An advisor types a question into a wealth-management agent. The classifier matches it to a skill, and the agent answers: fluently, grounded in real data, and a regulatory problem the moment it lands in a log. The output looked like something the agent could produce, and the agent had no mandate to produce it.

That scenario opens Venkat Peri's Intent Classification isn't a Quality Gate, and the diagnosis that follows is sharp. An intent classifier answers which of our known skills does this input match? It is narrow, confident, and indifferent to a prior question: whether the input is one the agent should engage at all. The fix Peri proposes is a narrow, cheap check that runs before routing. A small model reads the input against a rubric of what the agent must refuse, and returns pass, or fail with a reason. The diagnosis is right, and so is the pattern.

I want to push on a single place where that layer, as proposed, is wrong. It is the place with the most at stake, and it sits inside the layer's most sensible-sounding rule.

The part that is not in dispute

A scope check before intent routing is the right architecture. It should be cheap, and it should be understood for what it is. Peri is explicit that the input check "is not a security boundary." The real trust boundary is authorization (who the user is, what they are entitled to see, what the downstream service will permit), and it lives in the data path, enforced by the service layer. In Peri's words, "a prompt-based classifier has no business carrying that weight."

I agree with all of that. The disagreement is one rule down: bias toward pass, hard.

The cost asymmetry behind "bias toward pass", and where it inverts

The case for biasing the scope check toward pass rests on a cost asymmetry. A false positive blocks a legitimate user, who rephrases, gets blocked again, and stops trusting the agent. A false negative lets the query through to routing, where it either matches a skill and produces a bad answer or fails to match and gets deflected, a cost Peri puts at one routing pass: "Recoverable." Blocking a real user costs more than admitting a bad one, so you bias toward admitting, and the rubric writes that bias in twice, starting with when in doubt, pass.

For topicality, this is correct. It is wrong for one category, and that category is the one with a regulator attached to it.

Peri names that category first: the domain-policy violation, such as investment advice in a wealth agent or a jurisdiction-specific opinion in a legal agent. These requests look answerable, and the agent has no mandate to answer them. The article even makes the point most teams miss: supervision applies to an advisor-facing output as much as to a client-facing one. "Internal use is not a safe harbor." FINRA's rules are technology-neutral and apply to a generative AI tool as they do to any other (Regulatory Notice 24-09).

So the category is right. What it inherits is the default. For a domain-policy violation, a false negative costs far more than one routing pass, and nothing about it is recoverable: it is a prohibited answer that has to survive an audit it will not survive. When the check is in doubt about whether a request is investment advice, pass is the wrong answer.

For this category, the asymmetry flips, and a false negative is far more expensive than a false positive. A uniform bias toward pass therefore under-protects precisely the category with the highest stakes. Two different problems share one shape, and they need two tiers with different defaults.

The distinction that makes the second tier possible

When you refuse an off-topic question (I can't help with cooking, but I can pull up your portfolio), the refusal is communication. Its job is to serve the user's next move, and it is genuinely better when phrased in context. Let the model write it. Peri's rubric does: the checking model returns {"pass": false, "feedback": "<one friendly sentence>"}, and the article treats that sentence as user-facing copy, "kind, specific, and actionable." For this kind of refusal, that is exactly right.

When you refuse at a regulatory boundary, the refusal is a different kind of object. Policy determines its content, and conversational context must not change it. It is the compliance posture made visible: a control output that happens to be rendered as text.

So the model may classify the input, but it should not author the refusal, for two reasons. A control output that varies by context has stopped being a control output, and a model asked to phrase a refusal can, in the edge cases that matter most, phrase the prohibited content into the refusal itself. We already treat the model as a communication interface and keep execution elsewhere. The same split applies here: communication is model-authored, control outputs are deterministic, and a regulatory refusal is a control output.

What the hard tier looks like in code

In Zarel this tier is already implemented in the runtime. A wealth agent's contract declares the boundary:

treatment:
  topic_scope:
    hard_refusals:
      confidence_threshold: 0.60
      categories:
        - name: investment_advice

and the refusal text lives in the policy/i18n plane, never in the model:

topic_refusals:
  investment_advice:
    control_message: I can't provide investment advice or recommendations. I can help
      with account records, historical information, documents, and operational
      workflows.

