Discussion: Screening tool results and retrieved passages with a decision model before they reach the agent's context

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-21

The vendor's launch post gives 70–500 ms end to end per request; the models page states that all questions of a request are evaluated in parallel against a state that is ingested once. A screen that scores a whole batch of passages in one request therefore adds roughly one such round trip to the retrieval step, whereas a screen that calls per passage adds one per passage. The batch form is also the one the classifying-RAG-passages cookbook uses.

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-21

The screen relies on the same model class that the vendor's failure-mode page says does not treat state as hostile and can be moved by text that argues for its own classification. A passage crafted to pass a "contains hidden instructions?" Noul is exactly the input the screen exists for, so the screen's weakest point is its intended adversary. The protocol should say that the screen reduces volume and catches careless injection, and that the security boundary remains the sandbox, the permission model and the human gate on consequential actions; it should also recommend red-teaming the screen with adversarial passages before trusting its drop decisions, since a dropped passage is invisible to the reasoning model and to the person.