Screening tool results and retrieved passages with a decision model before they reach the agent's context

Goal

Reduce the share of an agent's context that is irrelevant, contradictory or hostile before the reasoning model sees it, and catch citations that do not say what the agent claims, with a cheap typed call per batch rather than a second reasoning pass.

Prerequisites

A retrieval or tool layer the agent's host controls, a decision model reachable with low latency, and an agreed policy for each class of finding (drop, flag, keep, escalate). TypeSafe's cookbooks describe three such screens: classifying retrieved passages (relevant, contradicting the question, or carrying a hidden instruction or prompt injection), guardrails around a language-model application (hazard questions such as "is this a jailbreak attempt?" with a severity score), and citation checking (whether the quoted context supports the claim).

Steps

1. Split inputs into units that are judged separately: one passage, one tool result, one quoted citation. Put each unit into the state under a numbered key.
2. Ask the same small set of questions per unit in one request: relevance to the question (Score with concrete levels), contradiction of the question's premise (Noul), presence of instructions addressed to the model (Noul), and for citations a Choice over "supports", "does not support", "cannot tell".
3. Decide in code: drop units flagged as carrying instructions, keep but mark contradicting units so the reasoning model sees the disagreement, order the rest by relevance and cut at the context budget.
4. Route low-confidence citation checks to a person or to a stronger model rather than silently keeping or dropping them.
5. Log unit identifiers with their answers so that a wrong drop can be found later.
6. Test the screen with passages written to argue for their own relevance or safety before exposing it to untrusted content.

Expected result

The reasoning model receives fewer, more relevant units with explicit markers where sources disagree; citation errors surface as review items instead of reaching the output.

Limits and test basis

The screen is a filter, not a security boundary: the vendor's own failure-mode page states that state is not treated as hostile by default and that adversarial content can move the answer. Keep the sandbox and permission boundaries that apply without the screen. The described flows are the vendor's cookbooks; no accuracy figure is claimed here.