The Unit of Judgment

Disaggregating the Agentic Stack: why routing by task complexity is simultaneously a cost decision, an architecture decision, and a governance decision A technical and economic analysis for enterprise and federal technology leadership.

Author Dev Roy, Founder & Chief Executive Officer, Enclavia.ai, Inc.

Function Solution Architecture and Applied Research, Enclavia.ai

Audience CTOs, chief architects, VPs of engineering, heads of AI platform, FinOps leadership, and investors Distribution Public. May be redistributed unaltered with attribution. Enclavia.ai, Inc. · Fairfax, Virginia · enclavia.ai · Your Data · Your AI · Your Way Contents Executive summary 3 Part I — The monolith and its bill 5 Part II — An outcome is an abstraction 7 Part III — The judgment spectrum 8 Part IV — Two bills, and the third one you own 10 Part V — Looking downward: disaggregation on every floor 13 Part VI — The missing axis: sensitivity 15 Part VII — The reliability tax of disaggregation 17 Part VIII — The Enclavia reference architecture 19 Part IX — Decision framework and 90-day plan 21 About Enclavia.ai and the ask 23 Sourcing note and evidence tiers 23

FIGURES AND EXHIBITS

Figure 1 The monolithic pattern Figure 2 The task stack beneath a single outcome Figure 3 The judgment spectrum Figure 4 One queue, three cost structures Figure 5 Disaggregation on every floor of the stack Figure 6 The Enclavia routing matrix: complexity × sensitivity Figure 7 Compounding reliability across routed steps Figure 8 Monthly cost by architecture and the ownership crossover Figure 9 Shepherd-AI as the disaggregation control plane

Your Data · Your AI · Your Way Page 2

EXECUTIVE SUMMARY

Enterprise AI is being repriced. Not by vendors lowering rates, which they have done aggressively, but by a change in what the enterprise is actually buying. For three years the unit of purchase was the outcome: hand a frontier model a queue, an inbox, a case file, or a codebase, and let it decide what to do. That instruction is issued at a level of abstraction far above the work. Underneath every outcome sits a stack of tasks whose difficulty varies by orders of magnitude, and in the monolithic pattern every one of those tasks is billed at the price of the hardest one.

The correction now underway is disaggregation. Break the outcome into its constituent tasks, classify each task by the depth of judgment it genuinely requires, and route each to the cheapest executor capable of completing it correctly. Some of those tasks turn out to need no model at all. Most need a small one. A minority need the best model money can buy. The published research on this is unambiguous: learned routers report cost reductions in the range of forty to eighty-five percent at equivalent quality, and cascade approaches have reported reductions as high as ninety-eight percent on specific datasets.

I have spent twenty years architecting platforms for federal agencies and Fortune 500 programs, and this pattern is familiar. It is the same argument that took enterprises from the monolithic application server to service decomposition, and from the general-purpose CPU to heterogeneous silicon. What is new is the second axis. In the workloads my teams build for clinical trials, MedTech, and defense, complexity is not the only property of a task that determines where it may run. Sensitivity is the other, and it is legally binding in a way cost never is. A router that optimizes for difficulty alone will confidently send regulated data to a third-party endpoint because that endpoint was the cheapest capable executor. It will be right about the economics and non-compliant by construction.

This paper makes the case that disaggregation is correct, that it is happening at every layer of the stack simultaneously, and that it is incomplete without a governance layer that routes on sensitivity as well as difficulty.

It closes with a reference architecture, a cost model with its assumptions exposed, and a ninety-day implementation plan.

Your Data · Your AI · Your Way Page 3

EXHIBIT 1 — FIVE FINDINGS

# Finding Consequence for the architecture An outcome is an abstraction over a task stack. Pulling an account identifier and diagnosing an unseen failure are not the same work, and in the monolithic pattern they cost the same.

Instrument at the task boundary, not the outcome boundary. You cannot route work you have not decomposed. Unit prices are falling and bills are rising. Agentic workflows are reported to consume five to thirty times more tokens per task than a chatbot query.

Cost control is an architecture problem, not a procurement problem. Negotiating rates does not fix a routing defect.

The same routing principle now operates on four

floors: application, model, serving, and silicon. Routing is the organizing principle of the modern stack. Treat it as a first-class control surface, not a gateway feature. Disaggregation multiplies the number of steps, and per-step reliability compounds. Twenty routed steps at ninety-five percent each yields a 35.8 percent chance of an end-to-end correct workflow.

Routing converts a cost problem into a reliability problem. Supervision is not optional once the step count rises. Complexity determines which model. Sensitivity determines which perimeter. A complexity-only router cannot express the second constraint.

Governance must sit above routing and be enforced at tool invocation, not asserted in a contract. How to read this paper Parts I through V establish the disaggregation argument and the evidence for it, working from the application layer down to the silicon. Part VI introduces the axis the public routing literature omits and the reason it is dispositive in regulated environments. Part VII quantifies the reliability cost that disaggregation imposes and the supervision required to pay it. Parts VIII and IX give the reference architecture, a cost model with its assumptions exposed, and a ninety-day sequence a platform team can execute without waiting for a procurement cycle.

