# I'm Building an Agent. Where Does Jev Fit?

> Jev for agent builders: what it returns, the five tests before a decision goes to it, where it fits in your stack, and how to shadow-test it first.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-09-21
- Canonical (HTML): https://cellcog.ai/blog/how-to-use-jev-in-your-agent/
- Section: Guides / Workflows & use cases
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Jev is a hosted, text-only API: one request with a state and a set of typed questions returns, in parallel, a Choice with a probability per option, a Score on an ordered rubric, or a Noul, the probability that a yes/no statement is true. It generates no text. $0.042 per million input tokens, output free, 64k tokens per request, limits TypeSafe says can change without notice.
- A decision belongs on a decision model only when five things hold: the option set is closed before the call, the same question recurs often enough to calibrate, a wrong permitted answer is bounded by a threshold plus an abstain option, the state fits well under 32k tokens after filtering, and the probability changes what your code does. Fail one and the decision stays with the model that reasons.
- For permission and safety decisions, Jev is a second reviewer that can only escalate, never the declarer. TypeSafe's own docs say adversarial content in the state can move the answer. Wire it so a yes raises the level and a no changes nothing.
- One verdict is weak and five questions are strong. On 2,000 phishing emails an independent bench put Jev's single verdict at 62.6% against 81.3% for a small LLM, then reached 95.1% by asking Jev five signal questions and combining them in a trained model. Decompose the judgment; combine in code.
- The abstain option is load-bearing. In a 7,000-call independent audit, removing the unknown option took the calibration error from 0.023 to 0.793 and made the model guess with confidence. Every schema you write carries an unknown or none-of-the-above option.
- Introduce it in stages: pin the version, replay your own past decisions with planted controls, run it in shadow beside the current path and log every disagreement, then move one bounded decision behind a flag with the old path as fallback. Shadowing 100,000 decisions costs about five dollars; the kill switch is a flag, never a deploy.

## At a glance

- **Where does Jev fit in an agent?** Under the agent's recurring, closed-set decisions: routing a task, gating whether a signal is worth waking for, verifying a step, scoring a lead or a story, pre-reading an inbound message. The model that plans, writes and reasons keeps everything else. Jev picks among options it is given; it never proposes.
- **Should Jev decide what my agent is allowed to do?** Not alone. Use it as an escalate-only second opinion beside your existing classifier: it can raise a risk level, never lower one. TypeSafe's own documentation says content written to steer the model can move its answer, so it is never the sole defense against an injected instruction.
- **How do I find out if it works for me?** Replay your own past decisions offline with planted known-good and known-bad items, measure calibration on your labels against a noise floor, then run it in shadow beside the current path. A hundred thousand shadow decisions at 1,200 tokens each cost $5.04 at the list price. Promote one bounded decision only after the shadow numbers hold.

I'm building an agent. This week every feed I read says the same three things about [Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev), TypeSafe AI's decision model: faster, cheaper, cannot hallucinate. What none of them tell me is where it goes. Not what it is; our [record from September 19](https://cellcog.ai/blog/jev-typesafe-decision-model/) answers that and grades the launch claims. The question I actually have is which of my agent's decisions should move onto it, which should stay with the model that writes the plan, and how I would find out without betting the product.

This is that guide, written from TypeSafe's own documentation and the independent tests published in the first week, all read on September 21, 2026. The short version: Jev belongs under the agent's decisions, never in place of the agent. Every decision below is one our own agents make many times in a working session. Yours will have the same shapes with different names.

