Do not use a language model when the input space is bounded, when the rule is stable, or when a deterministic implementation already exists. Three conditions disqualify outright; a fourth — a wrong answer costing money, credentials or access — means the model may propose but never decide. A date comparison, a JSON parser and an authorisation check are faster, cheaper and correct by construction — a property no model offers at any price, since a model is correct only by measurement.
Ross Jones — Founder, The Hopium Lab. Last modified 21 July 2026. Twenty-four shipped products across fifteen sectors.
Which jobs get sent to a model that should not be?
Five jobs recur in every stack I open: an unfiltered scrape, a rule written into a prompt, a parse of a format that has a grammar, a total computed in prose, and a stable taxonomy reclassified on every run.
| Failure mode | Sent to the model | What the job is | The tell |
|---|---|---|---|
| No prefilter | Every scraped item, in full, to a classifier | A date comparison, a domain allowlist, a hash | Most verdicts come back identical |
| Prompt-as-policy | "Never approve Y" in the system prompt | An authorisation check in the harness | Your access control is a paragraph of English |
| Schema amnesia | A published grammar, sent as prose | A parser standardised decades ago | You pay tokens to re-derive a spec |
| Untooled arithmetic | Figures in, a total back, no tool call | Code computes; the model only picks inputs | A total that never disagrees with itself |
| Category creep | A nine-category taxonomy, rebuilt every run | Rules for the confident majority, model for the residue | Nobody has measured the ambiguous fraction |
The prefilter case is not mine: Matthew Groff wrote the scraped-articles version at Umbrage in September 2024 — date filter, domain blacklist, keyword filter, dedupe, then the model on what survives. Correct, and widely copied. What the Umbrage post lacks is the arithmetic, and arithmetic is the only thing that moves a room where the expensive version already exists.
What does one model call actually cost at volume?
Around $68 a day to classify 40,000 items on the cheapest model in the current Anthropic line, and exactly five times that on the flagship — because per-item cost is dominated by tokens that never repeat.
A feed job from my own ingest: 40,000 items a day, 1,500 input tokens each, forty tokens back. On Haiku 4.5 at Anthropic's list price of $1 and $5 per million tokens (checked 21 July 2026), that is 60 million input tokens at $60 plus 1.6 million output at $8, uncached: $68 a day, about $24,800 a year, for a classifier whose answer is mostly the same value. The identical job on Opus 4.8 at $5 and $25 costs $340 a day — roughly $124,000 a year.
Every item a prefilter removes cuts that bill proportionally: strip nine in ten before the model and the $68 day becomes $6.80.
The rebuttal is that caching makes inference cheaper still. Cache reads run around a tenth of base input price — on the tokens that repeat. In the classifier job priced above, the instructions repeat, the article does not, and the article is most of the input.
Prompt caching discounts the tokens that repeat. The document you are classifying is the part that never repeats.
Can a prompt enforce a rule?
No. A prompt is an instruction to a stochastic process, and an instruction is not an enforcement boundary.
The strawman — a model inside the authorisation check, deciding who may read a record — nobody competent builds. The real failure is quieter and near-universal. Prompt-as-policy is putting a rule in the system prompt and treating the prompt as an enforcement boundary. Spending limits, refund thresholds, tenant isolation — English, in a context window, next to attacker-controlled text.
OWASP has ranked prompt injection first in its Top 10 for LLM Applications for two editions running, and LLM01:2025 concedes the point: it is "unclear if there are fool-proof methods of prevention". OpenAI's Instruction Hierarchy measures itself in deltas, not guarantees — 63% on system-prompt extraction, over 30% on held-out jailbreaks, and authors who concede the models remain vulnerable to strong attacks. Neither a 63% defence improvement nor a 30% jailbreak reduction converts an instruction into an enforcement boundary.
A rule the model can be talked out of is not a rule. The harness enforces; the model may only ask. A benchmark improvement is not an access control.
Should the model do the arithmetic?
The model may choose the inputs. The model must not compute the result in its head.
