The agent stack is growing a reflex layer

For the last few years the default architecture for AI software has been strangely simple. Something happens, send it to an LLM. Classify an email? LLM. Choose which tool to call? LLM. Score a lead, decide whether a ticket is urgent, check whether an action needs approval, work out which agent should receive a task? LLM, LLM, LLM, LLM.

It works. We have effectively hired a very capable reasoning engine to make thousands of tiny decisions. But it may not be the architecture we keep, because a new class of models is appearing around a different premise: not every decision requires generation. Sometimes software does not need an answer written in English. It needs a decision.

01 · The missing layer between code and the LLM

Traditional software is good at deterministic decisions: if amount > 10,000 then require approval. Large language models are good at ambiguous ones: does this customer sound like they are about to churn? The problem is the space between.

A large share of agentic work consists of decisions that are too fuzzy for an if statement, too repetitive to justify a frontier model, bounded to a known set of outcomes, and needed constantly during execution. Which department should receive this request — billing, technical, sales, security? How urgent is this incident — low, medium, high, critical? Is this action risky enough to require human review?

Today we mostly solve these by prompting a model, generating tokens, asking for JSON, parsing the JSON, validating the schema, and retrying when something unexpected comes back — all to make a decision that could have been three probabilities. That is the gap a new category of decision models is aimed at.

02 · What Jev actually is

On 15 September 2026 TypeSafe AI released Jev and called it the first System One Model: in the company’s words, “a new class of frontier models built to make fast, structured decisions that software can use directly”.^[1] The name is doing marketing work — System One is a vendor’s coinage for an emerging category, not an established model class — but the interface underneath it is the part worth reading.

Figure 1

The interface change, which is the whole architectural story

You send program state and a set of typed questions. You get back a typed value per question with a probability attached. The model is not composing an explanation token by token, and it cannot: Jev does not generate text at all.^[1][4] Its three question types are the whole surface area.^[5]

Question names and shapes as documented in the first independent write-up.^[5]

Everything else follows from that. Here is the published specification, as stated by TypeSafe and by the first independent write-up to actually use it.

↔ scroll table

That distinction matters more than any multiple in the launch post, because it is the one that changes what you have to build. An LLM call that returns JSON needs defensive code around it. A decision model does not — which means the interesting risk moves from will this parse to is this calibrated, and calibration is much harder to notice when it fails.

03 · Which numbers survive a second look

The figures circulating this week are real, published and mostly the vendor’s own. That is not an accusation — a launch post is supposed to make a case. It does mean the numbers need sorting by who measured them and against what, before any of them reach an architecture decision.

↔ scroll table

The one independent test so far

A reproducible benchmark published on GitHub ran 10,000 decisions across four public datasets — SST-2, AG News, Emotion and BANKING77, the last of which routes among 77 confusable intents — on a single machine, CPU only, batch size one.^[6] It compares Jev against a 149M ModernBERT cross-encoder, a bi-encoder with a small learned decision head, and a generative baseline.

Jev takes the top score at 79.3% macro accuracy with enriched option descriptions. The 149M open cross-encoder lands at 78.7% — 0.6 percentage points behind, on a laptop, with no network. The bi-encoder with an eight-float head reaches 69.9% at 15.7 ms per decision.

Three caveats from the author, all of which cut in different directions, and all of which are the reason this benchmark is worth more than the marketing: the 381 ms Jev latency observed there is “almost entirely network” rather than compute; the open models had their temperature fitted on 1,000 labeled examples while Jev received no such tuning, which favors the open side on calibration; and a single run with one seed moved ±2 percentage points on subsamples, so the 0.6 pp gap is inside the noise.^[6]

There is a fourth finding in that benchmark which is really a warning about all of them: there is no neutral set of option descriptions. Enriching the labels with one-sentence descriptions improved bi-encoders by 6.3 points on average and hurt cross-encoders by 4.3.^[6] How you word the options is part of the system, not part of the prompt. If you benchmark two decision models with one wording, you have measured the wording as much as the models.

04 · Thirty reproductions in a week

The more interesting signal is not Jev’s numbers. It is how fast the idea was reproduced. Within days of the launch a community index was tracking more than thirty open implementations and adjacent projects — encoders, logit readers, models trained from scratch, and one iPhone app.^[7] Neither the launch post nor the TypeSafe homepage mentions a paper, open weights or published training data,^[1][3] and the reproductions are what happens when an interface is published without them.

