What two models cost in practice

What two models cost in practice

Running a second model has an obvious price, and the obvious price is usually the smaller one.

Latency and tokens go up, though less than people assume. The quarantine call is a narrow extraction against a schema, which is exactly the workload a small fast model handles well. This is a good place for the cheapest model that can hold a schema, and using your frontier model for both roles is usually waste rather than caution.

The larger cost is that the architecture stops being a single call. Debugging gets harder, traces have two legs, and "the model got it wrong" now requires knowing which model. Budget for the observability work rather than discovering it during an incident.

The schema is the specification

Writing these schemas is the part of the work that feels least like security and matters most.

Every schema is a statement of exactly what the system needs from a piece of untrusted content, and writing one forces a question teams usually skip: what is the minimum this task requires? The habit that has grown up around agent tooling is the opposite, handing the model the whole document and letting it work out what matters.

This is where spec-driven development earns its place in a security book. The specification is not documentation of the contract, it is the enforcement of it. A field you do not declare is a field an attacker cannot use.

Keep schemas narrow. A schema with an object Extra or a Dictionary<string, string> Metadata has given the whole thing away for the convenience of not having to think about which fields are needed.

What this costs

Capability, and the cost is real rather than theoretical.

Some tasks genuinely require the planner to reason over untrusted content. Open-ended research over fetched pages, conversational question-answering across a document corpus, anything where the useful output is prose rather than structure. Quarantine does not support these, and no schema will make it.

Three honest options when you hit one. Accept the tainted planner for that specific flow and lean entirely on the gate, which is the usual answer. Split the product so the open-ended flow has no tools worth attacking, which is the good answer where the product allows it. Or put a human between the reasoning and any action, which is chapter 14.

What you should not do is quietly widen a schema until the boundary means nothing. A string Content field added at 4pm on a Friday undoes this entire chapter, and nothing in your test suite will notice.

Chapter 8 gives the planner an authority it cannot widen, so that a compromised planner is still limited to what the task actually required.

Sources for this chapter

The IQuarantinedReader interface, the RefundRequest example, and the C# throughout are the author's constructions, not CaMeL's implementation, and carry none of that paper's evaluated guarantees. The three leak paths (free-text fields, error messages, enum abuse) are the author's analysis from the mechanism rather than published findings; the enum channel in particular has not been measured here and its bandwidth is asserted to be low on reasoning alone. The argument that quarantine constrains the shape of attacker influence rather than eliminating it is the author's framing and is the most important claim in the chapter to disagree with if you think it is wrong.