Every quantitative claim carries an evidence tier. Tier 1 is independently benchmarked or primary-source. Tier 2 is vendor-stated, analyst-reported, or press-reported. Tier 3 is analytical framing, internal modelling, or an Enclavia position. The tiers are listed in full on the final page, and the cost model in Part IV is stated parameter by parameter so that a reader can substitute their own inputs rather than accept ours.

Your Data · Your AI · Your Way Page 4

PART I — THE MONOLITH AND ITS BILL

The two-thousand-ticket problem

Consider the canonical enterprise deployment. Two thousand support tickets arrive overnight. An engineer wires them into a frontier model with a single instruction: handle the queue, resolve what you can, flag what you cannot.

The system works. Tickets get resolved. The demo goes well and the pilot converts. The invoice arrives at the end of the month and nobody can explain it. The reason is visible in the architecture, not the bill. There is exactly one routing decision in that design, and it was made once, at deployment, for every ticket regardless of what the ticket contained. Classifying a routine billing question and diagnosing a fundamentally broken account traverse the same code path and cost the same money.

Figure 1. The monolithic pattern. One instruction, one model, one bill. Task complexity never enters the routing decision because the routing decision was made before the task was visible. The core error is not the model choice. It is that the instruction was issued at the level of an outcome. The enterprise bought a result and inherited whatever compute the model chose to spend getting there, with no mechanism to observe or influence the allocation. In every other part of the technology estate this would be considered an obvious defect. We do not run a nightly batch job and a real-time fraud check on the same instance class because they arrived in the same repository.

What the 2026 evidence shows

This is no longer a theoretical inefficiency. It is now visible in public financial disclosures. In April 2026, Uber's chief technology officer, Praveen Neppalli Naga, confirmed to The Information that the company had exhausted its full-year 2026 AI budget four months into the year, after agentic coding tool adoption spread across roughly five thousand engineers faster than the finance model anticipated. Reported per-engineer monthly costs ran between five hundred and two thousand dollars. Uber's total research and development spend in 2025 was 3.4 billion dollars, so this was not a scale problem. It was a pricing-model problem that enterprise finance had never had to hold before.

Your Data · Your AI · Your Way Page 5

The macro numbers point the same direction. Gartner's August 2026 forecast puts worldwide spending on AI- optimized infrastructure-as-a-service at 42 billion dollars for 2026, roughly double the 21.5 billion recorded in 2025, and marks the first year in which inference spending, at 23.3 billion, exceeds training spending at 19 billion.

Goldman Sachs projects global token consumption rising roughly twenty-four-fold between 2026 and 2030. EY's 2026 analysis puts the cost of a single orchestrated customer-service interaction at approximately 1.20 dollars, against roughly 0.04 dollars for the equivalent linear workflow in 2023, an increase of about thirty times driven entirely by orchestration rather than by unit price.

Unit prices fell. Unit counts exploded. The bill is a function of architecture, and architecture is the only lever that scales.

EXHIBIT 2 — THE 2026 TOKEN ECONOMY

Signal Figure Source and tier Agentic token multiplier per task 5× to 30× vs. a standard chatbot query Industry analysis, 2026 (Tier 2) Cost of one orchestrated customerservice interaction ≈ $1.20 in 2026 vs. ≈ $0.04 in

EY, 2026 (Tier 2)

Projected global token consumption growth ≈ 24× between 2026 and 2030 Goldman Sachs Research (Tier 2) AI-optimized IaaS spend $42B in 2026 vs. $21.5B in

Gartner forecast, Aug 2026 (Tier 2)

Inference vs. training spend $23.3B inference vs. $19B

training Gartner forecast, Aug 2026 (Tier 2)

Blended cost, tiered routing vs. frontier-only $2.31 vs. $18.40 per million tokens Q1 2026 analysis of 2.4B enterprise API calls (Tier 2) FinOps practitioners managing AI

spend 31% in 2025 98% in 2026→ FinOps Foundation (Tier 2)

Agentic AI projects forecast to be cancelled > 40% by end of 2027 Gartner, 25 June 2025 (Tier 2)Figures are drawn from published analyst and press reporting and are reproduced as stated by their sources. Where a figure originates in a client note that is not fully public, it is labelled as such rather than presented as a primary measurement.

The last row deserves emphasis. Gartner's expectation that more than forty percent of agentic AI projects will be cancelled by the end of 2027 is usually read as a capability story. It is not. The stated drivers are cost, unclear value, and inadequate risk controls. All three are architectural properties, and all three are addressable at the routing layer.

Your Data · Your AI · Your Way Page 6

PART II — AN OUTCOME IS AN ABSTRACTION

Handle the queue is not a task. It is a label for a sequence of tasks, and the sequence is knowable in advance. Decompose the support workflow and four distinct operations appear, each with a different difficulty profile, a different failure mode, and a different correct executor.

