Safety Systems as Mechanical Layer
Safety built into the rules themselves, so the pause does not wait on anyone’s nerve to call it.
A table-tool sits beside the dice and waits to be used. A card with an X on it, a hand signal, a pause anyone can call. None of these does anything until a person reaches for it, and the reach costs nerve. A quieter route puts the safety inside the procedure itself, so the rules fire it without a prompt. When a game pauses at an intimate scene because the move says it pauses, no one had to be brave. The mechanic did the asking.
This article is about safety baked into the system rather than bolted on at the start. It covers four cases: dice that carry a horror contract; a character resource that turns leverage into a countable object on the sheet; a scene structure that walks a tragedy to its end on its own clock; and a design that strips out conflict so thoroughly the usual safety questions barely arise. The common thread is that the rule carries the consent or the tone, so the experience does not depend on a separate intervention landing at the right moment.
The companion to this article lives in the Players family. The toolkit of table-level instruments, the X-Card and its relatives, is Safety Tools as Design Layer. That layer is social: it depends on a group choosing to use it. This one is mechanical: it fires whether or not anyone chooses. Keep the two apart in your head, because they fail in opposite ways and a strong design usually wants both.
The Mechanism (How it works)
Two registers of safety
Safety in a game runs in two registers, and the difference decides what you can rely on. The first is the social-contract register. A group agrees before play to honour certain limits and to use certain tools, and that agreement holds only as far as the table culture backs it. The canonical category here is the Safety Contract: the standing social agreement on content and boundaries, installed at a session zero and carried by group buy-in. The second register is mechanical. The rules themselves encode a pause, a boundary, or a consent step into the procedure for resolving a scene, so it is present every session whether or not anyone discussed it.
The two are not rivals. A game with strong mechanical safety still gains from a session zero that introduces and calibrates those mechanics; a game leaning on a social agreement still gains from mechanical affordances that lower the cost of speaking up mid-scene. The real question is which register carries the primary load, and who designed that split. The rest of this article works through what the mechanical register can carry, because it is the less-charted half and the one that belongs to Systems and Mechanics.
The reason the mechanical register is worth the trouble comes down to who has to act. A social tool depends on a participant choosing to invoke it, and choosing is exactly what discomfort makes hard. A mechanic that fires on its own removes that choice from the critical path. The same logic runs through the Social Contract and Safety that a table negotiates, where the standing worry is that the most uncomfortable person is also the least able to break the moment and speak.
Strings: consent made into a resource
Monsterhearts, Avery Alder’s game of teenage monsters and the tangle of adolescent intimacy, gives the clearest example of a safety idea worn as an ordinary game resource. Its central currency is the String: a unit of leverage one character holds over another, emotional or social or situational. Strings are won and spent in play, and spending one bends the other character toward what the holder wants.
What makes this safety-adjacent is where the negotiation sits. A String does not appear from nowhere; it is earned through the fiction, in a moment that gives one character a hold on another. When it is spent, the affected player has standing to negotiate the terms of what it does. So the distribution of leverage at the table is not buried in the GM’s head. It is written on the sheets, countable, and contested out loud. The mechanic turns a soft social question, who has power over whom, into a hard object players can point at and bargain over.
The game’s other relevant mechanic is more direct. Every Skin (the Monsterhearts word for a playbook) carries a Sex Move at the foot of its sheet, and when two characters have sex the relevant move fires automatically. The table stops, the move’s effect is read out and processed, and play resumes. The pause is not a courtesy someone offers; it is part of how the scene resolves. This is the structural difference from a table tool laid bare. An X-Card pauses a scene because a participant chooses to lift it. A Sex Move pauses the scene because the rule requires it, and so the social cost of calling the pause is gone before anyone feels it.
Light and dark dice: a tone contract in the pool
Trophy Dark, Jesse Ross’s game of doomed treasure-hunters in a hungry forest, encodes its emotional contract in the colour of the dice. A risk roll is built from two kinds of d6. Light dice stand for what the character brings: a skill, a piece of gear, or a Devil’s Bargain accepted from another player or the GM. Dark dice stand for what the character risks of their mind or body. The two colours read together on a single ladder. A highest die of 6 is a clean success. A 4 or 5 is success with a complication. Anything 3 or lower fails, and things get worse.
