Variability in LLM outputs is real, but mostly an engineering choice. Floating-point non-associativity and dynamic batching usually cause it. When the same input must produce the same output, you can force it at the kernel, scheduler, or architecture level. The rest of the system can stay flexible.
Make the completion deterministic
Batch-invariant kernels. Thinking Machines Labs pinned reduction order in the kernels that change with batch size. On a large Qwen at temperature zero, 1,000 identical prompts became one identical completion. vLLM and SGLang adopted similar modes. Early versions cost roughly 1.6–2× throughput; later work narrows the penalty by fixing only the selection points that matter.
Verify-and-rollback. Microsoft’s LLM-42 keeps the fast dynamic path, then periodically rechecks a window under a fixed shape. Matches commit; mismatches roll back. You only pay the overhead on requests you mark deterministic. It reuses existing kernels and is open.
Integer arithmetic. Integer addition is associative, so order stops mattering. One pipeline runs a small Qwen end-to-end in integers and produces identical logits across GPUs, CPUs, and vendors. Scale is still limited, but the principle is clear: determinism can live in the arithmetic instead of in carefully tuned kernels.
Pros: reproducible completions for eval, RL, and audit.
Cons: some throughput cost, and the agent loop can still diverge even if the tokens do not.
Bound the agent’s role
Blueprint-first. Encode the workflow as ordinary code. A deterministic engine runs it; the model only handles bounded sub-tasks with clear contracts. It never chooses the path. On TravelPlanner, this cut constraint violations sharply while raising the pass rate.
Hybrid pipelines. Keep every state change and decision in a symbolic or rule engine. The model explains the result or proposes candidates an external checker must accept. One evaluation produced identical traces across 100 runs; pure LLM pipelines did not.
Typed skill files. aigenos/flow lets the model only fill typed fields. The skill file decides the next step, the gates, and which tool runs with which arguments. A payment cannot fire before confirmation because the file refuses to load otherwise. Measured against prompt-driven ReAct, it used fewer calls and followed one route.
Pros: side effects stay in ordinary code you can test and version.
Cons: more design work up front; less flexible when the task has no fixed shape.
Bound agency at runtime
Even a deterministic model can still do too much. Put hard limits outside it: tool allow-lists, step and spend budgets, max iterations, circuit breakers on repeated calls, and approval gates for irreversible actions.
The Agentic Principal Chain tracks authority across delegation hops and checks each request against session history, so two allowed actions that together equal exfiltration get blocked. Published results dropped exfiltration to zero. The code is public.
Commercial platforms sell the same idea as configuration: autonomy levels, registry-granted tools, caps, named approvers, kill switches, on-prem deployment. The principles are sound. Enforcement has to live outside the model. Bounds should tighten after incidents. Full autonomy is rarely the right target for work that changes state.
Pros: stops runaway cost, loops, and many injection failures even when the model is wrong.
Cons: too tight and usefulness drops; too loose and the perimeter is theater. You still have to prove the limits hold under attack.
Marketing claims
Vendors correctly point out that “always ask before deleting” in a prompt is not a real control. They correctly prefer hard limits over filters the model can talk its way around. They correctly note that the same agent can run tightly or loosely depending on the task.
The slide into “the system governs itself inside your rules” is the part that needs evidence. Self-evolving routers that learn inside hard gates still require proof that the gates cannot be bypassed, that allowed actions cannot compose into forbidden ones, and that the audit log shows the real path.
Open research with published attack suites is easier to check than closed platforms. No platform makes the operator compliant. The obligations stay with the people who deploy it. Independent testing of the bounds matters more than the configuration screen.
Resume
Pay for determinism where you need the same tokens every time. Pay for architecture where the agent must act: keep the workflow, the gates, and the state changes in code you can inspect, and let the model only propose or explain.
Add runtime budgets and composition checks so a misbehaving model cannot leave the perimeter you set. Prefer approaches whose code and evaluations you can examine. Draw the line where variation is acceptable and where it is not. The agent is only as reliable as the bounds that live outside the model.