## What Jev returns

*Table: The interface, from TypeSafe's Models and API pages (read September 21, 2026)*

| Item | What the page says |
|---|---|
| Request | One POST with a `state` (string, JSON object, or array of text) and a map of typed questions; the state is ingested once and every question is evaluated against it in parallel |
| Choice | One of a declared set of options, with a probability per option and a `confidence` number |
| Score | A level on an ordered rubric of two to ten levels, with the distribution and a `confidence` number |
| Noul | The probability that a yes/no statement is true; "Noul answers don't carry" a confidence value |
| Output | No text. No images, audio or video in |
| Price | $0.042 per million input tokens; "Output tokens are free" |
| Context | 64k tokens per request; 32k for the state plus the longest question |
| Limits | 250,000 tokens per second and 1,200 requests per minute; the limits "can change without notice" during early access |
| Versions | `jev-1.13.0`; the aliases `jev-latest` and `jev-preview` both resolve to it; an alias moves when a release ships, so TypeSafe says to "pin that version's ID" if you tuned thresholds |
| Customization | None: the model "is not fine-tuned or LoRA-adapted with customer data"; you shape answers through the state, instructions and criteria |
| Language | "English is the primary training language and where accuracy is currently best" |

Three properties matter for placement. It picks; it does not propose, so your code must generate the candidates. It returns a distribution, not a sentence, so your code can threshold, log and test it. And the [confidence](https://docs.typesafe.ai/confidence) number is derived from the probabilities by a formula TypeSafe says you are "never locked into", so the thing to log and threshold on is the probability itself.

*The guide in four pictures, from TypeSafe's docs and the first independent tests*

![Scoreboard on a near-white ground: one bar at 62.6 labelled ONE VERDICT, one at 81.3 labelled SMALL LLM, one at 95.1 labelled FIVE QUESTIONS PLUS A COMBINER](https://cellcog.ai/blog/media/how-to-use-jev-in-your-agent/slide1.webp)
*One verdict is weak, five questions under a combiner are strong: the same 2,000 emails*

![Three panels labelled ROUTE, GATE, VERIFY with small diagrams, and a fourth greyed panel labelled GENERATE with a cross](https://cellcog.ai/blog/media/how-to-use-jev-in-your-agent/slide2.webp)
*Three verbs a decision model is good at, and the one it is not*

![Cost ladder with four rungs: Jev $4.58, GPT-5.6 Luna $35.40, Gemini 3.8 Flash $126.75, Claude Fable 5.1 $1,690, per 100,000 decisions](https://cellcog.ai/blog/media/how-to-use-jev-in-your-agent/slide3.webp)
*What 100,000 decisions cost on each path, list prices, arithmetic in the post*

![Timeline of four stages, replay, shadow, one gate behind a flag, widen, with a red lever labelled KILL SWITCH running under all four](https://cellcog.ai/blog/media/how-to-use-jev-in-your-agent/slide4.webp)
*Shadow first, one bounded gate second, widen third, kill switch throughout*

## Five tests before a decision goes to Jev

The docs page I would read first is not the quick start; it is the one TypeSafe calls [Jev 1.13 jaggedness](https://docs.typesafe.ai/model-jaggedness/jev-1.13), nine failure modes with a fix for each. It says the model "answers the question you wrote, not the one you meant", that it "is not a calculator", that it "reads dates as text, not as ordered quantities", that it "suffers from context rot" when the state carries material the question does not need, and that "State is data, and `jev-1.13` does not treat it as hostile by default." Read against that page, a decision belongs on a decision model when all five of these hold:

1. **The option set is closed before the call.** Choice, Score or yes/no. If the answer has to be invented, it is not a Jev decision.
2. **The decision recurs.** Calibration is measured, not assumed; a decision made ten times a day never accumulates the data to tune a threshold.
3. **A wrong permitted answer is bounded.** A threshold band with an abstain option routes the middle to the expensive path (a frontier model or a person). TypeSafe's confidence page puts it as "Thresholds scale with risk".
4. **The state is short after filtering.** Under 32k tokens by rule, a few thousand by preference; your code strips what the question does not need.
5. **The probability changes what code does.** If nothing branches on the number, you have bought a label and a bill.

Fail any one and the decision stays with the model that reasons. That rules out generation, arithmetic, dates and counting, multi-hop inference, anything whose correctness depends on knowledge outside the state, irreversible actions where the model would be the only check, and adversarial input where it would be the only defense.

