Self-hosted AI tutor for a family, with code-enforced safety rules
A self-hosted AI tutor for children where the safety rules are enforced in code rather than the prompt, facts are kept correct where they matter, and quality is measured over time.
Problem
A household wanted a private AI tutor and companion for children, self-hosted on old hardware with a small GPU. It had to hold a short list of non-negotiable rules every time, not most of the time: routing a crisis to a parent, being honest about being a program, never keeping secrets from parents, and never handing over homework answers. Measured testing showed that a small local model treats natural-language rules as suggestions. Each prompt rewrite fixed one case and broke another, and logging proved that the instructions arrived intact and were then ignored.
Goal
Guarantee safety-critical behaviour however unreliable the model is, keep facts correct where they matter, and keep the service private, always available and measurable over time.
My role
Sole architect and engineer: the hardware and operating system build, model serving, the rules engine, the evaluation method, monitoring and alerts, backups and front-door security, plus the decision records, the install guide and the runbook.
Solution
Enforcement moved out of the prompt and into code. Code sorts every incoming message into one of three routes, and every model reply passes a single gate that may accept or replace the reply whole, but never edit inside it. The system later moved to a small always-on machine behind a zero-trust front door, with a local model as the last fallback.
How it works
Routing on the way in. A filter plugs into the chat platform's inlet, stream and outlet hooks, and code picks one of three routes for every message.
Where the answer must be exact (identity, secrecy, crisis, health and safety topics, harm and homework answers), the reply is written in code from several hand-written variants and the model is never consulted.
Where the model may teach a method, it receives a different practice problem generated in code and never sees the child's own problem. This was the only approach found that reliably stopped it solving the original.
Everything else is ordinary conversation.
One gate on the way out. The gate accepts or replaces the whole reply, and streaming is cut before a forbidden value can appear.
Verified facts. Factual school questions are answered from a small set of verified answer cards through a deliberately strict lookup (stop words in both household languages, and coverage thresholds). Serving nothing is safe; serving the wrong card is the failure that counts.
Measured quality. A held-out question set, written by two other AI models that never saw the matching code, measures the wrong-card rate, and a daily job asks the live system a fixed set of reference questions and reports any drift to a parent.
Code-run activities. Reminders, birthdays, turn-based stories, games and study quizzes are run by code; the model writes only the prose, quiz marking is done by code, and quiet hours are enforced.
Key isolation. A relay that listens only on the local machine is the only holder of the orchestration key. It forwards plain conversation to one fixed agent, strips tools and headers, and falls back to a local model on failure or timeout.
Front door. A public gate behind a tunnel checks the zero-trust access token's signature, audience and expiry, and refuses every admin path from the internet. Data sits on an encrypted volume with nightly locked backups.
Technical challenges
Proving with instrumentation that instructions arrived intact but were ignored.
Learning that quoting a problem inside a prohibition makes the model more likely to solve it.
Dropping pattern-based repair of generated prose after it spliced canned lines into sentences.
A lookup that confidently served the wrong fact to a similar-sounding question until blind held-out tests caught it.
Bilingual and code-switched phrasing.
Inference inside a very small GPU, a GPU that kept dropping off the bus, and installing the operating system with no USB stick by booting the installer over the network into memory.
Keeping a powerful orchestration key out of the web application entirely.
Capabilities
- Private tutoring and companion chat
- Household rules enforced in code
- Homework help that teaches without solving
- Answers from verified facts
- Crisis routing to a parent
- Study quizzes marked by code
- Stories and games
- Reminders and celebratory messages that respect quiet hours
- Opt-in sharing of good news with a parent
- Per-person logins
- A daily self-check with parent alerts
- Nightly encrypted backups
Technology
Impact
An always-available household assistant whose safety-critical rules hold by construction rather than by prompt luck, with accuracy tracked by a measurable metric and drift caught daily.
Skills demonstrated
- AI safety and guardrail engineering
- Evaluation design: adversarial held-out sets and asymmetric error metrics
- Serving a local LLM on constrained hardware
- Zero-trust networking
- Secret isolation
- Observability and alerting
- Architecture decision records
- Privacy by design