Routing to the cheapest model that might work is easy. Routing without leaking sensitive context, changing models halfway through a tool loop, or granting a weaker backend authority it should not have is a different problem.

I kept the hard decisions deterministic. Privacy rules, backend health, measured capability, tool authority, and session affinity take precedence over the learned classifier. A small local embedding model only advises on ambiguous requests; it cannot override those boundaries.

What the evidence says

In one clean five-repeat experiment, the aggressive policy sent 81.15% of requests to local inference, up from a 22.82% conservative baseline. It also completed 10 of 10 authorized write/execute tasks without transport failures or unexpected side effects.

That did not settle the larger question. Quality remained inconclusive, and the latency and remote-token gates failed. The result supports the routing architecture and its authority model, not a claim that local-first routing is automatically faster, cheaper, or production-ready.

Read the evidence

• Experiment log
• Aggressive-local policy and tool authority
• Five-repeat execution result