Fable
Three checks before leaving the city gate
Every day, letters, bills, and drawings left Golden Leaf City through the chamber of commerce. In the past, the gatekeeper only checked whether there was a seal, not what was in the bag.
Reinforcement Learning from Human Feedback (RLHF): explained through a fable | Andy Ren Xu concept explainer
The chamber of commerce first posted a notice: confidential materials must not be shared externally. Everyone was nervous for a few days, but once busy they still sent things by mistake. Some copied entire tables, some put ID numbers into chat notes, and some handed contract screenshots to suppliers.
The new gatekeeper set up three checkpoints: one look when files leave the vault, one look when letters leave the city gate, and one look when clerks send to external mailboxes and chat channels.
Interception also has levels of severity. Ordinary mistaken sends get a reminder and a request to delete the sensitive column; highly confidential drawings require manager approval; obvious leaks are blocked outright and reported. Who, when, from where, and what was sent where must also be recorded.
Later, the chamber of commerce discovered that protecting data could not rely on a single reminder. Sensitive content often leaks while in motion, so protection must guard the route: able to identify, judge, block, and escalate serious incidents to higher authorities.
The gatekeeper also admitted that checkpoints would interfere with speed. So he turned common mistaken sends into gentle reminders, set truly high-risk materials as hard blocks, and left the few cases that needed external sending to supervisor approval.
So the guild did not block every road. Those who could safely leave the city continued on, those who could not leave stopped on the spot, and uncertain cases were escalated. Data protection turned from a slogan into judgments made along the road, and only then did it truly come close to where leaks occur. Later, when newcomers were onboarded, the old masters no longer began with abstract categories. Instead they had them review that failure: where intuition had originally been relied on, why the first patch was not enough, and how the new arrangement kept risk in a place that could be checked. Only when they could explain these details clearly, and also point out when to keep using the approach and when to escalate, were they considered to truly understand this method. Later they also had newcomers rehearse with this method: first let newcomers do it the old way and see how errors appeared; then redo it under the new rules and see which step was blocked earlier and which step left evidence. If newcomers could only recite names, they would still misuse it in similar scenarios; only those who could state the applicable boundaries, the costs, and the remedies after failure were allowed to take on work independently.