Figure 2. The task stack beneath a single outcome. In the monolithic pattern all four layers are trapped inside one instruction and priced at the rate of the hardest one.

The step that never needed a model

The most useful thing decomposition reveals is not which model to use. It is which steps need no model at all. Extracting an account identifier from a ticket body is pattern matching. It was solved by regular expressions decades ago, it is deterministic, it is auditable, and it is free. It landed on a language model for one reason: it arrived inside the same overarching instruction as the steps that genuinely required reasoning.

In the deployments I have reviewed, the mechanical fraction is consistently larger than teams expect. Identifier extraction, field validation, schema conformance, date normalization, system-of-record lookup, and routing on a known enumeration are all deterministic, and they are also the highest-volume steps, because they run on every item while deep reasoning runs only on the tail. Removing them from the model path is the cheapest optimization available, and it improves reliability at the same time, because a regular expression does not hallucinate.

Why the monolith concealed it

The monolith concealed the task stack because the interface hid it. A single prompt returning a single completion offers no seam at which to observe the internal allocation of effort. There is no telemetry that says this ticket consumed frontier reasoning for a field lookup. That information exists only if the workflow is decomposed first and instrumented at the task boundary.

This is the practical starting point for any team reading this paper. Before choosing a router, choosing a model, or negotiating a rate, produce the task inventory. For each recurring workflow, enumerate the steps, count the invocations per unit of work, and record which step actually determines the quality of the result. That inventory is the artifact everything else in this paper operates on.

Your Data · Your AI · Your Way Page 7

PART III — THE JUDGMENT SPECTRUM

Once the task stack is visible, each step can be classified. Three classes cover the overwhelming majority of enterprise agentic work, and the classification is stable enough to act as a design contract between the platform team and the application team.

Figure 3. The judgment spectrum. Each class has a different correct executor, a different cost profile, and a different assurance mode. Mechanical Deterministic transformation with a knowable right answer. Extraction, validation, lookup, format conversion, and enumeration routing. The correct executor is code. The cost is compute only. Assurance is by construction: the transformation either satisfies its specification or it does not, and that can be unit tested. Any mechanical step running on a language model is a defect, not an optimization opportunity.

Shallow judgment Bounded classification and generation against a known answer space. Sorting a ticket into billing, bug, or refund. Matching an inbound question to an existing knowledge article. Drafting a response from a template and a set of retrieved facts. These steps require a model, but they do not require a frontier model, and they are the highvolume tier: repeated thousands of times per batch. This is precisely the population that the NVIDIA Research position paper on small language models addresses, arguing that models under roughly ten billion parameters are sufficiently capable for the repetitive, narrow, tool-invoking tasks that dominate agentic systems, and reporting that serving a seven-billion-parameter model can be ten to thirty times cheaper than serving a seventy- to one-hundred-seventy-five-billion-parameter model. Assurance for this tier is statistical: sample, score, and monitor drift.

Deep judgment Novel diagnosis, multi-hop reasoning over incomplete information, and any decision where the answer space is not enumerable in advance. This is where a frontier model, or a human expert, earns its price. The defining property of this tier is not that it is expensive. It is that it is rare. A queue of two thousand tickets typically contains a few dozen genuinely novel cases. Assurance is by review, because sampling does not help when every instance is unique.

Your Data · Your AI · Your Way Page 8

The assignment rule

The operating rule is simple to state and hard to enforce without tooling: assign each step to the cheapest executor that can complete it correctly, and make the escalation path explicit. A step that cannot be confidently classified escalates one tier. A step whose output fails a confidence check escalates one tier. Escalation rate becomes a service-level objective in its own right, monitored the way error budgets are monitored, because a rising escalation rate is the earliest signal that the workload has drifted away from the routing policy that was calibrated for it.

EXHIBIT 3 — PUBLISHED EVIDENCE ON ROUTING AND CASCADES

Work Reported result Basis and tier RouteLLM (Ong et al., ICLR 2025) Up to ~85% cost reduction on MT Bench while retaining ~95% of GPT-4 quality, with roughly 14% of queries sent to the strong model; ~45% on MMLU; ~35% on GSM8K Peer-reviewed, specific to a GPT-4

Turbo / Mixtral 8x7B pairing (Tier 1)

FrugalGPT (Chen, Zaharia & Zou, 2023) Up to 98% cost reduction while matching the best individual model, or ~4% accuracy improvement at equal cost Published research, dataset-specific (Tier 1) Small Language Models are the Future of Agentic AI (Belcak et al., 2025) Serving a 7B model reported 10–30× cheaper than a 70–175B model in latency, energy, and FLOPs Published position paper with vendor authorship (Tier 1 / Tier 2) Production routing deployments, 2026 Commonly reported 40–70% cost reduction; wider range of 37–98% across studies and workload types Vendor and practitioner reporting, methodologies not normalized (Tier 2)The headline percentages in this literature are real and reproducible, and they are also benchmark-specific. They should be read as evidence that the mechanism works, not as a forecast for any particular workload. The only number that matters operationally is the one measured on your own query distribution.

