Teams should push enumerable, repeatable checks into deterministic code and reserve the model for ambiguous cases where context changes the meaning of a result. That split reduces token cost, improves coverage, and makes the agent easier to test. If the same decision can be expressed as a rule, it usually should not depend on the model.
Where deterministic rules should end and model judgment should begin
The cleanest split is to make the agent do deterministic work wherever the outcome can be enumerated, validated, or repeated reliably. That usually includes parsing, schema checks, policy gates, deduplication, thresholding, routing, and other yes-or-no decisions that do not change with context. The model belongs where the meaning of the input is genuinely ambiguous, underspecified, or dependent on situational judgment.
This separation matters because it prevents the model from being used as a general-purpose decision engine for problems that engineering can specify more tightly. It also keeps the agent’s behaviour more stable across runs, because deterministic logic is easier to trace than prompt-driven judgment.
When teams follow this split, they can explain which parts of the system are rules and which parts are interpretation. That makes the design easier to review, easier to test, and easier to change without accidentally shifting the agent’s behaviour.
What belongs in code, and what belongs in the model
Use code for checks that should produce the same result every time given the same input. If a result can be reduced to a rule, a lookup, a validation step, or a bounded calculation, keep it outside the model. That applies to guardrails, policy enforcement, structured extraction, confidence thresholds, allowlists, and any other control where the decision logic should be explicit.
Use the model for interpretation tasks where context changes the right answer. Summarisation, ranking by relevance, classifying messy user intent, and resolving incomplete or conflicting signals are typical examples. In those cases, the model is helping with judgment, not replacing a rule that should have been written down.
The practical test is simple: if two engineers could write the same rule and expect the same result, it should usually live in deterministic code. If the task requires reading nuance that cannot be fully reduced to stable logic, the model can handle that layer, but it should still hand off to code for final enforcement where possible.
How this split improves reliability, cost, and testability
A mixed design gives each part of the system a job it can do well. Deterministic code reduces token usage because the model is not asked to re-decide obvious cases on every run. It also improves coverage, because edge cases can be exercised directly in tests instead of being buried inside prompt behaviour.
For operators, the bigger gain is observability. When the code owns the repeatable checks, failures are easier to reproduce, audit, and fix. When the model only handles ambiguity, a bad outcome is less likely to be caused by a vague prompt where the same input might drift across retries or model versions.
This is also the right way to reduce accidental overreach. If the model is asked to decide everything, it becomes hard to tell whether the agent failed because the reasoning was weak, the prompt was incomplete, or the input was malformed. A cleaner division narrows the failure surface.
Risk and Threat Considerations
Whenever judgment is left too broadly to the model, the agent becomes easier to manipulate through prompt ambiguity, poisoned context, or inconsistent interpretation of the same input. The risk is not only bad answers, but uncontrolled behaviour that looks plausible enough to pass review.
Failure mechanism: Ambiguous logic stays in the model path instead of being converted into explicit checks, so malformed, adversarial, or simply edge-case inputs can bypass the intended control or trigger inconsistent actions.
Impact: The agent can produce non-repeatable decisions, miss obvious violations, or take actions that are harder to test, attribute, or contain. Over time that increases operational risk, because teams lose confidence in which decisions are stable and which are prompt-sensitive.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Separating judgment from enforcement limits agent authority on sensitive actions. |
| Recommendation — Constrain agent decisions with per-action policy checks before execution. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Deterministic policy checks should enforce minimal authority for agent actions. |
| AU-2 — Event Logging | A split design needs clear logging of rule hits and model-mediated exceptions. | |
| Recommendation — Enforce least privilege so model outputs cannot exceed approved authority. Log deterministic decisions and model exceptions for review and traceability. | ||
| NIST Zero Trust (SP 800-207) | 3.2 — Policy Decision Point | Policy decisions belong in a dedicated decision function, not inside the model. |
| Recommendation — Centralize authorization decisions in a policy decision point outside the model. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | The topic is an architecture choice about where logic belongs in an AI system. |
| Recommendation — Separate rule enforcement from probabilistic inference in the system design. | ||
Practitioner Guidance
What to prioritise: Start by inventorying the decisions your agent makes and classifying each one as enumerable, policy-bound, or genuinely judgment-based. Any decision that can be expressed as a rule should move out of the model path first.
What to verify: Confirm that the deterministic layer is actually enforcing the final boundary, not merely advising the model. A common mistake is to let the model “recommend” a rule while still allowing it to override the rule in edge cases.
Decision rule: If the same input should always yield the same output, codify it. If the correct answer depends on context that cannot be reduced to stable criteria, keep the model involved, but constrain its authority to that ambiguity only.
Practitioner takeaway: The best agent designs do not ask the model to be both judge and executor; they use the model for ambiguity and deterministic code for everything that should be repeatable.
Related resources from NHI Mgmt Group
- How should security teams govern AI agents that use Model Context Protocol?
- How should security teams govern AI agents using Model Context Protocol?
- Should healthcare teams use the same zero trust model for AI agents and service accounts?
- How should teams use AI agents for authentication work without creating security debt?