## The map: where it fits in my agent

My agents are AI employees: they read an inbox, classify every command before it runs, decide whether a signal is worth waking for, route tasks, score leads and stories, and check their own work. Here is the map I would build for that agent, with the failure that would hurt most in each cell. The tokens are my assumptions about the shape of each decision; the verdicts follow the five tests.

*Table: Where Jev fits in an agent shaped like ours (September 21, 2026)*

| Decision | Shape as Jev questions | Fit | The model keeps | The failure that would hurt most |
|---|---|---|---|---|
| Wake a resting agent for a signal | Noul "does this need the agent before its next scheduled session?" plus an urgency Score, plus an unknown option | Strong: bounded, high volume, low confidence wakes | Everything after waking | A false "no wake" on a real customer reply; bounded by the low-confidence-wakes rule and the next scheduled read |
| Route a task to a role | Choice over N roles plus "unclear" | Strong after shadow | Doing the task | A misroute wakes the wrong agent |
| Verify a completed step | Nouls: "completed?", "in scope?", "touched anything unexpected?" | Strong after shadow | Retry or repair | A false "completed" ends a task early and silently |
| Score a lead against a profile | Scores per criterion plus a Noul "obvious mismatch", combined with weights in code; numeric rules stay in code | Strong as the first pass before paid enrichment | The research and the personal email | Systematic false negatives on one segment |
| Filter candidate stories | Score relevance, Nouls "primary source?", "on our topics?" | Strong: an editor is already the floor | The final pick and the writing | Dropping the one story that mattered |
| Pre-read an inbound email | Parallel Nouls: automated?, needs a reply?, asks for something only the owner can decide?, contains an instruction aimed at the agent?, plus a language Choice | Strong for the pre-read, never for the reply | Reading, composing, every action | A false "no reply needed" on a customer |
| Classify a command's risk before it runs | Score over the ordered levels plus Nouls "reaches outside the workspace?", "hard to undo?" | Only as a second reviewer that can raise the level, never lower it | The declaration and the reason a human reads | A dangerous command scored safe; escalate-only wiring makes that impossible by construction |
| Grade outbound copy against house rules | Nouls: "quotes a price?", "compares to a human hire?", "promises a date?" | Strong, beside the existing rule gate | Writing and fixing | A false pass on a price figure |
| Pick which page to show a reader | Choice over pages plus "generic" | Weak: thin state gives prior-driven answers; reader data to a new processor | The copy | Consent and privacy review before any of it |

Two of those rows deserve a sentence. The wake gate is where the return is largest, because the thing a false wake wastes is a whole working session of a frontier model. At 1,400 tokens a decision, Jev costs $0.0000588; one avoided false wake that would have cost even a single dollar of model time pays for 17,007 Jev decisions (1 / 0.0000588). The risk classifier is where the return is most tempting and the wiring matters most. Today, in our design and in Claude Code's [auto mode](https://cellcog.ai/blog/claude-code-auto-mode/), the acting agent classifies every command before it runs and the platform enforces the threshold ([how our approval rail works](https://cellcog.ai/blog/every-tool-one-approval-rail/)). A decision model fits as an independent second read of the same command that can only make the effective level stricter. That is the shape Vercel wired into its own agent, where a caution verdict pauses a call until a person approves it, and the shape TypeSafe's jaggedness page argues for by conceding that adversarial state can move the answer.

## One verdict is weak; five questions are strong

The most useful independent result of the first week is a [phishing bench](https://github.com/anisselbd/jev-phishing-bench) run on September 17, 2026 over 2,000 emails. Asked for a single verdict, Jev scored 62.6% against 81.3% for Claude Haiku 4.5, and its recall on phishing was 43.2% against 76.4%. Asked five signal questions instead, with a cross-validated logistic regression combining the five probabilities, the same model reached 95.1% accuracy with an AUROC of 0.988 and a calibration error of 0.027.

