Dividing labor: overseen decision cores and language models

The problem: one stream for everything

The dominant assistant architecture concentrates three different jobs in one generative model. It holds what it knows about you, decides what to do about your request, and writes the answer — all inside a single stream of tokens where instructions, retrieved documents, and user input compete on equal footing.

That concentration creates three structural weaknesses. Anything can steer everything — a hostile or merely persuasive passage in retrieved content can reach the decision path as easily as it reaches the prose. Confidence is performed, not measured — there is no distribution to inspect, so the system cannot slow down when it does not actually know, it can only sound less sure. And failures arrive eloquently — when a single model both decides and speaks, a wrong decision is delivered in fluent, confident language.

Inference-time governance work shows that keeping a capable model frozen and governing around it beats retraining rules into weights. This study asks the complementary architectural question: should one model be doing all three jobs at all?

The thesis: divide the labor

Human organizations already know the answer. The person who keeps the records, the analyst who weighs the options, and the spokesperson who delivers the outcome are three different roles — and the spokesperson does not get to change the decision on the way to the podium.

EMOS — the Ethical Model Overseer System — applies that division inside a single agent: three interconnected parts, each with one job, overseen as a whole by an ethical algorithm.

01 · The overseer: memory that holds the bounds

An ethically oriented memory model is the seat of context and permission. What the system knows about the user and the task, what it may do, and where it must stop live here as structured state — not as prompt text that can be negotiated with. The ethical algorithm watches every exchange against this state: each decision the core returns and each action a tool proposes is checked before it can take effect. Because the bounds live in overseen memory rather than in the conversation, input can argue with a rule but cannot rewrite it.

02 · The decision core: classification, not conversation

A non-generative model answers typed questions asked against a state — true/false, multiple-choice, scaled — and returns a discrete probability distribution per question. State in, calibrated judgment out. In concert with the overseer, the core decides what the situation is and what may happen next, and its distributions select and parameterize calls to tools and utilities. It never writes to the user: its failure mode is a wrong classification the overseer can catch, never a persuasive paragraph that hides one.

03 · The voice: language comes last

A generative language model does the one thing it is there for: render the overseen outcome into words a person can read. It voices outcomes; it does not choose them. No path leads from the voice back into decision or tool authority, so the injection surface of the whole system is bounded to the phrasing of the reply — never to the action behind it.

The voice can only be wrong about how something was said. It cannot be wrong about what was done — it was never asked.

The loop in operation

A request enters as state into overseen memory. The core answers its typed questions against that state — what is being asked, what may happen, which tool applies — returning distributions rather than prose. Tools execute under the overseer's permission check. The ethical algorithm reviews the exchange against context and bounds. Only then does the voice turn the sanctioned outcome into a reply.

What we would watch

1. Separation integrity: An adversarial suite plants instructions inside untrusted content — retrieved documents, pasted text, tool output — and watches whether any injected directive ever reaches the decision path or tool authority.
2. Decision calibration: Reliability diagrams and Brier scores measure whether the core's stated distributions track empirical accuracy, including whether flat distributions trigger abstention rather than a confident guess.
3. Overseer intervention quality: Every flagged action is reviewed as a confusion matrix — true violations caught versus legitimate work blocked.
4. Voice fidelity: Each reply is checked against the sanctioned decision payload for added claims, hedged commitments, or dropped constraints — faithfulness, not fluency.
5. Split latency telemetry: End-to-end time is decomposed into state read, decision, tool execution, and voice segments so the loop's cost is attributable per part.

What success looks like

• No decision-path injection: Across the full adversarial suite, zero tool calls or decision changes are traceable to instructions embedded in untrusted content.
• Calibrated judgment: The decision core holds expected calibration error ≤ 0.05 on held-out classification suites, and abstains on flat distributions rather than committing.
• Overseer precision: At least 95% of flagged actions are true violations, with no more than 2% of legitimate requests blocked.
• Faithful voice: At most 1% of replies introduce claims not entailed by the sanctioned decision, while adding ≤ 300 ms to routine traffic.
• Bounded overhead: The full loop adds ≤ 250 ms median latency over a single-model baseline on routine requests — care scales with consequence, not with paranoia.

Key references