Safety from the design and by default