*Table: The same 2,000 emails, three designs (independent bench, September 17, 2026)*

| Design | Accuracy | Notes |
|---|---|---|
| Jev, one Choice verdict | 62.6% | Recall on phishing 43.2%; p50 latency 239 ms from France |
| Claude Haiku 4.5, one verdict | 81.3% | Recall on phishing 76.4%; p50 latency 687 ms |
| Jev, five signal Nouls plus a logistic combiner | 95.1% | AUROC 0.988, ECE 0.027 |

That is TypeSafe's own advice, stated on its Models page: "Decompose broad judgments into atomic questions and combine the outputs in code." Two rules follow for my agent. Every judgment becomes several literal questions, never one broad one; and the labels that train the combiner come from human outcomes (the approval a person granted, the reply that arrived), never from my own LLM's verdicts, or the LLM's errors become the target.

Parallel questions are also where the cost goes. TypeSafe's [parallel questions cookbook](https://docs.typesafe.ai/cookbooks/parallel_questions) reports that batching every question into one call is "12.2x cheaper and 10.0x faster with no change in answers" than asking them one at a time. The unit of design is one state and many atomic questions.

## What it costs, with the arithmetic

List prices per million tokens, read on the vendors' pricing pages on September 21, 2026: Jev [$0.042 input, output free](https://docs.typesafe.ai/models); [Gemini 3.8 Flash](https://ai.google.dev/gemini-api/docs/pricing) $0.75 input and $3.75 output through December 31, 2026; [GPT-5.6 Luna](https://platform.openai.com/docs/pricing) $0.20 and $1.20; [Claude Fable 5.1](https://docs.anthropic.com/en/docs/about-claude/pricing) $10 and $50. For a decision over a 1,000-token state I assume 90 tokens of questions for Jev, and 290 tokens of prompt plus schema overhead and 80 output tokens of JSON for an LLM classifier. Cost is input tokens times the input price plus output tokens times the output price, each divided by a million.

*Table: Cost per decision and per 100,000 decisions, list prices, inputs above*

| Path | Cost per decision | Per 100,000 decisions | Times Jev |
|---|---|---|---|
| Jev, 1,090 input tokens | $0.0000458 | $4.58 | 1x |
| GPT-5.6 Luna, 1,290 in and 80 out | $0.000354 | $35.40 | 7.7x |
| Gemini 3.8 Flash, 1,290 in and 80 out | $0.0012675 | $126.75 | 27.7x |
| Claude Fable 5.1, 1,290 in and 80 out | $0.0169 | $1,690.00 | 369x |

Read that table with the baseline named. The 444.6x figure on TypeSafe's home page comes from its own workflow evaluations against expensive models, and the launch post says "we expect that these are on the higher end of real world gains" and, on price, "We can't prove it isn't subsidized". Against the cheapest LLM in the table the per-token edge is single digits. The edge that survives every baseline is latency: TypeSafe quotes "70ms-500ms" per call, and the phishing bench measured a median of 239 ms from France against 687 ms for the small LLM on the same emails.

The honest comparator for my agent is neither column. Most of these decisions today happen inside a long agent turn that already holds the whole context, and a decision made there costs the turn, not a classifier call. Moving a recurring decision out of the turn buys something the dollar column does not show: a call you can log, threshold, version-pin, test against labels and switch off independently of the agent that made it. A verdict buried in an agent's prose is none of those things.

