An email arrives. Before an assistant writes the first line of a reply, half a dozen questions need answering. Invoice, enquiry or advertising? Is there an instruction in the text aimed at the assistant rather than the recipient? Which workflow is responsible, and does the email need a reply at all? Until now all of that was answered by the same large language model that later writes the reply, and it answers the only way it knows: with text. Ask "Is this urgent?" and you get a paragraph from which a program has to fish the yes back out, while how sure the model was stays its secret.

Since this October it works differently, and we think it is the most exciting news from the model world in a long time. Microsoft-Decision-1, Jev by TypeSafe and H2O-Lightning-4B by H2O.ai are models that do nothing but decide. They receive a piece of content and questions with predefined answers, and they return a probability for every answer, in a single pass.^{[1, 2, 3, 4]} Microsoft calls this a new layer of the AI stack and writes that the industry is moving beyond the idea that every request to a model has to end in generated content.^[1] The way we read it, after years in which one general-purpose model got every task, the first specialists are stepping up beside it. For a platform that builds agents out of individual steps this is a gift, and one you can do the maths on. We measured all three on the decisions our own agents make; the numbers are further down. First, a closer look at what such a model actually returns.

A yes you can measure

A request to a decision model has two parts. The state (state) is the content in question, say an incident report, an email or a draft reply. The questions (questions) say what the model should decide about that content, and each question takes one of three forms.^{[4, 5, 6]} A yes-no question, called "noul" by all three vendors, returns a single number between 0 and 1, the probability of yes. A choice (choice) names the best-fitting option from a list you define yourself, with a probability for every option. A score (score) places the content on a scale whose levels you describe and returns, next to the probability per level, a weighted value that may sit between two levels.

Microsoft demonstrates it with an incident report: "The checkout service has been unreachable for 20 minutes, customers cannot pay, there is no workaround." Two questions go with it, whether the incident needs immediate attention and how high its priority is on a scale from routine to urgent. The model answered with 99.75 percent for yes and put 98.72 percent on the level "urgent". The whole request cost 86 input tokens and 2 output tokens.^[7] Two tokens because two questions were asked; the model never returns more. H2O describes the same mechanism for its model in one sentence: one forward pass, one output token per decision.^[4]

Three further rules apply, and Microsoft and TypeSafe describe them the same way. Several questions about the same content go into one request, and the model answers them together. The name you give a question comes back unchanged in the answer, so your program reads the values directly without interpreting a sentence. And every question asks exactly one thing: "Is this urgent and customer-relevant?" becomes two questions whose answers your code combines.^{[5, 6, 7]}

What the number promises

A probability is worth as much as its calibration. Microsoft and TypeSafe state that they trained their models for exactly that; Microsoft puts the goal this way: a prediction of 90 percent should be right about nine times out of ten on representative cases.^[2] TypeSafe supplies the caveat: calibration is measured across groups of predictions and tells you, for a single answer, only how often answers of that kind are right on average.^[3] A value of 0.98 can still be wrong in the individual case. What it tells you is the hit rate of its class, and that is more than a sentence of text ever revealed.

That is why software works with such models through thresholds. Above a threshold it acts on its own, in a middle band it asks back or gathers more information, below it the case goes to a person or to a stronger model. Where the thresholds sit depends on the damage a wrong decision does; an action that is hard to undo needs a higher threshold than a read access.^{[7, 8]} And before a threshold automates anything, the calibration should be checked on your own data. Microsoft advises this explicitly and recommends, for questions where the model should be able to abstain, an option of its own such as "cannot tell".^{[1, 6]}

Three models, one format

Decision-1 arrived in Microsoft's model catalogue Foundry on 9 October 2026, post-trained from Qwen3.5-9B; Microsoft plans to rebase future versions on OpenAI and its own MAI models.^[1] Jev has been in early access since September 2026 at TypeSafe, a start-up from San Francisco that trains its model with a method of its own called RLCD and has named the class "System One".^{[9, 10]} H2O-Lightning-4B appeared in October with open weights under Apache 2.0 on Hugging Face; anyone with a GPU downloads it and runs it themselves.^[4] Three vendors, three business models, and still the request looks the same everywhere, at Microsoft and TypeSafe right down to the name of the endpoint systemone.^{[5, 6]} That three providers arrived independently at the same format tells us more about the maturity of this class than any single benchmark number.

