Routing is the step where a model decides which function or tool it should call for a given request. In evaluation, routing quality shows whether the model understands task intent well enough to select the correct action path before any parameters are extracted or code is generated.
How Routing Works
Routing is the model’s first decision point, because it determines whether the request should be sent to a search function, a calculator, a code tool, an internal workflow, or another action path. That makes routing a control problem, not just a classification label: the quality of the route strongly shapes everything that follows.
Good routing depends on intent recognition, task decomposition, and enough context to separate similar requests that need different tools. A request that asks for summarisation, for example, should not be treated the same as one that asks for data retrieval, even when both mention the same topic.
Why Routing Matters in Evaluation
In evaluation, routing quality shows whether the model can understand the user’s goal before parameter extraction or generation begins. A system can produce fluent outputs and still fail routing by selecting the wrong function, which means the failure often appears upstream of the visible answer.
This is why routing is often measured separately from final response quality. The key question is not only whether the model answered well, but whether it chose the right action path for the request it actually received. In practice, that distinction helps isolate planner errors, tool-selection errors, and instruction-following mistakes.
Routing also matters because it can change the security properties of the system. A request sent to the wrong tool may expose data unnecessarily, skip a required control step, or trigger side effects the user did not intend. For that reason, routing is frequently part of the broader trust boundary between user intent and model execution.
Common Routing Failure Modes
Routing fails in several predictable ways. The most common is overgeneralisation, where the model picks a generic answer path even though the request needs a specialised function. Another is under-routing, where the model hesitates to use a tool and instead tries to infer or invent the result.
Ambiguous prompts are a frequent cause of error, especially when the request contains multiple intents in one sentence. A user may ask for explanation, comparison, and action in the same prompt, and the model must decide whether to answer directly or split the request across tools or steps.
Routing can also fail through overconfidence in superficial cues. If the model keys too heavily on keywords, it may miss the real objective and select a path that is syntactically related but operationally wrong. That is why routing is best judged against intent, not just vocabulary overlap.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 — Access permissions and authorizations managed | Routing decides which action path or tool is authorized for a request. |
| GV.OV-01 — Oversight of cybersecurity risk management | Routing quality is a measurable governance concern for tool-using systems. | |
| Recommendation — Apply PR.AC-4 by constraining each route to the minimum tool access needed for that action. Track routing accuracy as an oversight metric for system safety and task integrity. | ||
| OWASP Agentic AI Top 10 | A2 — Tool Misuse | Routing errors can send a request to the wrong tool or action path. |
| A3 — Identity and Privilege Abuse | Misrouting can amplify a request into an action with excessive authority. | |
| A6 — Excessive Agency | Routing determines when autonomous execution is allowed versus when it should stop. | |
| Recommendation — Validate tool-selection logic so prompts cannot steer the system into unintended actions. Bind each route to the least privilege needed for the selected tool or function. Require explicit thresholds before a route can trigger autonomous execution. | ||
| CIS Controls v8 | 6.1 — Access Control Management | Routing quality affects which functions are reachable from a given request. |
| 8.2 — Audit Log Management | Routing decisions should be observable so incorrect path selection can be investigated. | |
| Recommendation — Restrict each action path to approved functions and review route permissions regularly. Log route selection and downstream tool invocation for security review and troubleshooting. | ||
Practitioner Guidance
Why practitioners should care: Routing is the point where errors become structural, because a bad tool choice can cascade into bad extraction, bad execution, and bad output. Treat routing as a distinct quality dimension when evaluating agentic or tool-using systems, rather than assuming answer quality alone proves the system understood the task.
What to watch for: High-confidence but incorrect tool selection, inconsistent routing on semantically similar prompts, and situations where the model answers directly when it should have used a function. Those patterns usually indicate that the routing logic needs clearer intent boundaries or stronger evaluation coverage.
Risk and Threat Considerations
Routing can create material security exposure when the wrong action path gives a request access to data, tools, or side effects it should not reach. In systems with privileged or state-changing functions, misrouting is not just a quality defect, it can become an authorization and containment problem.
Failure mechanism: The model misclassifies intent, selects an overly powerful tool, or routes a benign-looking request into a workflow that performs an unintended action. That can expose sensitive information, bypass intended review steps, or amplify prompt manipulation into a real execution path.
Impact: Incorrect routing can lead to data leakage, unsafe automation, incorrect transactions, or broader abuse of trust between the user, the model, and downstream tools. In high-stakes environments, repeated routing errors also weaken confidence in the whole agent or orchestration layer.