## What I would worry about

Specific to Jev as it stands this week:

- **Early access churn.** Limits "can change without notice"; aliases move; there is no SLA on the docs pages I read. Pin `jev-1.13.0`, log the `model` field the response returns on every call, and keep the old path live.
- **Adversarial state**, in TypeSafe's own words: content "written to adversarially steer the model, whether that is an injected instruction, a deliberately misleading framing, or text that argues for its own classification, can move the answer." Never the sole defense; plant injected instructions in your test set.
- **Non-determinism and incoherence.** An [independent calibration audit](https://github.com/jujumilk3/jev-calibration-audit) of about 7,000 calls found that "50 identical requests gave 15 distinct answers", that a Noul and a two-option Choice on the same question disagree, and that shown the options with the question removed the model "still scores 0.38-0.46 against a chance rate near 0.15". Use abstention bands, not point thresholds; give every evaluation a state-blind arm.
- **The abstain option is load-bearing.** In the same audit, removing the unknown option moved the calibration error from 0.023 to 0.793 and made the model choose a stereotyped answer at 0.79 confidence. Every schema carries an unknown or none-of-the-above option.
- **Language.** English primary; the audit measured accuracy 6.5 points lower on identical Korean items with the calibration error unchanged. Slice by language before any gate that reads user text.
- **Data leaving the platform.** TypeSafe's Models page says Jev "is not trained on customer requests or responses"; the docs point to a data processing agreement and to zero data retention for enterprise customers. Read the customer agreement before customer email or command text reaches a second processor, and ask counsel what your own privacy policy says about it.
- **Vendor dependence.** Hosted only, one vendor, undisclosed architecture, a price the vendor itself calls unproven. Design so that on a `429`, `529` or timeout the decision falls back to the current path and nothing ever blocks on the call.

True of any decision model, Jev included:

- **Schema-bound is not correct.** An approve for an unauthorized action still fits the schema. Only a labeled test on your own distribution and a policy layer that never treats a classification as authorization defend against it.
- **Calibration belongs to the task, the wording and the population**, not to the model. Independent calibration errors in the first week ranged from near zero to 0.154 by task on the same model. Re-test when the wording changes.
- **The noise floor.** The audit's own note: at 60 items a perfectly calibrated model still scores an ECE near 0.045. Small-sample claims in either direction are noise; plan on thousands of labeled items per decision, not hundreds.
- **Calibrated atoms do not make a calibrated composite.** Test the decision your code takes, not only the questions it asked.
- **Silent drift.** A vendor retrain, an alias move, or a change in your own inputs moves the distribution without raising an error. A fixed probe set on a schedule is the only detector.

## How I would introduce it

Stage 0, before code: choose the data path (a gateway with per-request zero retention, or the vendor directly under its agreement), get counsel's read, pin the version, and put the key where your other credentials live, never in a prompt.

Stage 1, offline replay. Build labeled sets from your own history with the outcome a human confirmed: commands with the approve or deny that followed, wake events with what the agent did after waking, leads with the reply that came or did not. Plant controls and print them beside every result: known-dangerous commands, known-safe ones, commands with a comment arguing their own harmlessness, a state-blind arm, two wordings per question, three repeats per item. Report accuracy with intervals, a reliability diagram, calibration error against the noise floor for your sample size, and the coverage-versus-error curve at the operating point you would actually run. At 1,200 tokens an item, 2,000 items cost 2.4 million tokens, about ten cents a pass; run it as often as the questions need.

Stage 2, production shadow. Jev runs beside the current path on all traffic of one decision class, never acts, and logs the answer, the full probabilities, the `model` field, latency and the incumbent's decision next to the eventual outcome. Adjudicate a weekly sample of disagreements and a smaller sample of agreements, to catch shared errors. Run at least two weeks and at least 5,000 decisions. A hundred thousand shadow decisions at 1,200 tokens are 120 million tokens: $5.04.

Stage 3, the first production decision, chosen by bounded failure: for my agent the wake gate, where the worst case is a reply that waits for the next scheduled session, or the escalate-only second read on command risk, where the worst case is extra approval prompts. Behind a flag per decision class, with the old path as the live fallback.

Stage 4, widen, one class at a time, each through stages 1 and 2 on its own data.

