Jev as a Risk Gate for AI Agents Touching Prod

An AI agent runs dozens of commands in a session. Most of them are boring: read a file, run the tests, grep for a symbol. A few are not. The one that runs a migration, deletes a bucket, or pushes to the prod cluster looks almost the same in a tool call log. What’s missing is a fast gut-check on every action before it runs. TypeSafe AI’s new model, Jev, looks like it could be that check.

We haven’t wired this up yet. This is a theory post: here’s the idea, here’s why Jev seems to fit, and here’s what I’d be careful about.

What Jev actually is

Jev is TypeSafe AI’s first public “System One Model,” in early access. The name nods to Kahneman’s fast, intuitive System 1 thinking. It doesn’t write text. You send it a state (some text) plus a set of typed questions, and it sends back typed answers:

• Choice picks one label from a list and returns probabilities plus a confidence score.
• Score rates the state against a rubric, also with confidence.
• Noul judges whether a statement is true, returned as a value from 0 to 1.

TypeSafe says each question is evaluated in parallel and in isolation, so adding more questions barely changes response time. Their launch post claims 70–500ms per response and $0.042 per million input tokens, with output “too cheap to meter.”

The part that matters for this idea is calibration. From the launch post: “If a model can do a task 95% of the time but doesn’t say when it’s in the 5%, it can’t automate that task.” TypeSafe says Jev is trained to aim for honest probabilities, and every answer includes a confidence estimate.

The idea: label every agent action by risk

Before an agent runs a tool call, send the command and a bit of context to Jev with a couple of narrow questions:

• A Choice: is this read-only, local-write, shared-infra, or prod?
• A Noul: does this action touch a production system?

Then route it in plain code:

• Read-only or local write, high confidence: let it run.
• Shared infra or prod: stop and ask a human.
• Low confidence on anything: stop and ask a human.

That last rule is the whole trick. You don’t need the classifier to always be right. You need it to know when it isn’t sure.

A sketch

Untested, based on the Python SDK shape in TypeSafe’s quickstart (pip install typesafe-sdk):

from typesafe_sdk import Choice, Noul, TypeSafeClient

client = TypeSafeClient()  # reads TYPESAFE_API_KEY

def assess(command: str, context: str):
    response = client.system_one(
        state=f"Context: {context}\nCommand: {command}",
        questions={
            "risk": Choice(
                instructions="How risky is running this command?",
                criteria={
                    "read-only": "Only reads files or state",
                    "local-write": "Changes local files or a dev environment",
                    "shared-infra": "Changes shared staging, CI, or team resources",
                    "prod": "Changes or could affect production",
                },
            ),
            "touches_prod": Noul(
                instructions="This command affects a production system",
            ),
        },
    )
    # confidence is in the API response; check the SDK docs for the exact field
    return response.answers["risk"], response.answers["touches_prod"].noul

The threshold for “low confidence” is yours to pick. Start strict and loosen it once you’ve seen real labels.

Why not a regex or another LLM?

A regex blocklist is fast and cheap, but it only catches what you thought of. kubectl delete is easy. A script that calls a prod API three layers deep is not.

Asking a frontier LLM on every tool call covers more ground, but it’s slow and expensive to run that often, and it doesn’t reliably tell you when it’s guessing. Jev’s pitch is the gap between those two: fast and cheap enough to run every time, and it hands you a confidence number to branch on.

This is the same point from AI agent harnesses matter more than models: permission checks belong in the workflow around the model, not in hoping the model behaves.

Caveats

• The numbers are TypeSafe’s. Their evals use workflows written by their own team, and they say the headline gains are probably on the high end of real-world results.
• Early access. It runs on the US West Coast, and TypeSafe notes the pricing may be subsidized.
• Text only. Jev takes text state, no images yet, and can’t explain its answer in words.
• It’s a classifier, not a permission system. Real access controls still matter. An agent that can’t reach prod credentials can’t break prod, whatever the label says.

The takeaway

Put a cheap, fast gut-check in front of every agent action, and let low confidence be the signal to pull a human in. Jev looks like a good fit for that first gate. It shouldn’t be the only one.