The model produces the score. The organisation owns the threshold. No score is not a pass. Mario respawns. Your payment run doesn't. Linux laptop. Qwen 3.5, two billion parameters, a small decision head on top. The model scores the available moves. No generated text.

TypeSafe introduced Jev: structured, probabilistic outputs rather than generated text. A decision model gives a proposed tool call a typed interface — is it grounded, should the workflow retry or escalate — often with a score. Authorization stays a policy decision. The enterprise standard is the control contract, not a decision model everywhere: record the proposed action, the model result, the policy version, and the disposition, and name the owner. The control can live inside the runtime. It must stay outside the model's discretion.

Agent gateways are becoming commodity infrastructure, but their native policy engines are not interchangeable. Externalising the decision point — one place where every gateway asks whether a call should proceed — is what keeps identity, authorization, and audit coherent as gateway sprawl arrives.