add a few safeties for operating on the kernel