What the spectrum omits

The judgment spectrum is a complete description of one variable. It says nothing about whether the cheapest capable executor is permitted to see the data in question. For a consumer support queue that omission is harmless. For a clinical trial adverse-event narrative, a payer claim containing protected health information, or a controlled unclassified defense artifact, it is the entire problem. Part VI supplies the missing axis.

Your Data · Your AI · Your Way Page 9

PART IV — TWO BILLS, AND THE THIRD ONE YOU OWN

Once each step is its own invocation, routing by difficulty becomes possible and the single bill splits. The highvolume shallow tier goes to a small, fast model and produces a small bill. The rare deep-judgment tier goes to the best model available and produces a moderate bill, contained by volume rather than by rate. Same queue, radically different economics.

Figure 4. One queue, three cost structures. The third panel adds the tier that the two-bill framing omits: an owned local pool inside the trust boundary, on which the marginal cost of a token is electricity.

The third bill

The two-bill architecture is a real improvement and an incomplete one, because it assumes both tiers are rented. There is a third option that changes the shape of the curve rather than its slope: run the shallow-judgment tier on open-weight models on hardware you own, inside your own trust boundary. This is not an ideological preference.

It is what the volume distribution recommends. The shallow tier is, by construction, the high-volume tier, and high-volume, stable, predictable workloads are precisely the workloads that amortize capital well. The deepjudgment tail is spiky, infrequent, and quality-sensitive, which is precisely the profile that rents well.

The portfolio rule that follows is: own the repetitive and the sensitive, rent the spiky and the hard. Enclavia's deployments target roughly eighty-five to ninety-five percent of inference executing on local models, with a policy-gated frontier fallback for the residual.

The cost model, with its assumptions exposed

Cost claims in this market are frequently asserted and rarely specified. The model below is stated in full so that a reader can substitute their own parameters and reach their own conclusion. It is an internal model and is labelled Tier 2 accordingly.

EXHIBIT 4 — COST MODEL ASSUMPTIONS

Your Data · Your AI · Your Way Page 10

Parameter Value Note

Workload unit One agentic task = 4 routed steps Classification, matching, diagnosis, drafting Token profile per step 3,000 input / 500 output Includes tool definitions and retrieved context Frontier tier rate $5.00 / M input, $25.00 / M output Published mid-2026 list rates for a mid-tofrontier tier model Small model rate (rented) $0.25 / M input, $1.50 / M output Published mid-2026 budget-tier rates Step mix after decomposition 25% mechanical, 70% shallow, 5% deep Derived from the four-step stack in Figure Owned Shepherd cell 3 × 96 GB accelerators ≈ $34,047 capex Reference cell: 5 workers plus orchestrator, ≈ 260 GB accelerator memory Amortization and power 36 months straight line; ≈ 2.5 kW at $0.12 / kWh ≈ $1,165 per cell per month all-in Assumed cell throughput ≈ 500,000 tasks per month per cell Illustrative; must be measured per workload At one hundred thousand tasks per month the arithmetic is as follows. Routing every step to a frontier model costs approximately 11,000 dollars. Rented two-tier routing costs approximately 1,120 dollars, a reduction of about ninety percent, which is consistent with the published routing literature. The sovereign three-tier configuration costs approximately 1,715 dollars, which is more expensive than rented routing at that volume. That result is stated deliberately. At low volume, renting wins, and any vendor who tells you otherwise is selling you hardware you do not need yet.

Your Data · Your AI · Your Way Page 11

Figure 8. Monthly cost by architecture. The crossover between rented two-tier routing and an owned local pool falls at approximately 196,000 tasks per month under the stated assumptions. Both axes are logarithmic; the steps in the sovereign line are cell additions.

The crossover under these assumptions falls at roughly 196,000 agentic tasks per month, or a little under 800,000 routed model invocations. Above that point the owned pool is cheaper and the gap widens, because the rented line scales linearly with volume while the owned line scales in steps as capacity is added. This is the same shape as Enclavia's build-versus-rent break-even analysis by workload class, which places crossover at approximately 1.6 months for the heaviest reasoning workloads, 2.7 months for mid-tier, and 8.1 months for the lightest. Those figures are vendor-stated and should be reproduced against your own numbers before they are relied on.

EXHIBIT 5 — MONTHLY COST BY ARCHITECTURE AT FOUR VOLUMES

Tasks per month Monolith Rented two-tier Sovereign three-tier 100,000 $11,000 $1,145 $1,715 250,000 $27,500 $2,863 $2,540 500,000 $55,000 $5,725 $3,915 1,000,000 $110,000 $11,450 $7,830 Tier 2, illustrative internal model. Figures follow directly from the assumptions in Exhibit 4 and exclude engineering effort, router overhead beyond a nominal allowance, and the cost of the evidence plane. They are intended to show the shape of the curve, not to quote a price.