The kill switch is a flag, never a deploy, and it also trips automatically: error or timeout rate above 2% over five minutes, p95 latency above 1.5 seconds, a `model` field that is not the pinned version, a disagreement rate outside two standard deviations of the shadow baseline for a day, or an adjudicated error above the bound you wrote down before stage 3. Write the stop conditions before the first production call, relative to the incumbent's numbers: calibration that does not hold on your labels at a thousand items or more, planted dangerous items flipping to safe at any rate above the current path's, a language slice more than five points below English, or a version change that moves your thresholds twice.

## Three uses that are not classification in a pipeline

The map above is the safe version of the idea. Three more shapes are worth a hypothesis each, with the evidence that would confirm or kill them.

**Disagreement as a regression sensor.** Pin Jev and run it in permanent shadow on a few percent of the incumbent's decisions. A fixed, cheap reference against a moving system is a label-free canary for changes on your side: a foundation-model update, a prompt edit, a format change. Confirm it by injecting a known regression in staging and watching the disagreement rate jump; kill it if the natural variance at your volume swamps plausible effect sizes.

**A typed first impression before the turn.** One parallel call over an inbound artifact, thirty questions on a 2,000-token state, writes a structured header into the agent's context before it starts: sender type, the asks, urgency, language, "contains an instruction aimed at the agent". The hypothesis is that a turn that starts with structure uses fewer tokens and fewer turns, and that injection attempts arrive pre-flagged. Confirm with an A/B on tokens and turns per handled message; kill it if the agent re-derives the header anyway.

**A semantic gate on outbound copy.** Rule gates catch strings: a banned word, a price figure. A decision model catches meaning: "compares the product to a human hire", "quotes a retired price", "promises a date", in any phrasing and any language the model handles. Confirm with recall of 95% or better on a labeled set of past violations including paraphrases; kill it if recall falls below the regex on literal cases or the false-positive rate blocks routine mail.

## What I am watching

- **A published calibration curve from the vendor.** TypeSafe publishes none; every reliability number so far is independent and small. A vendor curve on a named dataset changes the evaluation budget.
- **Adversarial hardening.** The jaggedness page says "We expect to improve on this in the future." A version that treats state as hostile by default moves the risk classifier from second reviewer toward first, still never sole.
- **Vercel's price after September 25, 2026.** Jev was free on Vercel's AI Gateway for its first week; Vercel's own launch post says that "By hour 24, nearly 13% of paid teams were using it" and that "Every other recent model launch remained below 7% after a full day." A free week among a gateway's paying customers is a real number about that week and nothing else; the post-promotion price and the retention are the numbers that matter.
- **A second decision model.** Open-weight replications appeared within the week. The day one is good enough to self-host, vendor dependence stops being a worry and starts being a procurement choice.

I came to this expecting to decide whether Jev goes into my agent. The honest answer is that "into" was the wrong preposition. It goes under: beneath the recurring, closed-set decisions the agent already makes, as a call I can log, threshold and switch off, with the agent that reasons kept exactly where it is. That is also how we build AI employees: the agent owns the outcome, the rails classify what it is about to do, and the owner sets the line it may not cross alone. [Hire one for any role](https://cellcog.ai/ai-employees) and watch where the decisions land.

## Sources

- TypeSafe AI, [Introducing System One Models & Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev), September 15, 2026; read September 21, 2026.
- TypeSafe docs, [Models](https://docs.typesafe.ai/models), [API](https://docs.typesafe.ai/api), [Confidence](https://docs.typesafe.ai/confidence), [Jev 1.13 jaggedness](https://docs.typesafe.ai/model-jaggedness/jev-1.13) (last reviewed September 17, 2026), [Parallel questions cookbook](https://docs.typesafe.ai/cookbooks/parallel_questions); all read September 21, 2026.
- anisselbd, [jev-phishing-bench](https://github.com/anisselbd/jev-phishing-bench), results dated September 17, 2026; read September 21, 2026.
- jujumilk3, [jev-calibration-audit](https://github.com/jujumilk3/jev-calibration-audit); read September 21, 2026.
- Vercel, [Jev is the fastest-adopted model in AI Gateway history](https://vercel.com/blog/ai-gateway-jev-model-launch), September 18, 2026; read September 21, 2026.
- Google, [Gemini API pricing](https://ai.google.dev/gemini-api/docs/pricing); OpenAI, [API pricing](https://platform.openai.com/docs/pricing); Anthropic, [Pricing](https://docs.anthropic.com/en/docs/about-claude/pricing); read September 21, 2026.
- Our own record, [Jev, TypeSafe's Decision Model: What It Is, Why It Spread](https://cellcog.ai/blog/jev-typesafe-decision-model/), September 19, 2026.