The safety move is hidden in the dark dice. For every dark die that comes up a 1, the character marks a point of Ruin, and at six Ruin the character leaves the story. The dark die is never optional once the character is risking themselves, and as they push harder more darkness enters the pool. The effect is that the game’s downward pull is not a tone the GM chooses to set or the players agree to chase. It is guaranteed by the probability of every roll.
This is mechanical safety pointing in an unusual direction. Most safety tools exist to keep content from getting too intense. The dark die does the opposite: it makes sure the game reaches the bleakness it promised on the cover, regardless of who is running it or what mood the table is in. The safety function here is the integrity of the contract. The system delivers what it advertised, so a player who signed up for tragic horror is not quietly handed something lighter. This is the same argument a resolution method makes with the shape of its odds, turned toward tone rather than competence: the distribution is a promise about how the fiction will feel.
A caution rides along with this. A genre-contract mechanic is not a content-safety mechanic, and treating one as the other is a real error. Trophy Dark’s dark dice guarantee the horror register. They do nothing to shield a player from a specific image or theme they find harmful. A game can hold a watertight tone contract and still need separate content tools, and the dark die cannot be consented away because it carries the genre. The two functions answer different questions and want different machinery.
Ten Candles, Stephen Dewey’s tragic-horror game, runs its entire safety and doom contract through the burning-down of ten real votive candles. The candles are lit during setup and the game lasts until they gutter out; the world has ended, the dark is closing in, and every character dies before the last flame does. Resolution uses a pool of d6s equal to the candles still lit. Roll at least one 6 and the action succeeds. The scene then carries on. Roll no 6 and the action fails. A candle goes dark for good and the scene is over. One fewer die remains in the pool from then on. The pool only ever shrinks. Because the light literally dwindles on the table, the tragedy’s arc belongs to the apparatus rather than to anyone’s willingness to push the tone darker. The structure carries a contract that a table tool would otherwise have to enforce by hand. No player has to be the one who declares it is time for things to get worse.
Scene grammar borrowed from the edit suite
Some mechanical safety lives not in the dice but in the verbs a group is given to edit a scene. The line worth tracing runs from a minimal interrupt to a full editing grammar. The X-Card is a minimal protocol: it says this content must change without saying how, leaving the group to rewind, cut, or pause. Script Change, Beau Jagr Sheldon’s toolbox, supplies the missing grammar by lending the verbs of video playback to the table.
| Tool | What it does to the scene |
|---|---|
| Rewind | Revise events just past or in progress; the group agrees on the replacement |
| Fast Forward | Skip over content without deleting it from the fiction |
| Pause | Halt play; resume only when the caller asks |
| Frame-by-Frame | Flag a coming scene as one to navigate with care |
| Instant Replay | An out-of-character recap to confirm everyone shares the same fiction |
The advance over the X-Card is that scenes become editable the way a non-linear edit is editable. A Rewind can revise a scene already under way; a Fast Forward skips without erasing; a Pause suspends without closing. The group makes a fine-grained editorial choice instead of treating every kind of discomfort as the same emergency. These verbs sit closer to the table-tool layer than to the dice, so the full toolkit is treated under Safety Tools as Design Layer. They earn their place here because they show safety acquiring a procedure, a small grammar of named operations, which is the step from a social gesture toward a mechanical one.
Removing the conflict instead of guarding it
The most thorough mechanical answer is to design the conflict out. Wanderhome, Jay Dragon’s pastoral game of travelling animal-folk, has no dice, no permanent GM, and no combat. It runs on the Belonging Outside Belonging engine that Avery Alder and Ben Rosenbaum first built for Dream Askew, a give-and-take token economy in place of a randomiser. To do something whose outcome is in doubt you spend a token; to gain one you let your character be inconvenienced or you add a detail the table finds worthwhile.
The safety consequence is structural rather than added on. A game with little outward conflict has fewer of the sharp adversarial moments where a safety tool usually has to fire. The danger has not vanished, since gentle games still reach genuine emotional weight from the inside, but the machinery that would produce a hard external clash is simply not in the box. This is the cleanest illustration that safety is a property of the whole design and not only of a tool laid on top. When the resolution system itself cannot manufacture a brutal contest, the tone is held by the engine, in the same way the absence of a randomiser in a diceless resolution method is a statement rather than a gap.
