Designing a Passively Safe API