↔ scroll table · a selection from the community index^[7]

Older technology belongs in the same conversation. Encoder models like GLiNER handle schema-conditioned extraction and classification locally, on a CPU, with confidence scores and labels supplied at runtime^[8] — not a Jev clone, but the same architectural idea: specialized models doing bounded cognitive work without invoking a general-purpose model for everything. Libraries that constrain decoding, like Outlines and Instructor, get you part of the way from the other direction, by forcing an existing model’s output into a declared shape.^[7]

The names will change. Some of these projects will be gone by Christmas. The architectural idea is worth separating from any individual vendor, and that is the part of this story that will still be true next year.

05 · Small brain is not small LLM

Imagine an inbound support agent receiving: our production database has been unreachable for twenty minutes and none of our customers can log in. A language model would write you a paragraph and a JSON object with an explanation field. The system does not need the explanation yet. It needs three answers and their confidence.

Figure 2

What the system needs before it needs a paragraph

DEPARTMENT · CHOICE

technical0.96

billing0.01

sales0.01

other0.02

PRIORITY · CHOICE

critical0.91

high0.08

medium0.01

low0.00

INCIDENT · NOUL

incident: yes0.98

incident: no0.02

CONFIDENCE > 0.90

continue automatically, log the decision

0.60 – 0.90

continue and flag for sampled review

BELOW 0.60

escalate to a reasoning model, then to a person

Now the probability is not metadata printed next to the answer. It is part of the control flow: above a threshold the agent continues, in the middle it continues and flags, below it escalates. Which is where the terminology usually goes wrong, because we think about AI architecture in terms of model size — small, medium, large — when the useful distinction is what a component is for.

A small brain is not a smaller GPT. It is a machine dedicated to one kind of cognition: a lead-fit brain, an intent brain, a routing brain. None of them writes an essay. Each makes one class of decision repeatedly, which is exactly the shape of the work an agent does between the moments that look impressive in a demo: which context to load, which tool to use, whether to ask, whether the result is suspicious, whether this needs approval, which specialist should handle it, whether the task is complete.

Figure 3

The reflex layer, and what sits under it

We send all of those questions back through the same general reasoning engine today. There is no reason that has to stay true — and once it stops being true, the agent stops looking like one intelligent model connected to tools and starts looking like an engineered system with parts.

What this does to a Process Brain

At auxfirst we use Process Brains for governed machines built around one repeatable job. The load-bearing word has always been process, not brain: what the work is, which context matters, which decisions exist, where autonomy is permitted, how outputs are validated, where a human stays involved. Decision models make the inside of that machine more specialized — a context router, an intent classifier, a risk read, a priority read, a main reasoner, a validator, a policy gate, an escalation path — and the question stops being which model we use and becomes which component owns which decision. That is the question agent-first architecture is written to answer, and it is software architecture rather than prompt engineering.

06 · Cognitive routing

For years, optimization around LLM applications meant prompts: better instructions, better context, better examples. Agentic systems add a different optimization problem — which cognitive work should reach the large model at all?

Suppose an agent makes a thousand decisions while completing a workflow. The shape of that distribution, not the quality of any single prompt, is what determines the cost and the latency of the whole thing.

Figure 4

Where a thousand decisions could go

700 Deterministic rules220 Bounded, fuzzy — a decision model70 Small-model reasoning9 Frontier reasoning1 Human judgment

If all thousand go to the largest model, the problem is not that your prompt is inefficient. The architecture is. The goal is to route each unit of cognition to the cheapest mechanism that can decide it safely — sometimes code, sometimes retrieval, sometimes a classifier, sometimes a decision model, sometimes a small model, sometimes a frontier model, sometimes another person.

Cognitive routing has a second-order effect that the cost table does not show. Cheap decisions multiply actions, and actions have to be checked by somebody. We named that constraint verification throughput in the Publisher Agent Map: the number of agent outputs a qualified person can genuinely check in a day. Routing a decision to a model that costs a thousandth as much does not make the review cheaper. Speed moves the bottleneck; it does not remove it.

07 · A probability is not a permission

This is where decision models meet the part of the work we actually do. Agentic experience design is about delegation: when should an agent act, when should it ask, when should it explain, when should it stop, when should it bring in a human. Those look like interaction questions. Underneath, many of them are decision functions — and now they are cheap.

Consider an outbound agent about to send an email. It could evaluate five bounded questions before acting: is this reversible, does it reach an external party, is sensitive data present, does policy require approval, is model confidence sufficient. Each is a noul question. Each returns a number. Feeding those numbers into a gate is an obvious move, and it is where the obvious move goes wrong.

