Safe Mode: Unblocking an Org-Wide Agentic Rollout

Context

We were rolling out Claude’s agentic tooling — Claude Code, Cowork, Claude in Chrome, MCP connectors — across the whole organization, with executive approval. Those tools are useful precisely because of what they can reach: your files, your browser session, your terminal. The reach is the product and the attack surface at the same time.

Security review, reasonably, wanted guardrails first, so the rollout was gated on a training requirement.

The default answer to a training requirement is a slide deck. It satisfies the letter of the requirement while failing its intent, and everyone involved knew that at the time. So I set a different bar: something a person would choose to open, finish in one sitting, and send to a colleague afterwards. The bet was that security awareness only works at the level of instinct. The goal was never that people have access to the information — it was that they make the right call when a client sends them a suspicious project file.

Three formats, one lesson

The first version was a reference document. A polished interactive explainer: each product, its access level, its attack surface, the real incidents, the defenses, a quiz. Accurate and complete, and dense. It read like documentation because it was documentation — fine for the security-curious, invisible to everyone else.

The second restructured around personas. How do you use this? — four paths, each showing only its essentials. That halved the perceived length and was a genuine improvement. But every path was still paragraphs and risk boxes. Better-organized density is still density.

The third abandoned the document metaphor. The honest diagnosis was that the format was the problem, not the content. Safe Mode became an arcade-style card run: pick your path, then tap through one idea per screen.

The lesson generalizes past this project: when engagement is the bottleneck, information architecture cannot fix what the format is breaking. The question stopped being how to organize the content and became what the smallest unit of learning is — and what makes someone want the next one.

What I built

Safe Mode — a bilingual (English/French) security game that runs about three minutes. Four role-based paths and three card types: Intel (a fact), Habit (a reflex), and Your call (a decision with instant feedback). Roughly every other card is interactive, so a player is doing something rather than reading. A streak counter, a progress bar, and a rank at the end, from Loose Cannon to Security Champion.

It ships as a single HTML file: no dependencies, no build step, and no backend of my own to run or secure. The advisor below is live because the runtime it publishes into supplies the model access.

Alongside it, a companion safety video with a full voiceover script, fact-checked against the official documentation. That pass caught real misconceptions in the script about how the permission modes work.

Design decisions

Every card holds about 25 words. The ceiling did the editing for me: it forced each fact to earn its place and each habit to be phrased as an action. The dense first-version content didn’t disappear — it moved into an optional field guide behind the results screen, sourced, for whoever wants the depth.

Real incidents, never hypotheticals. Every risk is anchored to something that actually happened: an agentic tool leaking files that contained Social Security numbers within 48 hours of launch, and CVE-2025-59536, where opening a project file was enough to execute code. “This is theoretically possible” bounces off people. “This happened, here is the link” does not.

A live AI advisor, inside the training. The feature I’m happiest with: a screen where someone describes what they are about to do and gets a SAFE / CAUTION / RISKY verdict with one concrete precaution. It is context-aware — asked from a results screen, it knows which path you played — and an I’m feeling lucky button pulls from a curated bank of 22 questions, including the ones nobody thinks to ask, like what actually gets retained and what sandboxing really covers. The button fills the box rather than sending it — deliberately, so people see how the question gets phrased.

There is an irony I decided to lean into rather than hide. A training that says don’t blindly trust AI output contains an AI advisor. So the advisor carries a permanent disclaimer — guidance, not policy; ask your security contact when in doubt — which is the habit the training is teaching, demonstrated on itself.

Distribution as a requirement. No backend meant no leaderboard, so social pressure had to travel by copy-paste: one tap produces a shareable line carrying your score, your best streak, and a challenge. Deciding where the thing would live turned out to determine what it could do, which is not the order these decisions usually get made in.

Bilingual as an authoring decision. Not a translation pass at the end: the deck was written in both languages, down to French typography like the non-breaking space before a question mark. An organization in Québec that trains only in English has not trained the organization, and a half-translated deck tells everyone exactly what the training was worth to whoever made it.

The unblocking was not technical. I proposed the sequence — publish the training first, then request the capability — which turned “move fast” and “prove it’s safe” from competing positions into an ordered plan both sides could endorse. The engineering was a few working sessions. That conversation was the actual work.

Impact

The training shipped, the guardrail requirement was satisfied, and the organization was granted the agentic capabilities the rollout had been gated on.

The part that surprised me: people who played it liked it, and said so unprompted. That is an uncommon outcome for security awareness training, and it is the clearest evidence I have that optimizing for retention rather than mere completion was the right call.

What stays open is the content. The decks want rotating as the threat landscape moves — a second season, once the first set of instincts has settled and the traps that worked have stopped surprising anyone.

Safe Mode was built for one organization’s rollout and doesn’t leave it. If you want something pointed at yours, the Pre-Flight Checklist asks twelve questions about how your engineering org actually works with AI and scores it in about four minutes. Think of it as the free tier.