Deterministic Control and Model Judgment

Every hybrid workflow alternates between a deterministic guard, model judgment, a typed boundary, and a state transition. Ownership splits at the state transition and the human gate. So do the tests.

The five stages below are not a diagram of good intentions. Each one has a published number attached to it in this lesson. A CVE severity score for a guard that lived only in prose. A task-success gap for control flow moved into code. An attack success rate for a tool list that was simply made shorter. An accuracy drop for a typed boundary tightened around a judgment step.

A guard that lives in a prompt can end up catalogued as a vulnerability. This one did. CVE-2025-32711, “M365 Copilot Information Disclosure Vulnerability”, was published on 11 June 2025, assigned by Microsoft itself. The record describes the flaw in one line: “Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.”

The severity is not marginal. The CVSS v3.1 base score is 9.3, Critical. NVD's own analyst score for the same record is 7.5, High. This is the shape this lesson is about, shipped, patched and filed. Untrusted incoming content reached an assistant that had data access. The only thing standing between the two was instructions written in prose. The model followed the injected instruction instead. Nothing was misconfigured. The control was simply stored in the one place an attacker gets to write to.

Hybrid orchestration reserves the model for interpretation, ranking, drafting, or choosing among bounded alternatives. Code and workflow state enforce invariants, permissions, irreversible transitions, and required evidence. This separation does not remove model risk. It makes the consequences of model variability visible, and limits where that variability can reach.

CaMeL is what that looks like when someone measures it. Ten authors published it in March 2025. The design rule is one sentence of the abstract: “To operate, CaMeL explicitly extracts the control and data flows from the (trusted) query; therefore, the untrusted data retrieved by the LLM can never impact the program flow.” A trusted layer derives the plan from the user's query first. The model meets untrusted data only after that.

The bill arrives with the guarantee. CaMeL solves 77% of AgentDojo tasks with provable security against prompt injection. The same agent, left undefended, solves 84%. Seven points of utility, paid once, for a security property enforced by code instead of argued for in a prompt.

Prompt-only control, hybrid control, and fully deterministic control put the invariant in three different places: in the wording of the instruction, in the code wrapped around the model, or in the code alone. The test that separates them is simple. Reword the prompt, or just run it again, and see whether the rule still holds.

That test has a name and a published number. τ-bench introduced pass^k in 2024 — the chance that all k i.i.d. trials of a task succeed, averaged across tasks. Its abstract states the result: “Our experiments show that even state-of-the-art function calling agents (like gpt-4o) succeed on <50% of the tasks, and are quite inconsistent (pass^8 <25% in retail).” In figures: the GPT-4o function-calling agent reached 61.2% pass^1 in the retail domain and 35.2% in airline, 48.2% on average. At pass^8 in retail it falls below 25%.

Same agent, same policy document, eight runs. The task came out right every time in fewer than a quarter of cases. Prompt-only control is not weak because someone worded it badly. It is weak because it is re-decided on every run. pass^k is how you watch that happen.

Take one workflow and divide it by who is responsible for what. Mark which steps hold an invariant and which genuinely need judgment. A good split shows two things: where you have been asking the model to interpret a rule and police it at the same time, and where the rule is enforced by code that does not care how the request was phrased. Keep both lists.

The adversarial step at the end already has a public harness, and the harness has a size. AgentDojo is an adversarial test environment of 97 realistic agent tasks and 629 security test cases across four environments: Workspace, Slack, Travel Agency and e-banking. The defence that performed best in it is also the least clever available. Restrict which tools the agent may call at all. The paper reports it in one line: “Our simple tool filtering defense is particularly effective, lowering the attack success rate to 7.5%.”

The stated limit belongs on your list next to the result. Tool filtering fails for the 17% of test cases where the tools needed to do the job are also sufficient to carry out the attack. So 7.5% is the payoff for exposing only valid actions for the current state. The 17% is the size of the residue that marking invariants and guarding transitions has to cover, because no shorter tool list will.

Do not ask only whether the model can perform the task. Ask which part benefits from judgment. Keep the invariant parts outside the model.

The measurements in this lesson all point the same direction, and they point with different instruments. A control that lived in prose was catalogued as CVE-2025-32711 at CVSS v3.1 9.3, Critical. A control moved into extracted control flow cost seven points of task success — 77% against 84% — and returned provable security against prompt injection. A control implemented as a shorter tool list brought attack success down to 7.5%, and stopped covering 17% of cases. A policy carried in the prompt and rerun eight times held below 25% pass^8 in τ-bench retail. And where the boundary was tightened around a judgment step, GSM8K exact match moved from 94.57 to 86.95.

So put the enforcement somewhere a rewritten prompt cannot reach. Keep the model on the steps where interpretation is the actual work. Expect to pay for the separation in points of utility, rather than pretending it is free.