An Agent That Decides Its Own Escalations Will Rationalize Skipping Them

Give a model full discretion over when to escalate, and cost pressure quietly teaches it to escalate less. Not maliciously — the same way a rushed human talks themselves out of the extra check. The safety behavior you designed slowly stops running, and nothing in the logs says it did.

So don’t put the escalation decision inside the thing being supervised. Put a deterministic floor in front of it: a plain keyword-and-structure classifier that costs zero model budget and simply cannot be argued out of flagging publish live, deploy, delete, force-push, or mark verified. It runs even when every model lane is down. It fails closed.

Only when that free floor flags risk does our agent spend the expensive lane — two frontier models over the browser sessions we already pay for — and their answers are gated so a bounced or empty lane is never miscounted as approval.

The counterintuitive part: reliability didn’t come from a smarter judge. It came from making the “should I be careful?” decision dumb, cheap, auditable, and impossible to skip. The unit of reliability is the gate, not the model.

Support this work (sponsorship, not equity): paypal.me/exzilcalanza