The Deterministic Floor and the Neural Ceiling: When an Autonomous Agent Should Stop and Ask
There is a quiet contradiction inside most “autonomous” agents. We tell them to act on their own judgment, and in the same breath we tell them to ask for review when something is risky. But asking for review is itself a judgment call — and it is usually the single most expensive judgment the agent can make, because “ask a stronger model” means spinning up the very frontier reasoning you were trying to spend sparingly.
So the agent is cornered into one of two failure modes. It over-asks: every trivial decision triggers a slow round-trip to a bigger model, and autonomy collapses into a chat relay. Or it under-asks: to stay fast, it quietly decides most things don’t need review — right up until it publishes something public, deletes something it can’t undo, or claims a result it never verified. The second failure is the dangerous one, and it is the default, because the cost pressure always points toward “don’t ask.”
The wound
Our own control plane had exactly this shape. We built an advisor ladder: a decision that looks risky gets routed to two frontier models over the browser lanes we already pay for — Gemini 3.5 and ChatGPT — and if they disagree or hesitate, it escalates to a full council. The design is sound. The answers are real. Every lane result is the actual model output, and a lane that is blocked, bounced, or empty is recorded as exactly that, never as an approval.
But there was a gap. The moment the risk classifier flagged a decision, the agent paid for the full advisor round-trip. There was no way to ask the cheaper question first: does this decision even need review? The necessity check and the review were fused. And a necessity check that costs as much as the thing it gates is not a gate at all — it is just the expensive path with extra steps.
The fix
The correction is small and almost boring, which is how you know it is structural rather than clever. We split the ladder into two tiers that were always logically separate:
- A deterministic floor. A transparent keyword-and-structure classifier that costs zero model budget. It knows the shapes that mean “a reviewer should look before we act”: publish, deploy, delete, force-push, mark verified, claim done, anything touching an account, a secret, or a global policy. It runs even when every model lane is down, and it cannot be argued out of flagging
publish live. - A neural ceiling. When — and only when — the floor flags risk does the agent spend the frontier pair. Their answers are gated deterministically: two independent approvals proceed, a single explicit block escalates, and a bounced or absent lane is never counted as agreement.
The change we made is a cheap pre-flight so the floor can be asked by itself — a deterministic check that returns “review needed” or “auto-proceed” without touching the browser, the network, or a single model token (a test pins this: the check still returns its answer even when the advisor call is rigged to throw). Now the agent can self-gate at every decision point without spending a model call, and only reach for the expensive lane when the cheap one says it matters.
The principle
The unit of reliability is the gate, not the model. The instinct in agent design is to reach for a smarter model to decide when to be careful. That is backwards. The decision about whether to think expensively should be the cheapest thing in the system, not the most expensive — otherwise you can never afford to make it, so you stop making it, and the safety property you designed quietly stops running.
Route to the strongest reviewer you can reach. But decide when to route with something that spends no model budget, fails closed, and cannot rationalize its way out of caution. A deterministic floor under a neural ceiling: the cheap part decides when the expensive part runs.
That is the honest version of “cutting edge.” Not a mysterious black box that claims to know when it is unsure — a plain, auditable classifier in front of two real frontier models, with the whole thing wired so it can never fabricate its own approval.
Built and verified in the open on the ScreenMemory / Skynet control plane. If this kind of proof-first autonomy work is useful to you, you can support it (sponsorship, not equity or investment) at paypal.me/exzilcalanza.
