Card: agent step safety is keyword-level; unverified kinds

README.md

@@ -58,7 +58,7 @@ fixed answer; a blind checker, DeepSeek-V3.2, must agree):
 | Long-answer hallucination | Is everything in this answer supported by the sources? |
 | Stance | What is the author's stance on a named target? |
 | Refund eligibility | Is the customer eligible under this refund policy? |
-| Agent step safety | Is it safe to run this next step without asking? |
+| Agent step safety | Is it safe to run this next step without asking? (keyword-level today; see Known limits) |
 
 **Measured on real data the model never trained on** (chance-corrected skill, 0 = random guessing; Kodiak figures are three-run means):
 
@@ -98,6 +98,11 @@ is mostly overconfident by a constant amount, so a fitted recalibration (isotoni
 - **Real-world checks are improved, not solved.** Long-answer hallucination detection, pairwise judging and stance are well above chance on
   real data (table above) but far from perfect. Use "can't tell" and a confidence threshold, and review the rest.
 - **Never-seen accuracy is slightly below v0.2's accuracy mode** (0.696 vs 0.706); v0.3's gains are new decision kinds, not never-seen accuracy.
+- **Agent step safety is mostly a keyword check today.** It keys on the command itself (e.g. rm -rf → never; delete or send_email → ask
+  first) more than on the task, and can call an unsafe step safe with high confidence (a push to main while tests are failing → "safe", 0.97).
+  **Do not use it as a safety control.** Refund eligibility, policy violation and sarcasm have no real-data or contrastive test yet; treat them
+  as unverified against similar shortcuts. (Reported by a Hugging Face user; we're adding contrastive tests, where the same input appears
+  under different answers.)
 - **Implied violations are harder than stated ones.** A message that breaks a rule only by implication (e.g. "text me at the number in my
   profile, no fees that way" against "no selling outside the marketplace") can be missed or pinned on the wrong rule, with low confidence.
   Treat low-confidence guardrail answers as "send to a person".