The consent-in-gaming question
Underneath these examples sits a question that the design discourse of the 2020s named consent-based design: can a mechanic fire against a player’s character without that player’s agreement? It is a different question from content safety. Content safety asks what the game will contain and who can stop it. Consent-based design asks whether the rules can act on your character over your objection.
The two games above answer it in opposite ways, and the contrast is instructive. A Monsterhearts String needs relational grounding; you cannot simply be Strung without the fiction that earns it, and the affected player negotiates the spend. A Trophy Dark darkness die cannot be consented away at all, because removing it would remove the genre. Neither answer is more correct. They are deliberate choices about where the rules may reach without asking, and a designer makes that choice every time a mechanic touches another player’s character. This is the same authority boundary that Rulings vs Rules and the Authority Contract draws around the GM, seen from the side of the player whose character is on the line.
Where the mechanical register fails
Baking safety into the rules is not a cure, and its failure modes are specific. The most dangerous is complacency: a group installs a mechanic and treats safety as solved, which is worse than having nothing because it manufactures false confidence. A mechanic on the sheet does not help if the table’s culture quietly signals that invoking it is embarrassing. The mechanical register lowers the social cost of safety; it does not zero it.
Two further failures recur. A tool the group has never practised and feels no permission to use is functionally absent. That is what the brief practice-run is for. The group taps the card once in a low-stakes moment, or calls a pause and then resumes it, so that the single rehearsed use encodes the permission for the real one. A mechanic can also be captured as GM authority. Suppose the GM is the only person who ever calls a Script Change or acknowledges an X-Card. Then the tool has become fiat. Its unconditional availability to every participant was never a courtesy but its structural precondition. The pattern under all three is that a mechanism guarantees the form of safety but not the table’s relationship to it, and the design has to account for both.
A point of lineage closes the picture. The live-action tradition built this vocabulary first. The Nordic LARP scene’s Cut and Brake signals, in broad use well before the X-Card reached the mainstream, and the Open Door principle attributed to Eirik Fatland, all predate the tabletop tools that now echo them. Brake especially has no clean tabletop equivalent. It acts on intensity rather than on the presence of content, asking a scene not to escalate further rather than to stop outright. The live forms carry finer distinctions because that community ran high-intensity events with many participants for longer. The tabletop tradition mostly adopted lighter-weight versions of the same ideas. That descent is treated more fully in the Players family, in Bleed, Aftercare and Debriefing and the toolkit article above.
Where this fits
The bigger picture. Safety as a mechanical layer is the systems-side complement to the table-tool layer, and the boundary between them is the thing to hold clear. The Players family owns the social instruments, the agreements struck at session zero and the cards and signals that depend on a group reaching for them; that is Safety Tools as Design Layer. This family owns the half that lives inside the rules, where a die’s colour, a move’s trigger, a shrinking pool, or the absence of a randomiser carries the consent or the tone on its own. The two layers are complementary, and the strongest designs run both: a mechanical guarantee so the contract does not depend on nerve, and a social agreement so the mechanic is introduced, practised, and given permission to fire. Lean on either alone and you inherit its characteristic failure, the unused card or the unexamined rule.
Next steps. A mechanic that carries tone or consent is rarely a standalone widget; it is woven into the game’s resolution and its fiction. To see how a die’s distribution makes an argument about feel, the foundation is Mechanical Resolution Types; to see how a trigger and its tiers are written into the fiction so a pause or a consequence has a place to land, Moves and the Fiction-Mechanic-Fiction Loop. Because so much of this safety travels bundled into a character archetype, the Sex Move on a Skin or the Brink on a Ten Candles card, the next stop is Playbook Design. And to place a safety-bearing system within the wider design traditions it belongs to, from the indie story games where these mechanics were born to the mainstream lines now adopting them, start from the TTRPG Format Taxonomy.
Referenced by
- Blood on the Clocktower
- Distributing Narrative Authority
- Dungeons & Dragons, 5th Edition
- Horror Conventions
- TTRPG Format Taxonomy
- Thousand Year Old Vampire