---
title: Using decision models to flag agent requests for review
subtitle: A typed model can help classify a request. Whether the request may run is a separate decision.
kind: Technical note
date: 2026-09-03
author: Ron Bronson
revised: 2026-10-16
---

An agent may request permission to send a message, change a booking, or submit a form. Before the action executes, software needs to determine what sort of action it is, whether the request is unusual, and whether the person has authorized it. Each question can go to a different mechanism.

## Decision models return a category, score, or probability

Decision-oriented models return restricted answers such as a category, score, or probability. A classifier might label a tool action as read, prepare, send, purchase, or unknown. A second assessment may flag an unusual destination or inconsistent evidence.

That narrow output is useful for deciding what gets reviewed. Other checks have to establish permission, identity, and the final outcome.

## Model scores stay advisory when an action is checked

Vloora routes each request by its uncertainty, stakes, authority, and novelty, which separates routine work from requests that need verification or a person's approval.

A runtime should check the actual requested operation and its parameters against the person's current permission. Where models help interpret an action, their outputs are advice. A changed action needs its own approval, and a favorable model score cannot revive an expired grant.

## Testing models against a rules-only baseline

A useful experiment runs the same set of requests through a rules-only baseline and several model implementations. The comparison should measure dangerous permissions, missed exceptions, unnecessary prompts, latency, and inconsistent answers. Missing evidence deserves its own cases.

Evaluations of Jev-style systems found them promising for screening traffic for closer inspection, and found that they also missed serious failures. Both results argue for testing each routing use carefully and keeping the final say away from any classifier.

## The customer's permission determines which actions can run

The model helps decide what deserves attention, the consumer's mandate decides what may run, and the execution record shows what was attempted and what outside services reported. Keeping these separate lets a product replace its inference provider without silently changing the rights the person granted.

## Sources

- Vloora, Agent credit reporting research brief, updated October 16, 2026, on the decision-model survey and evaluation references
- Model Context Protocol, [Tool annotations guidance](https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/), March 16, 2026
- Open Policy Agent, [Guidance on agent tool calls](https://www.openpolicyagent.org/docs/agent-tool-calling)