On performance, all three vendors present their own measurements. Microsoft compared Decision-1 across 36 benchmarks with almost 150,000 questions that were excluded from training and reports the highest accuracy in the field at a median latency about 35 times below that of GPT-6 Sol; when the same request is rephrased, the model changes its decision in 1.3 percent of cases.^[2] TypeSafe advertises "193.6x faster, 444.6x cheaper" and shows a decision in 0.114 seconds for USD 0.000081 next to 8.566 seconds and USD 0.01388 for a language model, measured on workflows TypeSafe describes as System One tasks.^[10] H2O.ai announced on 12 October 2026 first place on the JevBench leaderboard among 104 open-weight systems, with 72.5 points ahead of Jev at 71.5, at a median of 29 milliseconds per decision.^[12] The order of magnitude is the same for all three: decisions in milliseconds instead of seconds, at prices where the single call no longer matters. Whether that holds for our tasks too was something we wanted to know for ourselves.

What we measured ourselves

We let all three models compete on the decisions our agents make anyway: cases from our test sets with a known correct answer, the same questions and the same options for every model. Decision-1 and Jev answered from their hosted services, H2O-Lightning-4B from a single graphics card in a machine in our own building. As the yardstick, the language model that has answered the respective steps so far ran alongside. It was the first run of this measurement, with no further training and no tuning of the models to our cases. The samples are small, every single number is a hint. The direction is the same in every row.

Across the 198 decisions from 22 decision steps in 17 of our agents, Decision-1 was right 194 times, Jev also 194 times, and H2O-Lightning-4B, a small model at four billion parameters, 192 times. The language model reached 197, took a median of 660 milliseconds instead of 195 to do so, and cost six to seven times as much per decision as Decision-1. In choosing the responsible workflow, Decision-1 and Jev were right in twelve of twelve cases, H2O-Lightning in eleven. Two further tasks we compared by discrimination, that is, how cleanly a model separates fitting from unfitting cases regardless of any threshold. The figure for that is called AUC; 1.0 would be perfect, 0.5 would be guessing.

Three things stand out. Jev is trained mainly on English, H2O-Lightning evaluated mainly in English, and both still got our German cases right almost as often as Decision-1. The three models' errors mostly fall in different places; of the fourteen wrong decisions in total, there were only two cases in which two models slipped at the same time.

Second, the probabilities. Every model has its own handwriting. On the question about planted instructions Jev hands out lower values throughout than Decision-1 and separates the cases a shade more cleanly; H2O-Lightning puts a little less weight on the option it picks than the other two, but gets the order of its options right just as often. The threshold above which a workflow acts on its own is therefore set per model; the number that means "sure" with one does not yet mean it with another. With a threshold of its own for each, all three were level on the check for planted instructions, as far as 345 cases can tell them apart. On scores along a scale, Decision-1 kept the expected range in all seven cases, H2O-Lightning in six, Jev in four, because it pulls its values towards the middle of the scale; with level descriptions tuned to each model that would probably shift, but we have not measured it yet.

Third, speed and price. Decision-1 and Jev answered after a median of 195 milliseconds, over the network from their data centres. H2O-Lightning took 38 milliseconds, on a single graphics card (an RTX 5090) in a machine in our building, with no network in between. At the same price per token Jev costs about twice as much as Decision-1, because it splits the same text into roughly twice as many tokens; the entire Jev series of about 3,900 calls cost about nine US cents. H2O-Lightning has no price per call; a thousand decisions took about three to four watt-hours of electricity on our card. And none of the three models left a single request unanswered in the whole series.

All three ran where they are at home: Decision-1 in Microsoft's EU compute zone via Azure, Jev in TypeSafe's service in the US, H2O-Lightning on our own hardware. In MadeForPrivacy's data zones that reads "GDPR-compliant", "Unprotected" and "Local only", and the result makes this assignment a pleasant one. Three models that decide about equally well, one per zone; whoever wants to keep their data in the building gets, with H2O-Lightning, a model that keeps up in our measurement. Of the three, only H2O-Lightning can be run on your own hardware; TypeSafe has published no weights, whatever you may read online.^[9]

In MadeForPrivacy all three run through the same service type, "Decision". Which model a step uses is something you set per data zone, without changing the workflow; the list of services per zone is on the integration page.

With Decision-1, the model of our "GDPR-compliant" zone, we then went one step beyond the comparison. As a first stage ahead of the check for planted instructions, which comes up further down, we measured it on 289 new cases, 134 attacks and 155 harmless pieces of content. The combination detected 129 attacks with zero false alarms; the check by the language model alone reached 128 attacks with four false alarms. Only 13 percent of the content still needed the language model, and the mean checking time fell from 1.26 to 0.42 seconds. We take two observations from that. The wording of a question matters: the same decision asked in three versions differed, on a small set, by up to three of eight cases, without any version looking worse. Microsoft says so itself and advises testing the order and wording of the options.^[6] And the language model keeps its place where it decides better: of 15 steps we switched to Decision-1 in our workflows, 13 stayed; in two the language model decided more reliably and keeps deciding there.