Two effects compound the advantage of the owned tier and do not appear in the table. Rented cost rises with success, so the more work the agents do the more the enterprise pays, which inverts the normal relationship between automation and margin. And the owned tier accumulates an asset: the worker-competence map, the routing policy calibrated on real traffic, and the drift baselines. None of that transfers when a vendor contract ends.

Your Data · Your AI · Your Way Page 12

PART V — LOOKING DOWNWARD: DISAGGREGATION ON EVERY FLOOR

The disaggregation described so far sits above the model. The reason it works is that the same principle, routing by task complexity, is already operating beneath it, on every floor of the stack. This is worth establishing carefully, because it changes the strategic reading. Routing is not a clever application-layer optimization that a gateway vendor invented. It is the organizing principle of modern AI infrastructure.

Figure 5. The same routing principle on every floor. The governance layer at the top is the one floor the industry has not yet built as infrastructure.

Model layer: mixture of experts

Sparse mixture-of-experts architectures apply routing inside the model. DeepSeek-V3 carries 671 billion total parameters but activates only 37 billion for any given token, using a trained router that selects eight of 256 routed experts alongside one always-on shared expert. That is an activation ratio of roughly one parameter in eighteen.

Mixtral 8x7B established the same pattern earlier at smaller scale, with 46.7 billion total parameters and approximately 13 billion active per token. The router is making exactly the decision described in Part III, at the granularity of a single token, several hundred times per forward pass.

Serving layer: prefill and decode

One floor down, the same logic separates the two phases of inference, which have opposite hardware profiles. Prefill is compute-bound; decode is memory-bandwidth-bound. Colocating them on one accelerator means neither time-to-first-token nor time-per-output-token can be tuned without degrading the other. DistServe (Zhong et al., OSDI 2024) demonstrated that disaggregating the phases onto separate pools substantially improves goodput under fixed latency targets, reporting up to 7.4 times more requests or 12.6 times tighter service-level compliance. Microsoft's Splitwise work reported the structural reason the problem is worsening: moving from A100 to H100, compute grew about 3.43 times while memory bandwidth grew only about 1.64 times, so the decode phase becomes relatively more starved with each hardware generation. By 2026 this had moved from research to default practice, with support in vLLM, SGLang, and NVIDIA Dynamo.

Your Data · Your AI · Your Way Page 13

Hardware layer: silicon

At the bottom floor the routing is physical. A Google TPU TensorCore is not a homogeneous processor. It comprises a matrix multiply unit, a vector unit, and a scalar unit, and work is dispatched to whichever is appropriate. The MXU is a systolic array performing on the order of sixteen thousand multiply-accumulate operations per cycle, taking bfloat16 inputs with FP32 accumulation, and handles the dense matrix work. The vector unit handles activations, softmax, and normalization, which do not fit the systolic array's rigid structure.

The scalar unit handles control flow and memory addressing. Three classes of work, three executors, chosen by fit. The judgment spectrum is a description of something that silicon designers settled a decade ago.

EXHIBIT 6 — THE SAME DECISION ON FOUR FLOORS

Floor Unit routed Basis of the decision Who decides Application A task within a workflow Depth of judgment required The orchestrator's router Model A single token Learned expert affinity The MoE gating network Serving A phase of inference Compute-bound vs. memorybound The serving scheduler Hardware An instruction bundle Matrix, vector, or scalar shape The compiler and dispatch unit The strategic conclusion is not that routing is a good idea. It is that routing is already the substrate, and whoever owns the routing decision owns the cost curve, the latency profile, and the data path. When that decision is made inside a vendor's endpoint, all three are outside the enterprise's control and outside its audit scope. Which brings us to the floor that is missing from the diagram as the industry currently draws it.

Your Data · Your AI · Your Way Page 14

PART VI — THE MISSING AXIS: SENSITIVITY

Everything in Parts I through V optimizes a single variable. Cheapest capable executor is a correct objective function for a workload with no regulatory surface. It is an incomplete objective function for every workload my teams actually build.

The failure is easy to demonstrate. Take a clinical operations workflow: a site sends a narrative describing a suspected adverse event. Decompose it and the task stack looks familiar. Extract the subject identifier, which is mechanical. Classify the event against a coded terminology, which is shallow judgment. Assess causality against the investigator brochure, which is deep judgment. Draft the query back to the site, which is shallow judgment. A complexity-only router correctly identifies that the causality assessment needs the strongest available model, and correctly identifies that the strongest available model is a frontier API. It then sends protected health information and unblinded trial data across a boundary that the sponsor's own protocol forbids, and it does so for a defensible technical reason.

Complexity decides which model. Sensitivity decides which perimeter. These are independent variables, and a router that models only the first will violate the second efficiently. Figure 6. The Enclavia routing matrix. The horizontal axis is the judgment spectrum from Part III. The vertical axis is the constraint the spectrum omits. The upper two rows never leave the trust boundary.

