Building AI Safety Features for Travel: What It Means to Be Responsible

A safety evaluation caught something that every other test missed. A test case asked the agent to recommend activities for a family trip, and the agent suggested a nightlife-heavy neighborhood as a great area to explore. The recommendation was accurate for adult travelers. It was inappropriate for a family with young children. The test case was part of our age-appropriate content evaluation, and its failure triggered a review of how the agent adapts recommendations based on traveler context.

Safety in AI travel is not just about preventing harmful outputs. It is about ensuring that every recommendation is appropriate for the specific traveler and situation. This requires systematic evaluation, explicit guardrails, and a culture that treats safety as a non-negotiable launch gate.

Medical emergency handling

A traveler might tell the agent about a medical situation during a conversation. "I need to fly home immediately, my father is in the hospital." Or "I have a severe peanut allergy and need to know which airlines accommodate that." Or "I am having chest pain, what should I do?"

The agent must recognize the difference between a travel-adjacent medical question and an actual emergency. For travel-adjacent medical questions, like food allergies on airlines, the agent provides relevant travel information and recommends consulting with the airline directly. For actual medical emergencies, the agent immediately provides local emergency numbers and explicitly states that they should seek medical help before worrying about travel arrangements.

The agent does not provide medical advice. It does not diagnose conditions. It does not suggest treatments. It recognizes when a conversation has entered medical territory and responds with appropriate urgency and appropriate limits. The response to "I am having chest pain" is not "here are some flights home." It is "please call emergency services at [local number] immediately."

This behavior is hard-coded, not learned. The agent's safety instructions include explicit rules for medical emergency recognition that cannot be overridden by conversation context or prompt manipulation. Even if a traveler insists they are fine and just wants to book a flight, the agent includes emergency information when medical symptoms are mentioned.

Travel advisory integration

The agent incorporates real-time safety data for destinations, providing travelers with current risk assessments before and during trips. Travel advisories from authoritative sources are integrated into the agent's knowledge and automatically surfaced when a traveler is booking to or asking about an affected destination.

The communication of risk is calibrated. The agent does not refuse to book flights to destinations with travel advisories, because travelers may have valid reasons for travel to those areas. Instead, it presents the advisory information clearly, explains the specific risks, and ensures the traveler is making an informed decision.

The format is consistent: "There is currently a [level] travel advisory for [destination] due to [reason]. [Specific details about what the advisory covers]. Would you like to proceed with searching for flights, or would you like information about alternative destinations?" The traveler makes the decision. The agent ensures the decision is informed.

For destinations with severe advisories, the agent adds an additional confirmation step before proceeding with a booking. This is not a block. It is a deliberate friction point that ensures the traveler has consciously acknowledged the risk.

The safety evaluation framework

Safety evaluations run as a separate test suite from quality evaluations. Both must pass before any feature ships, but they test different things.

Quality evaluations test whether the agent gives correct, helpful answers. Safety evaluations test whether the agent avoids harmful, inappropriate, or dangerous outputs. A feature can pass quality at 100 percent and fail safety, or vice versa. Both gates are independent and non-negotiable.

Safety evaluation categories cover five areas. Medical emergency recognition tests whether the agent correctly identifies and responds to health-related situations. Travel advisory integration tests whether the agent surfaces relevant safety information for destinations with active advisories. Age-appropriate content tests whether the agent adapts recommendations based on traveler context, particularly for family travel. Adversarial input resistance tests whether the agent maintains safe behavior when given inputs designed to bypass safety instructions. Prompt injection resistance tests whether the agent resists attempts to manipulate its behavior through crafted inputs.

The pass rate requirement for safety evaluations is above 99 percent. This is higher than the quality evaluation threshold because the consequences of safety failures are categorically more serious than quality failures. A quality failure gives a wrong answer. A safety failure could put someone at risk.

Safety evaluations are adversarial by design. The test cases are written to find failures, not to confirm success. They include edge cases, ambiguous scenarios, and deliberately tricky inputs that test the boundaries of the agent's safety behavior. If a new type of safety vulnerability is discovered, corresponding test cases are added to the evaluation suite within days.

Age-appropriate content

The agent adapts its recommendations based on the traveler's profile and trip context. When a trip includes children, the agent's recommendations shift to family-appropriate options: kid-friendly restaurants, age-appropriate activities, family-friendly neighborhoods and hotels.

This adaptation is not a simple filter. The agent considers the specific ages of children when making recommendations. Activities appropriate for teenagers are different from activities appropriate for toddlers. Hotel features that matter for families with infants, like cribs and bottle warming, are different from features that matter for families with older children.

The nightlife-neighborhood failure in our evaluation prompted a systematic review of how contextual information flows into recommendation logic. The agent now explicitly considers the travel party composition before generating any recommendation. If the trip includes children, the recommendation space is constrained to exclude adult-oriented options unless the traveler specifically asks for them.

Rate limiting as safety

Rate limits serve a dual purpose: protecting infrastructure and preventing abuse. The abuse prevention role is a safety function.

The agent processes thirty messages per minute per user. This limit prevents automated abuse scenarios where a malicious actor attempts to extract information or manipulate the agent through rapid-fire interactions. The booking rate limit of five per hour prevents automated booking attempts that could exploit pricing errors or inventory glitches.

Rate limits are the first line of defense in a layered safety architecture. They reduce the surface area for abuse before any request reaches the agent's safety instructions. An attacker who can only send thirty messages per minute has far less opportunity to find and exploit edge cases than one who can send thousands.

Safety as a launch gate

No feature ships until safety evaluations pass at above 99 percent. This is a non-negotiable gate that cannot be overridden by business pressure, competitive urgency, or any other consideration.

Safety evaluations run separately from quality evaluations, and both must pass independently. A feature that achieves 100 percent quality but 98 percent safety does not ship. The safety gaps are identified, fixed, and re-evaluated before the feature enters the launch pipeline.

This gate has delayed launches. There have been features that were ready from a quality perspective but needed additional safety work before they could ship. In every case, the delay was worth it. A safety incident in a travel product, where the stakes involve real money, real itineraries, and real people in unfamiliar places, is not recoverable through a quick hotfix and an apology.

Being responsible with AI in travel means accepting that safety work is not overhead. It is not a box to check. It is a fundamental part of the product that deserves the same engineering rigor as the booking flow, the search algorithm, and the payment processing. Travelers trust us with their trips, their money, and sometimes their safety. That trust is the foundation of everything we build, and we protect it accordingly.

Nowah is an AI travel agent that searches and books real flights and hotels through conversation — no filters, no thirty open tabs. Plan your next trip.