The version that holds is two dials with two owners. Consequence sets the band, in advance, by design — that is the Action Heat Ladder, where the hottest dimension of an action decides who pulls the trigger. Confidence then moves behavior inside that band: how loudly the agent works, how much evidence it shows, whether it proposes rather than acts. Confidence never promotes an action to a hotter band, and a model is never allowed to grade its own consequence.

Figure 5

Confidence moves along a row. It never moves a row.

Confidence ≥ 0.90

0.60 – 0.90

Below 0.60

Low consequenceinternal, reversible in minutes

Act, log it. The log is the control.

Act, log it, sample the reviews.

Ask the next layer. Cheap to retry.

Medium consequencetouches a client record or a shared system

Act and disclose what was done.

Propose. A named human approves.

Stop. Escalate with the evidence.

High consequenceleaves the building, binds money or policy

Draft only. A named approver sends.

Draft, flagged as uncertain.

Do not produce an action at all.

Read that grid as a policy rather than a suggestion. Low-consequence work runs quietly and the log is the control. Medium-consequence work runs with disclosure, and a wobble in confidence turns it into a proposal. High-consequence work is drafted, never sent, whatever the number says. The model estimates. The system governs.

Two consequences for anyone building this. First, the gate belongs in the mandate, not in the prompt: who may approve what, in writing, per action, is the AI agent operating model, and a probability threshold is a parameter of that document rather than a replacement for it. Second, the thresholds need evidence. When we scored twelve enterprise platforms in the Agent Supervision Register, median capability came out at 11 of 12 and median supervision at 6, and not one documented a way to reverse work an agent had performed. A confidence number in a product that cannot undo anything is decoration.

Used properly, though, confidence becomes what Confidence Cues always wanted it to be: not a percentage printed next to an answer, but a reason the system behaves differently. An agent that does not merely have confidence but acts differently because of it is a much better design primitive than a badge saying 87%.

08 · Where not to put one

Every new category arrives with a hammer problem. Decision models are useful precisely because their domain is bounded, which means the damage from over-applying them is predictable.

They fit when the possible answers can be written down in advance. They do not fit exploration, novel planning, synthesis across unfamiliar evidence, open-ended explanation, creative generation, or any task where the answer space cannot be specified. You would not ask a choice model to develop a market-entry strategy. You might use one twenty times inside the agent executing that strategy.

Beyond the category question there are concrete failure modes, documented by the first writer to put Jev through real work: it breaks on literal reading that requires an explicit condition, it cannot reliably do arithmetic or counting, and it struggles with dates and with indirection.^[5] His practical rule is the most useful sentence written about this model class so far — when your instinct says extract X, rephrase it as here are the candidates for X, which one is it?^[5] A decision model is a chooser, not an extractor.

And the hard limits are hard: no images, a ceiling of 255 options per choice, and no text output of any kind.^[1] A routing problem with a thousand destinations is not a choice question; it is a retrieval problem with a choice question at the end of it.

09 · What to watch

Jev is days old and most of its alternatives are younger. This is not a settled category, and the honest list of open questions is short and specific.

• Calibration in your domain. Published expected calibration error is a claim about somebody else’s test set. Two hundred labeled examples from your own traffic will tell you more than every benchmark in this article.
• Independent evaluation with human labels. The vendor evals score agreement with two frontier models. Until something scores these systems against human judgment on domain data, “accuracy” is a comparison, not a measurement.
• Failure modes in production, which will matter more than demo latency — particularly the quiet ones, where a bounded output space makes a wrong answer look exactly like a right one.
• Dependency shape. A hosted decision model with no paper, no weights and no exported evaluation is a dependency in the control flow of your agent. That is a different risk class from a dependency in its prose.
• Whether your platform can host any of this. A decision layer needs somewhere to run, permissions it cannot exceed and evidence of what it decided — which is the test in agent-first platform, and it is not passed by an API alone.

The bigger question is already independent of which vendor wins: how much of an agent’s cognition actually requires a general-purpose model? My guess is much less than today’s architectures imply. We began the LLM era by discovering that one sufficiently capable model could do almost everything. The next stage may be discovering that it should not.

The AUX takeaway

The architecture of a trustworthy agent should not begin with which model are we using. It should begin with what decisions does this system make — then: which are deterministic, which carry bounded uncertainty, which need genuine reasoning, and which carry enough consequence that a person must stay in the loop. Running that inventory before choosing a model is most of what AI agent development lifecycle work consists of, and it survives every change of vendor underneath it.

Code where certainty exists. Small brains where the answer space is bounded. Big brains where reasoning is necessary. Humans where consequence demands judgment.