Reading the matrix

The bottom row is the case the public routing literature addresses, and there the standard advice is correct: use the cheapest capable executor wherever it happens to run. The middle row constrains egress. Mechanical and shallow steps stay local by default, and deep-judgment steps may escalate to a frontier endpoint only through a policy gate that minimizes and redacts the payload and records what was sent. The top row admits no egress at

Your Data · Your AI · Your Way Page 15

all. If the deep-judgment step in a regulated or classified workflow requires more capability than the enclave holds, the correct answer is to put a larger model in the enclave or to route to a human, not to relax the boundary.

This is the practical justification for the sovereignty position. It is not that frontier APIs are untrustworthy. It is that a routing decision cannot be simultaneously optimal on cost and compliant on egress unless the compliant option is genuinely available, and that requires capable models running on infrastructure the enterprise controls. Openweight capability closed enough of the gap over the last two years to make that a real choice rather than a sacrifice.

Why the gate has to be architectural

The common alternative is a contractual control: a data processing agreement, a zero-retention commitment, a business associate agreement. Those instruments are necessary and they are not sufficient, because they are assertions about behavior rather than properties of the system. An auditor asking which model saw which patient record under which authority cannot be answered by a contract. It can only be answered by a system that made the decision, enforced it at the point of tool invocation, and emitted a signed record of it.

Enclavia enforces scope at tool invocation using open policy enforcement, so that a worker agent's ability to reach a given tool, dataset, or external endpoint is evaluated against policy at the moment of the call rather than at the moment of prompt construction. The distinction matters because prompt-level guardrails are advisory. A model can be persuaded to ignore an instruction. It cannot invoke a tool that policy refuses to grant.

EXHIBIT 7 — ROUTING DECISIONS MAPPED TO CONTROL OBLIGATIONS

Framework Obligation touched by routing What the architecture must produce HIPAA / HITECH Minimum necessary; disclosure accounting Per-invocation record of what data reached which executor, inside or outside the covered boundary 21 CFR Part 11 / Annex 11 Attributable, legible, contemporaneous, original, accurate records Signed, time-ordered attestation of each automated decision and its inputs

NIST SP 800-53 r5

AC-4 information flow enforcement; AU-12 audit record generation; SC-7 boundary protection Flow control enforced at the tool boundary and audit records generated per dispatch ISO/IEC 42001 AI system impact assessment and operational control Documented routing policy, its rationale, and evidence it was enforced EU AI Act Logging and traceability for high-risk systems Retained, tamper-evident logs sufficient to reconstruct an automated decision This exhibit maps obligations to architectural outputs. It is an engineering aid and not legal advice; applicability depends on jurisdiction, role, and system classification.

Your Data · Your AI · Your Way Page 16

PART VII — THE RELIABILITY TAX OF DISAGGREGATION

Disaggregation has a cost that the economic framing hides. Splitting one instruction into many invocations multiplies the number of places the workflow can fail, and per-step reliability compounds multiplicatively. This is arithmetic, not opinion.

Figure 7. Compounding reliability. At ninety-five percent per-step correctness, a twenty-step routed workflow completes correctly 35.8 percent of the time. At ninety-nine percent it completes 81.8 percent of the time. Twenty routed steps is not an extreme figure for a production agentic workflow once tool calls, retrieval, verification, and reformatting are counted. At ninety-five percent per-step correctness, which sounds excellent in isolation, the end-to-end success rate is 35.8 percent. The lesson is not that agents do not work. It is that the marginal value of per-step reliability is enormous and non-linear, and that the number of steps is now a first-class design parameter rather than an implementation detail.

This is where routing stops being a cost exercise and becomes a control exercise. A router that saves ninety percent of the bill while dropping end-to-end success from eighty percent to forty percent has not saved anything. It has moved the cost from the invoice to the operations team. Cost per successful outcome, not cost per token, is the only metric that reconciles the two.

Three failure modes and the signals that catch them

Enclavia's Shepherd-AI supervision layer instruments generation for three specific collapse modes rather than asserting robustness generically. Each has a measurable signature that is observable only from inside the inference process, which is the technical reason this capability requires self-hosted models. A closed API exposes, at best, a truncated set of top-k log probabilities and no hidden states at all.

EXHIBIT 8 — FAILURE MODES, SIGNALS, AND GRADUATED RESPONSE

Your Data · Your AI · Your Way Page 17

Failure mode Signal Detector Response

Hallucination Output distribution collapses as the model commits confidently to fabricated content Shannon entropy against a task baseline Re-prompt with narrowed scope Off-task drift Internal state departs from the distribution captured at the start of generation Mahalanobis distance; CUSUM change detection Reroute to a different worker Repetition loop Sliding-window semantic similarity exceeds threshold Semantic repetition window Terminate and escalate one tier Out-of-distribution input Prediction set exceeds calibrated size at the target error rate Conformal prediction Escalate to deepjudgment tier or to a human The response is graduated rather than binary. A first trip returns the partial output and the measured drift value to the meta-agent, which re-prompts the worker or selects a different model. A repeat offender is benched and its trust score decays, so the system learns over time which models it can rely on for which task classes. That competence map is one of the assets referred to in Part IV, and it is not something a vendor can hand over.

