> If you can't create a safe interface and must have the function then create an unsafe function and clearly document the invariants and then rely on the user to uphold them?

Yes, that's what you do in practice. But it's no different--in principle--from the approach C programmers have to use.