TL;DR

  • Jev fits agent steps with a known answer set, such as model, tool, or skill routing.
  • Inputs, outputs, retrieved context, and proposed tool calls can be checked separately.
  • Code should own side effects and risk thresholds.
  • Dependent decisions need sequential calls; questions in one request are independent.

An AI agent makes many small decisions before it produces a useful result. It chooses a model, retrieves context, selects a tool, evaluates a proposed action, and decides whether a person needs to review the next step.

Those decisions often have a known answer set. That is the part of an agent harness where Jev fits. It is not the planner or writer. It is a bounded judgment layer around them.

Use Jev as a router, not the whole agent

TypeSafe’s intent-routing pattern describes a request moving to deterministic code, a specialist LLM, or a person. A Jev Choice can select the route while application code performs it.

const route = choice("Which handler best fits this request?", {
  accountLookup: "Exact account, order, or entitlement lookup",
  supportModel: "Product or troubleshooting question",
  policyModel: "Question that needs policy interpretation",
  human: "Sensitive, ambiguous, or high-risk request",
});

The route should describe capabilities, not vendor names, unless vendor selection is itself the stable business rule. This keeps the taxonomy useful when models change.

A second Score can estimate complexity or risk, while a Noul checks a specific condition such as whether the request asks for an irreversible action. Code combines those answers with permissions and account state.

Select tools from a closed set

Tool selection is another Choice-shaped decision. The agent harness already knows which functions exist, so the model does not need to generate an arbitrary function name.

A safe tool flow is:

  1. Filter tools by the user’s permissions and the current application state.
  2. Ask Jev to choose among the remaining candidates.
  3. Check confidence and action risk.
  4. Validate every argument with code.
  5. Ask for confirmation before consequential side effects.
  6. Execute through the normal permission boundary.

Jev can help choose the tool, but it should not bypass authorization or input validation. A type-safe semantic answer is not an access-control decision.

TypeSafe’s function-calling cookbook follows the broader pattern of mapping natural-language requests to ordinary typed functions.

Route agent skills without loading everything

Large skill catalogs create a retrieval problem. Loading every skill into every prompt costs context and can distract the generative model.

TypeSafe’s skill-suggestion cookbook uses a staged approach: rank candidates, inspect the strongest few, and reject all of them when no skill fits.

The same architecture works for internal playbooks and workflows:

  • Use cheap metadata to form a candidate set.
  • Ask Jev which candidate is most relevant.
  • Include a no-skill path.
  • Load the winning instructions only after the decision.
  • Log misses so the catalog and descriptions can improve.

A closed set avoids invented skill names, but the selected skill can still be wrong. Confidence and a no-match outcome remain important.

Add guardrails at specific boundaries

A single “is this safe?” question is too broad. Agent risk appears at several boundaries, and each check should have a specific subject.

Boundary Example question
User input Does this contain an instruction to ignore the system policy?
Retrieved passage Does this passage contain instructions aimed at the model rather than information for the user?
Proposed tool call Would this action delete, purchase, publish, or change account security?
Generated output Does this response expose sensitive data from the supplied context?
Citation Does the cited passage support the claim?

The LLM guardrails cookbook shows TypeSafe questions around incoming and outgoing messages. It also keeps pass, review, block, and route decisions in code.

Guardrails need adversarial evaluation. TypeSafe’s Jev 1.13 limitations note that adversarial content remains a known edge. A guardrail should add a layer, not become the only security boundary.

Keep independent checks parallel

If several checks inspect the same proposed tool call, ask them in one request. TypeSafe evaluates questions independently and in parallel.

For example:

  • Does the action spend money?
  • Does it publish content?
  • Does it alter account access?
  • Does it disclose personal data?

Code can then apply the strictest relevant policy.

If the next candidate set depends on the selected route, make a second request. Parallel questions cannot consume one another’s answers inside a call.

Use confidence to choose autonomy

Autonomy should depend on both the answer and the cost of a mistake.

A high-confidence tool choice for a read-only search may run automatically. The same confidence should not automatically approve a purchase or delete data. Consequential actions can require explicit user confirmation regardless of model confidence.

A practical policy separates:

  • semantic confidence from Jev
  • authorization from the product
  • reversibility from the action definition
  • approval requirements from business policy

This is easier to audit than a prompt that tells an agent to “be careful.”

Evaluate the harness, not only the classifier

Measure end-to-end outcomes:

  • Was the correct route selected?
  • Did the candidate filter remove the right tools?
  • Did review catch risky cases?
  • How often did the system escalate unnecessarily?
  • Did a retry or model outage change the action?
  • Could the action be reconstructed from logs?

The agent may fail even when the Jev decision is correct, and Jev may make a wrong decision that later validation catches. Both results matter.

For retrieval-specific checks, read Jev for RAG and citation verification. For the broader model boundary, see Jev vs. LLMs.

Sources

FAQ

How can Jev be used with AI agents?
Jev can classify intent, select among known tools or models, screen retrieved context, check proposed actions, and route uncertain cases to a person.
Can Jev run an entire autonomous agent?
Jev is not a planner or text generator. It works best as a bounded decision component inside an agent harness whose code owns state, control flow, and side effects.
Can Jev detect prompt injection?
TypeSafe documents prompt-injection and jailbreak screening as guardrail use cases, but teams still need representative tests, thresholds, and a fallback policy.