Escalation rate as a service-level objective

The operational discipline that makes routing safe is treating escalation rate as a monitored objective with an error budget. Define the expected share of steps that escalate a tier under the calibrated policy. Alert when the observed rate departs from it in either direction. A rising rate means the workload has drifted away from the policy and the routing thresholds need recalibration. A falling rate toward zero usually means the thresholds are too permissive and quality is degrading silently, which is the more dangerous of the two failures because the bill looks excellent.

Your Data · Your AI · Your Way Page 18

PART VIII — THE ENCLAVIA REFERENCE ARCHITECTURE

The preceding parts define a set of requirements: decompose outcomes into tasks, classify each task on two axes, route to the cheapest capable and permitted executor, supervise every step from inside the inference process, and emit evidence of every decision. Shepherd-AI is Enclavia's implementation of those requirements.

Figure 9. Shepherd-AI as the disaggregation control plane. The trust boundary is the architectural feature, not a deployment option. Frontier access exists but is policy-gated, minimized, and attested.

Components

▸ Meta-Agent. decomposes the stated outcome into its task stack, selects the most trusted worker for each task, verifies worker output, and re-prompts or reroutes on failure. This is the component that converts an outcome into routable units.

▸ Meta-Meta-Agent. allocates models to hardware by the compute and memory each requires, runs the reinforcement pipeline that updates trust scores, and owns the retrain queue for persistently drifting workers. ▸ Local worker pool. approximately thirty-eight purpose-built agents running open-weight models on owned hardware, covering document intelligence, extraction, classification, analysis, and domain-specific reasoning.

▸ Policy gate. evaluates scope at the moment of tool invocation using open policy enforcement, so that reach to a dataset, a tool, or an external endpoint is granted or denied by policy rather than by prompt. ▸ Drift monitor. Shannon entropy, Mahalanobis distance, CUSUM change detection, and conformal prediction running alongside generation, with the graduated response described in Part VII.

▸ Evidence plane. signed, per-dispatch attestation recording which model saw which data under which policy, exportable out of band for audit without opening an operational channel.

Your Data · Your AI · Your Way Page 19

The four sovereignty pillars, mapped to the four floors

Part V established that routing operates on four floors. Enclavia's sovereignty pillars map onto them directly, which is the clearest way to explain what sovereignty means concretely rather than rhetorically.

EXHIBIT 9 — SOVEREIGNTY PILLARS AGAINST THE DISAGGREGATION FLOORS

Pillar What it controls Corresponding floor Data sovereignty Zero outbound by default; zero retention; logs destroyable at session end Governance layer above the application Model sovereignty Local-first inference on open weights the enterprise holds, with policy-gated frontier fallback Application and model layers Architecture sovereignty Scope enforced at tool invocation rather than asserted in a prompt or a contract Governance layer, enforced at every floor below Compute sovereignty Owned hardware tier, so the marginal cost of a token is electricity and the asset does not evaporate at contract end Serving and hardware layers

What this does not claim

Three honest limitations. First, open-weight parity with frontier models is real but not uniform; it holds well for bounded, tool-using, domain-constrained tasks and holds less well for open-ended reasoning at the very top of the difficulty distribution, which is precisely why the frontier fallback exists rather than being removed. Second, the cost model in Part IV is an internal model, and below roughly two hundred thousand tasks per month it favors renting. Third, the crossover point is sensitive to utilization: an owned cell running at twenty percent duty cycle does not amortize, and the correct response to low utilization is to consolidate workloads onto the cell, not to buy a second one.

Your Data · Your AI · Your Way Page 20

PART IX — DECISION FRAMEWORK AND 90-DAY PLAN

Seven questions for the architecture review

Can you produce a task inventory? For your three highest-volume agentic workflows, list every step, the

invocations per unit of work, and the judgment class. If you cannot, you are not yet in a position to route anything.

What share of your model calls are mechanical? Any step with a deterministic right answer that currently

runs on a language model is a defect. This is the cheapest fix available and it improves reliability.

What is your cost per successful outcome? Not cost per token, and not cost per call. If a routing change

cuts the bill and raises the rework rate, the metric must catch it.

What is your end-to-end step count, and your measured per-step reliability? Multiply them. If the

product is below your tolerance, adding a cheaper model makes it worse, not better.

Can you name the perimeter for every data class you process? Then check whether your router can

express that constraint. Most cannot, because they were designed to optimize one variable.

At what monthly volume does your workload cross the ownership threshold? Run Exhibit 4 with your own

rates and your own step mix. The answer is a number, not a philosophy.

If an auditor asked which model saw which record under which authority, what artifact would you hand

them? If the answer is a contract rather than a log, the governance layer does not exist yet.