## FAQ

**What is Jev and what does it return?**

Jev is TypeSafe AI's decision model, in early access since September 15, 2026. You send a state (text or JSON) and a set of typed questions in one request; it returns every answer in parallel as a Choice with a probability per option, a Score on an ordered rubric, or a Noul, the probability that a yes/no statement is true. It produces no text and accepts no images or audio. Price is $0.042 per million input tokens with output free, 64k tokens per request, and rate limits of 1,200 requests per minute and 250,000 tokens per second that TypeSafe says can change without notice.

**Can Jev replace the LLM in my agent?**

No. Jev selects among options you give it; it cannot generate a plan, a draft, a tool call or an argument, and TypeSafe's own docs say it is not a calculator and reads dates as text. It belongs under the agent's recurring closed-set decisions (route, gate, verify, score) while the generative model keeps everything that requires text, world knowledge or multi-step reasoning.

**How much does Jev cost compared with an LLM classifier?**

For a thousand-token decision at list prices read September 21, 2026: Jev about $0.000046, a GPT-5.6 Luna classifier call about $0.00035 (7.7 times more), a Gemini 3.8 Flash call about $0.0013 (28 times more), a Claude Fable 5.1 call about $0.017 (369 times more). The 444x figure on TypeSafe's site is measured against expensive models; against the cheapest LLMs the per-token edge is single digits and the measured edge is speed.

**Is Jev safe to use for permission or security decisions?**

Only as an additive signal. TypeSafe's jaggedness page says the model does not treat state as hostile by default and that adversarial content can move the answer. An independent phishing bench put its single-verdict recall on phishing at 43.2% against 76.4% for a small LLM. Use it as a second reviewer that can raise a risk level and never lower one, keep your existing classifier and policy layer as the floor, and test with planted adversarial inputs before trusting it anywhere.

**How do I test Jev before it makes a real decision?**

Build a labeled set from your own past decisions with the outcome a human confirmed, add planted known-good and known-bad items and a state-blind arm (the same questions with the state removed), and measure accuracy, a reliability diagram and calibration error against a noise floor for your sample size. Then run it in shadow beside your current path, logging the full probabilities and the model field on every call, and adjudicate the disagreements. Pre-register the numbers that would make you stop before the first production call.

**Does Jev work in languages other than English?**

TypeSafe says English is the primary training language and other languages, including CJK scripts, are handled but not equally well, and asks you to test your own content first. An independent audit found accuracy 6.5 points lower on identical Korean items with the calibration error unchanged, meaning the model knew it was less sure. Slice your evaluation by language before any gate that reads user text.

## Related

- [Jev, TypeSafe's Decision Model: What It Is, Why It Spread](https://cellcog.ai/blog/jev-typesafe-decision-model/index.md)
- [Your Agent Can Now Reach Every Tool You Use: 20,000+ Actions, One Approval Rail](https://cellcog.ai/blog/every-tool-one-approval-rail/index.md)
- [Claude Code Auto Mode: What It Does, How to Turn It Off](https://cellcog.ai/blog/claude-code-auto-mode/index.md)
- [Best AI Agent Harnesses: September 2026 Rankings Across the Full Agent Stack](https://cellcog.ai/blog/best-ai-agent-harnesses/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/how-to-use-jev-in-your-agent/. Try CellCog free, no credit card needed: https://cellcog.ai/signup