The future agent may not have one brain. It may have an entire nervous system — and the useful skill will be deciding which reflex belongs where.

Terms used here

System One model

A model class that takes program state plus typed questions and returns a typed value with a probability, instead of generating text. Named by TypeSafe at Jev's launch on 15 September 2026; it is a vendor's term for an emerging category, not an established one.

Decision model

The neutral name for the same idea: a model whose output space is declared in advance, so the answer is a member of a known set rather than a sentence that has to be parsed.

Reflex layer

auxfirst's name for the tier of an agent that answers bounded, high-frequency questions — routing, classification, risk, relevance, policy matching — without invoking a general-purpose model.

Calibration

Whether a stated probability matches observed frequency: of the decisions a model calls 0.8, about 80% should be right. Usually reported as expected calibration error (ECE), where lower is better. Calibration is domain-specific, so a published figure is a hypothesis about your data, not a measurement of it.

Cognitive routing

Sending each unit of cognition to the cheapest mechanism that can decide it safely — code, retrieval, a classifier, a decision model, a small model, a frontier model, or a person.

Constrained decoding

Restricting a model's output to a declared type or grammar. It guarantees the shape of the answer, never its correctness — which is what a claim of zero type errors means.

Questions people are asking this week

What is Jev?

Jev is a model released by TypeSafe AI on 15 September 2026 that takes program state plus typed questions and returns typed decisions with calibrated probabilities instead of text. It answers three kinds of question — a yes/no probability, a choice from a declared set of options, and a score on an ordered scale — and it cannot generate prose at all.

What is a System One model?

System One model is TypeSafe's name for a model class optimized for fast bounded decisions rather than for generating language, by analogy with fast intuitive thinking. It is a vendor term for an emerging category rather than an established one, and the neutral description is a decision model: the set of possible answers is declared in advance, so the output is a member of that set with a probability attached.

What are noul, choice and score?

They are Jev's three question types. A noul question returns a single probability between 0 and 1 for a yes/no condition. A choice question picks one option from a declared list and returns the option, the full distribution and a confidence. A score question returns a probability-weighted position on an ordered scale.

Is Jev really 193 times faster and 444 times cheaper?

Those are the vendor's figures for one workflow, described by an independent writer who tested it as the high end of real-world results. TypeSafe's broader claim is up to 200 times faster and 400 times lower cost on classification tasks. The price, $0.042 per million input tokens with free output, is published and checkable; the speed and cost multiples depend entirely on which baseline and which workflow you compare against.

Are there open alternatives to Jev?

Within a week of the launch, a community index listed more than thirty open reproductions and adjacent projects, including Laya on a ModernBERT-large encoder with Apache-2.0 weights, a 151M non-autoregressive model called Verdict, NanoJev trained from scratch with its dataset published, and several logit readers on Qwen checkpoints. An independent benchmark over 10,000 decisions found a 149M open cross-encoder on a CPU landing 0.6 percentage points behind Jev on accuracy.

Where should a decision model not be used?

Anywhere the answer space cannot be written down in advance: exploration, planning, synthesis across unfamiliar evidence, open-ended explanation and creative work. Flavio Copes also documents concrete failure modes — literal reading that requires an explicit condition, arithmetic and counting, dates, and indirection — and the practical fix, which is to rephrase an extraction as a choice between candidates.

Does a confidence score mean an agent can act on its own?

No. Confidence is the model's own estimate of whether it is right; consequence is a property of the action and is decided in advance. A calibrated probability can move an action inside its band — silent execution, execution with disclosure, a proposal — but only design should move the band itself. Sending an irreversible external action because the score read 0.97 is a governance failure, not a modeling one.

Method · Every source was fetched and read on 21 September 2026, and quotations are marked. Vendor figures are labeled as vendor figures wherever they appear; the only numbers in this article that are not somebody’s published claim are the ones in Figure 4, which is an illustration of a distribution rather than a measurement of one. The confidence and consequence grid in Figure 5 is auxfirst’s reading, built on the Action Heat Ladder, not an industry standard. Where a repository could not be fetched on the day of writing, its claims were left out rather than repeated second hand.

Written by

Emil Krzemiński

Founder of auxfirst, the agentic experience design agency. Develops the AUX discipline and the Action Heat Ladder — the frameworks for designing trust and control into AI agents that act on people’s behalf.

LinkedIn · About auxfirst · For AI assistants →

Cite this page

Krzemiński, E. (2026). The Agent Stack Is Growing a Reflex Layer. auxfirst.
https://auxfirst.com/news/system-one-models-jev.html

Published 21 September 2026 · Markdown version