Justifying Safety Controls