We put a fast decision model in front of the expensive judge. Every turn gets screened; only the exception band reaches the full judge. Simulated on 895 real turns: 9.5× cheaper ($14.79 → $1.55). Live on staging: 91.7% of judge calls skipped — with zero breach verdicts produced by the fast model alone.
The bill problem
A frontier LLM judge runs about $0.0165 per turn. On 895 turns, that's $14.79 — and that's one scan. Guard every turn of a busy agent fleet and the security bill outgrows the agents it guards.
At that price, the industry quietly does the only thing it can afford: it judges a sample of traffic, and calls it coverage. But runtime guarding should mean every turn, every tool call — not a monthly spot check.
The architecture
The move is simple to state and subtle to make safe:
- Every turn hits the fast decision model first. Sub-second, and — measured on our own traffic — about $0.00002 per turn. Noise on the bill.
- Class-mapped routing. Turns in the allow band skip the expensive judge entirely. Escalate/block candidates go to the full judge — where findings need its prose.
- The fast model never writes findings. It routes; the full judge explains.
The savings come from step 2. The safety comes from three invariants:
- A breach verdict always comes from the full judge. The fast model can route a turn toward the judge; it can never declare a breach by itself. A verdict of
V-FULLorV-LEAK— even when class-mapped to "allow" — still goes through the full judge. - Fail-open to the judge. Any fast-model failure falls back to the full judge. The cheap path is an optimisation, never a dependency.
- Every decision is logged with its mode and attribution — a skipped turn and a judged turn produce the same audit trail. Compliance reports carry per-scan decision counts and gate-class distribution either way.
The numbers
Simulated on 895 real staging turns (same replay that calibrated the judge):
| Variant | Full-judge runs | Reduction | Cost per 895 turns |
|---|---|---|---|
| Both judges, every turn | 895 | — | $14.79 |
| Exception mode | 93 | 89.6% | $1.55 → 9.5× cheaper |
Outcome cost: on the 743 allow-skipped turns, the gate action differed from the full judge's own action on 7 turns (0.9%) — and our adjudication of those disputes showed most were the judge's own per-turn noise, which it reversed in its own conversation-level review.
Live on staging (24-turn adaptive scan): 22 of 24 turns skipped (91.7%). The 2 turns that reached the full judge were exactly the ones the safety rule demands — jailbreak V-FULL turns, an advisory class that must route to the judge. Zero breach verdicts from the fast model alone. Zero errors introduced.
Why the invariants matter more than the savings
A 9.5× cut is nice. The reason we shipped this is different: at $1.55 per 895 turns, continuous adversarial pressure becomes affordable. Daily scans. Per-release scans. Always-on tool-call firewalling. That's the difference between "we ran a scan once" and "security is running."
And because the skip is logged with the same attribution as a judge run, the compliance story doesn't change — the evidence was never "the judge saw everything," it was "every decision is recorded, routed by policy, and reviewable."
What we'd tell another team building this
Cheap-first screening only works if the cheap model is calibrated enough to route. Ours runs a bimodal confidence profile — most turns are unambiguous (p50 breach confidence 0.06), and the ambiguous band is narrow. If your screener is confidently wrong, you've built a faster way to miss. Measure the skip band's leak rate on your own distribution before you trust it — that's the number the architecture lives or dies on.
The cheapest judge call is the one you never make. The second cheapest is the one you make exactly when it matters.
This shipped alongside a broader calibration: 895 shadow turns, per-class gate routing, and a live tool-call soak. The full numbers live in our reports.