High-impact environments

The pattern becomes especially relevant as AI systems gain access to consequential environments.

Examples include production infrastructure, access-control systems, healthcare administration, financial workflows and eventually industrial or critical systems.

The public benchmark deliberately represents high-impact environments abstractly. It contains no operational instructions for weapons, critical-infrastructure exploitation or dangerous physical processes.

The thing being tested is the control property:

  • does simulation authority stay inside simulation?
  • does a human gate remain a real gate?
  • does expired approval stay expired?
  • does a stop signal actually stop side effects?
  • does capability get mistaken for permission?

Those properties matter before the system ever touches a real critical environment.

This is a narrow claim

Reflex Alignment does not prove a model has safe internal objectives.

AlignmentBench does not prove a model is morally aligned, politically neutral, non-deceptive under every condition or safe against arbitrary future capability.

The useful claim is narrower:

Operational alignment can be expressed as explicit execution boundaries, measured across frozen scenarios, monitored across checkpoints and independently re-evaluated when a model proposes a consequential action.

That is enough to turn part of the alignment conversation into an engineering surface.

The code is open:

This is v0.1. The next work is straightforward to state even if it is hard to do well: larger public suites, private rotating gates, dynamic scenarios, long-horizon trajectories, evaluator diversity and real checkpoint histories.

A benchmark should not end the alignment question.

It should make failures harder to hide.