An agent asks: I'm agent X, my task is Y, it's about company Z, and I have about 6,000 tokens. What should I actually be looking at?
Most systems answer with "the top results from a vector search". That fails in three ways, and each one needed its own fix.
Four ideas carry the nine stages.
Before anything is ranked, sources are filtered: inactive ones, human exclusions, untrusted sources for agents that can write, tenancy mismatches, personal data, workflow restrictions. Every rejection is written down with its reason.
Pinned sources go in first. The rest are sorted by value per token, penalized for redundancy, and packed until the marginal utility falls below a floor. Allocation stops there, even with budget left.
The prompt is built as directive, task, evidence and a tail restatement. The lowest trust tier can never reach the directive band, enforced in code and by a database CHECK constraint. Low-trust text is wrapped as data to analyse.
Shadow A/B runs, ablations and inclusion trials measure what each source is worth. The proposer drafts a change only with enough evidence, and a person approves it. Revert is one click.
What an agent sends, and what it gets back.
An LLM scores outputs criterion by criterion, but the overall score is recomputed in code from fixed weights. The model's own total is never trusted. Rubrics are immutable: a change is a new version.
Humans label a golden set, and the system measures rank correlation, mean error and bias between its judge and the humans, so it knows how much to trust itself.
Because the last few slices usually cost more attention than they add. Past the marginal-utility floor, more context dilutes the signal and raises cost and latency.
A 2-second timeout races the whole pipeline. A timeout, an exception or a rate-limit breach all return a deterministic static prompt with fallback_used set to true. Summaries degrade to deterministic extracts under 2.5 seconds, and embedding dedupe falls back to shingle overlap.
A clean boundary with the firm's context graph: the graph owns the directive band, meaning truth and routing. The engine owns the evidence band: fetch, budget, order and format. The graph never retrieves, and the engine never judges truth.
A 22-assertion verification suite runs against a live server and checks determinism, replay identity, trust-tier protection, tenancy isolation, fail-open behaviour and token accounting. The spec is executable.
Need something like this? I build these end to end, as a full-time engineer, on contract, or with SKAI Group.
Book a 30-min callAgents giving answers nobody can explain? Let's look at what they're seeing.