Agents Need Boundaries, Not Just Better Prompts

Executive Summary

The useful question in AI tooling is shifting from “can the model do it?” to “what is it authorized to decide, and how will we know it succeeded?” Today’s strongest signals point to the same answer from three angles: use narrowly shaped models for repeated judgments; give agents permissions that are explicit and reversible; and scale coding work only where outcomes can be verified. That is less glamorous than a general-purpose agent narrative, but it is a more credible route to dependable autonomy.

What Happened

Simon Willison highlighted Jev, a TypeSafe AI product described as a “System One” model. Rather than producing prose, it takes text and returns bounded outputs: classifications, yes/no decisions, ratings, and confidence. Willison’s preferred name—“decision models”—is clarifying. The product claim is not that a smaller model has solved general reasoning; it is that many production tasks do not need an essay. They need a constrained, inspectable judgment for routing, scoring, moderation, or a guardrail.

That distinction matters because generated language can conceal uncertainty behind fluent explanations. A fixed output shape does not make a system correct, but it does make the question of correctness more concrete: did it choose the right category, cross the right threshold, or defer when confidence was insufficient? The hard work moves to calibration, evaluation data, and escalation rules—where it belongs.

A practitioner account from Theo offers the complementary lesson for broad coding agents. In “I was using Fable wrong, this is how I fixed it”, he argues that long-running agents work better when assigned a clear end state rather than a detailed script of intermediate steps. But that latitude comes with conditions: access to tests and other verification tools, feedback from pull requests, and a human retaining judgment over riskier changes. His comparison of Claude Fable 5.1 with Astra is anecdotal, not an independent benchmark. The more durable claim is operational: autonomy is only useful when the task supplies a way to check it.

A shorter product anecdote makes the same point in consumer form. Nate B Jones describes giving the Instinct iMessage agent permission to check him in for a flight; it later returned a wallet link for a valid boarding pass in “Is Instinct worth it?”. This is a first-person report, not a capability test, and should be read accordingly. Still, its shape is instructive: a narrow permission, a bounded external action, and an artifact the user can immediately inspect and accept.

Why It Matters

These are not three versions of the same product. Jev narrows the output of a model; the coding workflow narrows the definition of done; the flight example narrows the permission to act. Together they suggest a practical design rule: do not seek trust in agent behavior as a general property. Construct it from constraints appropriate to the job.

That reframes the usual debate about prompt quality. Clear instructions remain necessary, but they are not the governing control. For repeated decisions, use an interface that cannot wander into prose. For coding tasks, attach testable completion criteria and make review a normal part of the loop. For actions in the world, request permission at a scope users understand and return a result they can verify.

The Bigger Story

This reinforces an emerging practitioner view: model progress increases the value of workflow design rather than eliminating it. Stronger models can take on more ambiguous work, but ambiguity should be absorbed by explicit goals, tools, evaluation, and authority boundaries—not by optimistic prompts alone.

The implication is not to make every workflow rigid. Theo’s account is persuasive precisely because it preserves room for the agent to choose its route. The better dividing line is between freedom over how to work and clarity about what counts as success, what actions are allowed, and when the system must hand control back. Systems that cannot state those answers are not yet ready for more autonomy; they are simply harder to audit when they fail.

Further Reading

• Simon Willison, “Jev introduces a new shape of LLM — System One, aka Decision Models” — a concise introduction to the case for bounded decision outputs.
• Theo, “I was using Fable wrong, this is how I fixed it” — a detailed practitioner account of goal-driven coding-agent work and its guardrails.