Four properties follow, and the runtime enforces each one in code; the only model in the loop is the classifier that labels the input.

Bias to refuse. The asymmetry inverted, so the default inverts with it. The threshold is set low, and the contract schema refuses one above 0.7: when the classifier names a prohibited category, moderate confidence is enough to refuse, and a match it did not score refuses too.

Fail closed on no verdict. When the classifier errors or the provider is down, a topicality gate falls through to the normal path. A regulatory gate cannot. We couldn't classify it, so we answered it is the wrong default for a boundary you are legally responsible for. On no verdict, the hard tier returns a generic regulated-boundary refusal, and the ceiling on the threshold means a tenant cannot set it high enough to switch the tier off. The tier also runs before the topical gate steps aside for an active flow, so a regulated question typed in the middle of one meets the same boundary.

Deterministic wording. The refusal resolves from the policy plane, localized and fixed. Same category, same locale, same words, every time, and the model that classified the input never touches the text. An auditor can check that; the model composed a refusal gives them nothing to check.

Logged as a control event. Every hard refusal is written to a dedicated audit table before the reply goes out, with the category, the reason, a hash of the input and a masked copy of it; the raw text is never stored.

The tier has a limit: it is still not your security boundary. Peri's formulation is the right one: "If a user asks a question about data they should not be able to access, the answer is not 'the classifier refused.' The answer is 'the service did not return the data.'" Authorization lives in the data path. The hard tier governs what the agent will say about a prohibited topic; what the agent is permitted to do is decided elsewhere.

There is a second limit, and Peri's next piece names it. In Your Intent Classifier is Solving the Wrong Problem, how does a backdoor Roth conversion work? may be curiosity, a decision about to be executed, or a question asked on a parent's behalf, and nothing in the query says which. No classifier resolves that, and this one does not try to. The contract describes what the category covers (for the wealth contract: buy/sell recommendations, suitability advice, allocation guidance, price predictions, personalized advice), and the classifier is asked whether the message falls inside it. A tier biased to refuse will still, at the margin, refuse a question that was only curious: that is the cost it accepts so as not to answer the ones that were not. It does not make the ambiguous question safe. Whatever the tier lets through is answered by the model, and there Peri's prescription is the right one: build the response around the domain's decision factors, because "architecture is about the response surviving when the model gets the user wrong."

Why the hard tier has no knobs

The temptation, once you have this, is to make all of it configurable per category: fail open here, model-worded there, a confidence knob on each. Resist it. The value of "hard" is that it means exactly one thing: fail-closed, deterministic, no exceptions. Once a category labeled "hard" can be configured to fail open, an auditor can no longer rely on the word. Keep the flexibility where it cannot corrode the guarantee: in which category is hard, never inside the hard guarantee.

The stakes

Peri closes on what the first review asks for: the audit trail of every off-scope query the agent answered. A bias-toward-pass layer logs its refusals, but the doubtful requests it passed are the ones that end up in that trail, and the refusals it logged are sentences a model wrote. Peri's fuller design does not lean on the input check alone: in What to ask your agentic AI vendor, compliance and fabrication checks on every output are hard gates, and "a single detection of a fabricated claim or compliance violation blocks the output." That is a second net, and a good one. It is also a model reading an answer that already exists, while a boundary is declared before any answer is written. A deterministic tier answers for every request it refused, by construction: a logged, policy-determined event, with a category, a reason, and a fixed string versioned with the contract that a regulator can read. What the classifier misses is still a miss, which is why the tier is biased to refuse.

The public demo of this contract isn't up yet. Write to us if you want to see it answer "should I move my portfolio into tech stocks?" with the policy string, word for word.

Intent classification decides what to do with a question. The layer before it, as Peri puts it, decides "whether the question is one the agent should engage at all." For most agents, that second decision can be a lenient, conversational guess. For the ones operating inside a regulatory boundary, it has to be a deterministic control, with a declared category, fixed words and a record for every refusal.

This is the regulated-refusal case of a broader line: communication and proposal may be probabilistic, but authority, consequence, and compliance must be deterministic and declared. The general argument is in You can't fight probabilism with probabilism.

Nicolás Moreno builds Zarel: governed AI operations, where the AI proposes and the contract decides.