There is one question that is asked in almost every introduction to AI agents, and it is the wrong question to ask. It is: “How do we control what the agent says?” The right question is: “How do we control what the agent does?”
The difference sounds small. It is the whole difference. After all, a conversation can be read, corrected or retracted — it is cheap in the literal sense. An action, however, is more costly: it alters balances, sends messages, posts transactions, calls up services. Conversation is talking. Action is doing. And security that focuses on what is said, whilst action slips in through the back door, is not a security concept — it is an audience.
Control does not lie in the conversation, but at the decision point.
That is the thesis of this chapter. And it has some good news up its sleeve: the decision point is the one place in the system where control is possible cheaply, quickly and in a focused manner. You just need to know where it is — and assign the right services to it.
1. What a decision point is
A decision point is not an abstraction, but a point in the data stream: the hold before an intention becomes an action. The agent has thought it through. They have a plan. They may even have the parameters ready. And now — before the plan translates into a tool call, a payment, a message or a database change — something happens that is not a conversation: a check. A gate. A decision about the decision.
Decision points can be recognised by one characteristic: They are the only place where the system can still say ‘No’ before the ‘Yes’ costs money. After that, the action is out in the world. You can cancel a payment, but the cancellation is itself another action — the chain of actions cannot be run backwards. What we said in Chapter 6 about meaning applies here to control: the conversation is soft, the decision point is hard.
This also clears up an old misunderstanding. People tend to assume control lies where language arises — in chat, in prompts, in system prompts. We saw in Chapter 5 why this cannot hold: a system prompt cannot compel, but a channel can. The decision point is precisely this embodiment: it is the channel in its most important role. Not transport — judgement.
2. JEV and IQ: two servants at the point — and nothing more
The architecture of this book has introduced two entities that carry out their actual work here: the IQ, which canonises meaning, and the JEV, the small, silent decision-maker (Chapter 6). In earlier drafts of this chapter’s framework, both sometimes gave the impression that they were systems in their own right — thinkers, platforms, or even competitors to the agents themselves. They are not. In the mesh architecture, they are services at the decision point, and there are exactly two:
Firstly: the gating of decisions. The JEV sits at the point and checks the pending action against the canonical meaning. This is not a vote on the question ‘Is this a good idea?’, but on the question ‘Is this system permitted to carry out this action now?’ — A rule against a proposal, in milliseconds, for fractions of a cent. It does not ask whether the agent is convinced, but whether the action is permitted. This is the crucial difference from a conversation: the JEV is not the agent’s conversation partner, but the verifier of its intent. Anyone wishing to negotiate with it is negotiating with the wrong authority.
Secondly: controllable depth of thought. The JEV does not merely decide whether an action is permissible, but how much thought may be expended before a decision is made. Not every decision requires the same level of care: a routine message can be checked swiftly, whilst an action that pushes the boundaries requires a more thorough evaluation. The decision point sets the budget for deliberation — depth of thought as a control variable rather than a random product of the model. This transforms the often-invoked ‘reliability’ of the models into something better: a scale that the company itself possesses.
And the IQ? It provides the JEV with the vocabulary through which the assessment is carried out. Gating against vague terms is gating with a fine mesh. Gating against canonised meaning — the same terms, the same boundaries, the same version as everywhere else in the mesh — is gating with zoom. The three instances from the previous chapter converge here: meaning (IQ), assessment (JEV), execution (node). The decision point is the place where architecture becomes operational routine.
3. HONL Yellow: when the point calls for human intervention
There are actions that gating alone should not decide — not because the JEV is too weak, but because they fall within a zone that is deliberately kept in human hands: the Yellow Zone. Bona fide, in good faith, but an exception: thresholds that are exceeded; cases with genuine scope for interpretation; situations where the rule does not know what the situation knows.
Here, the decision point does what it does best: it escalates in a prepared manner. The person at the point does not receive a conversation, but a prepared decision — this has been described in Chapter 5 as the ergonomics of the 10-second decision: context, rationale, confidence, and three buttons. The JEV has already carried out the assessment; it has simply deliberately left the final approval to the human. This is not a weakness of the architecture, but its clarity: The machine prepares, the human approves, the machine executes. Each instance does what it does best — and none does the work of the others.
And as always, the principle holds true: what remains human in the Yellow Zone will never become human in the Red Zone — attacks, manipulation and circumvention of rules are deterministically blocked, not permitted (Chapter 5). The decision point does not distinguish between good and evil based on emotion, but on architecture: Yellow asks, Red blocks, Green proceeds.
4. The Economics of Not Slowing Down
Now comes the objection that every company has in mind before it even voices it: ‘That sounds like a brake.’ And here the chapter must be honest — with a figure that became a reality in 2026.
Two developments have turned the economics of evaluation on its head: the decision-making capabilities of the major providers have become a standard commodity (those who do not build ‘Decisions’ themselves buy them as a service — the market is catching up), and the price war among the models has roughly halved the costs of targeted, quick verification decisions. What in 2024 was still cited as an argument against widespread gating — “too expensive to check every action” — has by 2026 become a fraction of that cost. The economics have swung in favour of control. The gating service at the decision point now costs a subscription fee plus a few cents, and the more routine actions it allows to proceed unchecked, the less of a burden it becomes.
That is the real point of the decision point: it is not the brake in the system, but what makes it possible not to brake. Because the decision point carries out the checks, the hundred routine actions preceding it can run quickly and autonomously — without anyone reading over the conversations. Monitoring by reading conversations is the most expensive control model there is: it costs man-hours, reliability and speed. Control at the decision point costs a few cents and leaves everything else unrestricted. Anyone who, on the other hand, operates the system without a decision point in order to save on the ‘brake’ ends up buying back the more expensive brake: people who reconstruct conversations retrospectively to understand what the agent has done.
Just for the sake of completeness — because honesty demands that we also acknowledge the paradox: cheaper verification does not automatically lead to lower overall expenditure. What makes the individual verification cheaper makes verification across the board more frequent — more agents, more actions, more gates — and the bill still rises. This is not an argument against the decision point, but it is an argument against the notion that control is a one-off purchase. The point is an operational item. Those who factor it in fare well; those who omit it are surprised by the token bill (Chapter 4 provided the mechanics for this).
5. The Test: Three Questions for Every Decision Point
How can one tell whether a decision point is genuine — or a sham? Three questions suffice:
- Can it say ‘No’ before something happens — or does it only document the event after it has happened? A log is not a decision point. A decision point blocks action before it is carried out.
- Does it check an action against canonised meaning — or against the agent’s text? Anyone who checks the agent’s reasoning instead of their action against the canon is confusing the examiner with the audience.
- Does it know what it is not permitted to decide? A decision point that decides everything on its own is a chamber without Yellow. A decision point that asks the human for input during attacks has confused the zones — Red is not authorised, Yellow is not blocked.
Anyone who asks these three questions of a system and receives a valid answer three times has a decision point. Anyone who fails to receive a valid answer three times is having a conversation with spectators.
The chapter in one sentence
The decision point is the only place in the agent-based system where control is possible cheaply, quickly and in a concentrated manner: the IQ provides the meaning, the JEV the judgement, the human the signature in yellow — and the economy of 2026 has made not braking cheaper than braking.