A ninety-day sequence

EXHIBIT 10 — NINETY-DAY IMPLEMENTATION PLAN

Phase Activity Output Owner Days 1–15

Task inventory across the top three workflows; classify every step on the judgment spectrum; count invocations Task inventory and step-mix baseline Platform architecture

Days 16–30

Remove mechanical steps from the model path; replace with deterministic code and unit tests Reduced call volume; measured reliability gain Application engineering

Days 31–50

Stand up the router with a conservative escalation threshold; shadow-run against production traffic without serving routed output Routing accuracy and escalation-rate baseline Platform architecture

Days 51–65

Introduce local open-weight workers for the shallow tier; measure quality delta on your own distribution Local-vs-rented quality comparison AI platform / MLOps

Days 66–80

Apply the sensitivity axis; enforce scope at tool invocation; enable the evidence plane Policy-enforced routing and signed dispatch records Security and compliance

Days 81–90

Re-run the cost model with measured parameters; decide own-versus-rent by tier Board-ready cost-peroutcome model Finance and platform jointly

Your Data · Your AI · Your Way Page 21

What to measure afterward

▸ Cost per successful outcome: total spend divided by outcomes that required no human rework. This is the only figure that reconciles cost against quality. ▸ Escalation rate: the share of steps that escalate a tier, tracked with an error budget in both directions.

▸ Local execution share: the proportion of inference executing inside the trust boundary, tracked as a compliance metric rather than a cost metric. ▸ End-to-end workflow success: the product of per-step reliability across the workflow, measured rather than assumed.

▸ Evidence completeness: the share of dispatches with a complete signed attestation. Anything below one hundred percent is an audit finding waiting to happen. The conclusion I would offer to a technology executive reading this is narrow and, I think, defensible.

Disaggregation is not a trend to evaluate. It is already the architecture of the stack from the silicon upward, and the application layer is simply the last floor to adopt it. The open question is not whether to route by task complexity. It is who holds the routing decision, whether that decision can express a constraint other than price, and whether the system can prove afterward what it decided. Those three properties are only simultaneously available inside your own trust boundary.

Your Data · Your AI · Your Way Page 22

ABOUT ENCLAVIA.AI AND THE ASK

Enclavia.ai, Inc. builds sovereign AI infrastructure for regulated industries: healthcare and clinical trials, MedTech, defense, and government. The platform runs agentic workloads inside the customer's own trust boundary on open-weight models, with a supervision layer that instruments internal model state, a policy layer that enforces scope at tool invocation, and an evidence plane that emits signed attestation as the system runs.

The compliance surface spans HIPAA and HITECH, 21 CFR Part 11, FDA SaMD pathways, NIST SP 800-53 r5, ISO/IEC 42001, and the EU AI Act. We are inviting a small number of design-partner programs to run a scoped pilot against a real internal workload and measure three things with us: the task inventory and the share of calls that never needed a model, the cost per successful outcome before and after routing, and the completeness of the evidence record. If your agentic program is going to be in the sixty percent that survives, the architecture decision is the one to make now.

Dev Roy · Founder & Chief Executive Officer · Enclavia.ai, Inc. dev@enclavia.ai · 703-984-9981 · enclavia.ai · Fairfax, Virginia

SOURCING NOTE AND EVIDENCE TIERS

Every quantitative claim in this paper carries one of three tiers. The tier is stated so that a reader can weight the claim appropriately rather than accepting all figures as equivalent. ▸ Tier 1 independently benchmarked or drawn from a primary published source. Includes RouteLLM (Ong et al., ICLR 2025), FrugalGPT (Chen, Zaharia and Zou, 2023), DistServe (Zhong et al., OSDI 2024), Splitwise (Patel et al., ISCA 2024), the DeepSeek-V3 technical report, and Google Cloud TPU system architecture documentation.

▸ Tier 2 vendor-stated, analyst-reported, or press-reported. Includes the Gartner August 2026 infrastructure forecast, the Gartner agentic project cancellation forecast of 25 June 2025, EY's 2026 agentic token cost analysis, Goldman Sachs token consumption projections, FinOps Foundation survey data, and The Information's reporting on Uber's 2026 AI budget as corroborated by Forbes and trade press.

▸ Tier 3 analytical framing, internal modelling, or vendor-stated position. Includes the Enclavia cost model in Exhibit 4 and Exhibit 5, the ownership crossover in Figure 8, the build-versus-rent break-even figures of 1.6, 2.7, and 8.1 months, the local execution share target of 85 to 95 percent, and all architectural claims about Shepherd-AI.

Two corrections applied during preparation. The NVIDIA small-language-model result is a position paper with vendor authorship, and its ten-to-thirty-times serving advantage is presented by its authors as a rule of thumb sensitive to batching, hardware, and architecture; it is reported here on those terms rather than as a benchmarked constant. The routing cost-reduction percentages are benchmark-specific to particular model pairings and query distributions, and are evidence that the mechanism works rather than a forecast for any given workload.

The judgment spectrum and the two-bill framing in Parts I through IV derive from a publicly circulated industry briefing on agentic disaggregation, treated here as a Tier 3 analytical model and extended with the sensitivity axis, the reliability arithmetic, and the cost model, which are Enclavia's own contribution.