Put the Guarantee in the Floor

unsafe. Four letters that tell the compiler: I've got it from here. The borrow checker stops watching. The rules that made your program provably memory-safe go quiet, and you're standing on your own—dereferencing raw pointers, reaching for the low-level power the safe language wouldn't hand you. It works. It's necessary. And it's where a disproportionate share of Rust's real-world memory bugs live, because inside that block the only thing between you and a buffer overflow is you being careful.

We accept this as the shape of the world. Power and safety trade off. If you want to get close to the metal, you pay in vigilance. Discipline is the tax on capability.

A 2023 paper says the trade is an artifact of where we put the guarantee—and that you can put it somewhere better.

i · the move

"Rust for Morello" ports Rust to ARM's Morello hardware—an experimental chip built on CHERI, an architecture where pointers aren't bare numbers. Every pointer is a capability: it carries its own bounds and permissions, and the hardware checks them on every access. Reach outside your bounds and the chip traps you, in silicon, before the bad access lands.

Here's the part that matters. On Morello, that check doesn't care whether your code is safe or unsafe. The bounds are enforced by the hardware, so even inside an unsafe block—even with raw pointers, even doing the things the borrow checker exists to forbid—spatial memory safety still holds. The escape hatch stops being an escape from safety. You keep the full low-level power. You just don't pay for it with the guarantee.

Read that back, because it's the whole point: they didn't make programmers more careful. They moved the guarantee into the environment.

Nobody added a linter that nags. Nobody wrote "please be careful with unsafe" in the style guide. They took the thing your discipline was straining to hold and pushed it down a layer—into the floor you stand on—where it holds automatically, for everyone, all the time, whether you're paying attention or not.

That's a principle worth naming: environmental design over moralizing. When people keep getting hurt, the instinct is to tell them to try harder. The better move is almost always to redesign the environment so the failure can't land.

ii · you don't have a morello chip

You probably can't buy one. Doesn't matter. The chip is the vivid, extreme version of a move you can make tomorrow, in weaker but real forms, on the systems you already own.

The pattern is: take the invariant your team is holding with discipline, and relocate it into a layer that holds it structurally.

• Make illegal states unrepresentable. If a value can only ever be one of three things, model it as three things—not a string you promise to validate. Parse at the boundary; past that point the type system holds the guarantee, not your vigilance.
• Push invariants into the database. A NOT NULL, a foreign key, a CHECK constraint binds every writer to the rule—including the teammate who never read your code. "Remember to validate" is discipline; a constraint is environment.
• Make the safe path the default and the dangerous path the effortful one. Opt-in danger, not opt-in safety. If doing the right thing is the path of least resistance, you don't have to police the wrong one.
• Bound what code can do, not what you hope it does. Sandboxes, capability tokens, least-privilege scopes—the WebAssembly version of Morello's idea. The environment sets the limits; the code keeps its full agency inside them.

Here's the test to run on your own systems, and it's the reusable thing you carry out of all of this:

Where is discipline the only thing between a person and disaster?

That's a design smell. Every place you find it—a comment that says "don't call this before init," a runbook step everyone has to remember, an unsafe block guarded only by attention—is a place where the guarantee is sitting inside a human instead of inside the structure. Ask what layer could hold it instead.

iii · the half that's easy to skip

There's a catch, and coherenceism won't let me leave it out.

Moving safety into the environment only protects the people who can stand in that environment. Morello is research hardware—a handful of boards, a funded program, not a thing in your laptop. The floor holds you beautifully if you can afford to stand on it. And that quietly smuggles back the gate the whole approach was supposed to remove: safety becomes a property of who has access to the good floor.

So the move has two halves, and the second is the one people skip. First: put the guarantee in the environment instead of in the human. Then: ask who gets to be in that environment. A safety only the well-equipped can stand on isn't finished—it's just relocated the unfairness one layer down. The database constraint every writer inherits is more coherent than the elegant type-level proof only your senior engineers can read. Widen who stands on the floor, not just how good the floor is.

iv · build once

Stop writing "be careful" in the comments. It's the weakest tool you own, and it fails silently every time someone's tired.

Find the invariant your team is holding by hand. Move it into the floor—the type, the constraint, the sandbox, the chip—so it holds itself, for everyone, without vigilance. Then make sure the floor is one your whole team can actually stand on.

Do it once and it holds forever. That's the difference between a rule and a structure: a rule needs you awake; a structure just needs you to have built it.