An agent run, broken into decisions

Back to the email from the start. Microsoft speaks of thousands of small decisions around a comparatively small number of complex generative tasks,^[1] and an inbox assistant shows what that means. Before writing: invoice, enquiry or advertising? Hidden instruction? Responsible workflow? Reply needed? After writing: does the draft meet the requirements? Is anything missing? Is the task done, or does it need a follow-up question? May this go out without approval? A single step in this chain produces text. All the others pick from a short list.

Answered as a probability, each of these questions changes its character. First in price. At USD 0.042 per million input tokens, deciding about an email of a thousand tokens costs less than a hundredth of a cent; five decisions per email and ten thousand emails a month come to about two US dollars.^{[1, 11]} Checking becomes cheaper than skipping. Then in measurability. A probability can be checked against cases whose correct answer is known, and from that you get, for every threshold, how many cases are right, how many wrong and how many stay undecided; that is exactly how the numbers in the section above came about. Then in control. The threshold is a setting rather than a phrase in an instruction: whoever wants a workflow stricter raises it, whoever wants more cases through automatically lowers it and sees in the numbers what that costs. And finally in the output itself. A model that only chooses from predefined answers carries nothing but numbers in its reply. The decision can still be influenced; a planted text, however, can no longer reach the next step by this route.

What this means for MadeForPrivacy

MadeForPrivacy builds agents as pipelines of individual steps. Which step runs when is set in the configuration; the pipeline steers the flow. Every step gets the excerpt it needs and uses the AI service assigned to it. Which services qualify is decided by the agent's data zone, down to "Local only". A decision model fits this picture as if it had been built for it: it is an AI service like any other, with a zone, with every call in the log, and a step that needs a verdict uses it while the steps that write stay with the language model. That is exactly why we could run the measurements above with the cases of our own agents: the decision step gets a different service, the rest of the pipeline stays as it is.

How close the platform already works to this is shown by the injection guard from our post on prompt injection. Its second check lets a language model decide whether a text contains a planted instruction; what counts is the verdict, not the text around it, and a text that could not be checked counts as "unchecked". A language model delivers such a verdict only by a detour. A model that returns nothing but a probability in the first place saves that detour and, on top, returns a number that can be set against a threshold and tallied across many emails. The cascade from our tests, Decision-1 in front and the language model for the uncertain 13 percent, is this principle in numbers.

On data protection the same rule applies to a decision model as to every AI service: the content being decided on goes to the service, so the agent's data zone determines which service qualifies. The nice thing about this model class is that today there is a representative for each of the three zones. H2O-Lightning-4B runs with 9.3 gigabytes of weights on a single GPU in your own building, and the licence allows commercial use; as a service on your own hardware it belongs in the "Local only" zone.^[4] Microsoft offers Decision-1 in Foundry in the EU compute zone as well; that is how we use it, in the "GDPR-compliant" zone.^{[1, 6]} Jev runs as TypeSafe's service in San Francisco and therefore belongs in the "Unprotected" zone.^[10] Which AI services exist per zone is listed on the integration page. Which of them an agent may use is decided by its zone, and the log shows per step which service answered. Add to that an advantage that lies in the nature of these models: what comes back is a single number. A rendering of the content never arises on the way back.

Where the limits are

A decision model delivers its verdict without a reason. You get 0.93, and whoever needs a reason to go with it, say for the reply to a customer, still gets it from a language model.^{[3, 6]} Arithmetic it leaves to the code: deadlines, sums and comparisons are worked out by your program beforehand, as TypeSafe recommends, and the model gets the result.^[9] Jev is trained mainly on English, H2O-Lightning evaluated mainly in English; both process other languages according to their vendors, with some loss.^{[4, 11]} All three worked in German throughout our tests. And the quality of a decision hangs on the options you define. If the right answer is missing from the list, the model still spreads its probability across the list; an option "none of these" is yours to provide.^[6]

Before such a model decides in a workflow, it should therefore be measured, with cases from your own operation whose answer is known, and with an eye on where the threshold has to sit so that the uncertain cases land with a person or a stronger model. Whoever does that gets the sum from above: decisions in milliseconds, for fractions of a cent, each as a number you can tally at the end of the month. For us this is the start of a division of labour we have wanted for a long time, with specialists for the verdict and the language model for the text. How pipelines, data zones and the per-step log work together is shown on the page about the agent platform; the research behind model selection and checking steps is in our scientific foundations.