Frontier systems call calculators and execute code, so "models can't do maths" is stale — routing a sum to a tool is not asking a model to do arithmetic. The live failure is a figure produced inline, in prose, with no tool call. Apple's GSM-Symbolic (arXiv:2410.05229, October 2024) found accuracy declines when only the numbers in a question change, and that one irrelevant but plausible clause drops it by up to 65% across every model tested. Arithmetic error is also silent — no exception, no log line, a wrong total in the same font as a right one, found in reconciliation three weeks later.
Does any regulation tell you not to use a model?
No regulation forbids putting a model in a pipeline. Two of them make the option of not using it a design requirement.
The EU AI Act (Regulation (EU) 2024/1689) Article 14 covers high-risk systems only. Article 14(4)(d) requires that a human overseer be able to "decide, in any particular situation, not to use the high-risk AI system"; 14(4)(b) names automation bias as what oversight exists to counter. GDPR Article 22 is narrower still — decisions based solely on automated processing with legal or similar effects — and confers a right to human intervention, not a prohibition.
Anyone claiming the law bans a model from a pipeline has read neither the AI Act nor the GDPR; filtering scraped articles engages neither one. Abstention is in the drafting as a capability that must exist: not using the model is a feature you build, not a gap you have.
Where is reaching for a model genuinely correct?
Where the input space is unbounded, the rule cannot be written down, and a wrong answer is cheap to catch.
Data formats split both ways. JSON has an Internet Standard — RFC 8259, STD 90, December 2017 — with a MUST-level conformance requirement on parsers, so handing JSON to a model throws away decades of parser engineering. CSV is the inversion, and where I break my own rule: RFC 4180 is Informational and states outright that "there is no formal specification in existence". Human-typed spreadsheets, mainframe exports and OCR'd scans are where a model-assisted parse earns its cost: nothing deterministic exists to discard.
Whether a model that belongs in the system should be an agent or a process step is answered in Agent or Process?.
How do you decide before anyone builds?
Four gates, applied per step rather than per system, in the order below. One term carries the weight: the residue is the fraction of items the deterministic rules decline to decide. (I also run this as a fixed-price go/no-go, but the procedure is free — run it yourself first.)
SHOULD THIS STEP CALL A MODEL? — v1.0 (21 July 2026)
The Hopium Lab. Apply per step, not per system. Fork it.
GATE 1 — IS THE INPUT SPACE BOUNDED?
[ ] Enumerate the valid inputs, or name a schema that binds them?
Bounded -> code. Unbounded prose -> continue.
GATE 2 — IS THE RULE STABLE?
[ ] Would the correct output change if the business changed its mind?
[ ] Has the taxonomy grown in 90 days? A filling "other" bucket
counts as growth. Stable -> deterministic rules over the confident
majority, reviewed on a calendared date; the model sees only what
the rules decline. Drifting -> continue.
GATE 3 — WHAT DOES A WRONG ANSWER COST?
[ ] Money, credentials, access, or a decision about a named person?
Then the model proposes, code decides, a human signs.
[ ] Prompt-as-policy is putting a rule in the system prompt and
treating the prompt as an enforcement boundary. Enforce in the
harness.
[ ] No arithmetic in prose. Tool call, or no number.
GATE 4 — DOES A DETERMINISTIC IMPLEMENTATION EXIST?
[ ] A published grammar, an RFC, a parser, a tested regex?
Exists -> use it. Genuinely unspecified -> continue.
RESIDUE RULE
[ ] Only the residue -- the fraction of items the deterministic rules
decline to decide -- reaches a model.
[ ] Measure the residue rate weekly. A climbing rate means the rule
drifted: fix the rule, do not widen the model's remit.
BEFORE YOU SHIP
[ ] Per-run cost at ten times volume, at list price, in writing.
[ ] The wrong answer nobody would notice -- named, by a person.
Most pipelines I open have one step that needs a model and three or four that inherited one from a weekend prototype nobody revisited. Delete the model call from one step and run the tests. If nothing breaks, that step was never a decision.
Ross Jones, Founder, The Hopium Lab. Last modified 21 July 2026. Engineering commentary, not legal advice.