Reasoning in Code, Not Weights

01. Summary

Apollo-1 is a neuro-symbolic model for enterprise agents that must be trusted to act: to approve, decline, refund, book, or escalate on behalf of a company that is accountable for the outcome. This paper explains its structure through one example, a bank’s agent that approves or declines chargeback disputes for cardholders. The argument has five parts.

The problem. A language model in a loop with tools cannot be trusted with work governed by thousands of rules. Every rule is an instruction the model may or may not follow, and per-step error compounds across a multi-step task.

Why now. Task-oriented work splits into a small, invariant structure and an unbounded context. Neural reasoning can now carry context without hand-coding, so structure can finally be held in symbolic logic. Three things had to exist for this to work, and as of 2026 they do.

The inversion. In Apollo-1 the agent’s behavior is a compiled program, not a prompt. The bank declares facts, rules, actions, and outcomes; the symbolic half computes the path for each conversation; the neural half reads the customer’s message and words the decided reply. It is one computation, not two systems.

The guarantees. Four properties make it hold: unknown is never treated as false, actions are contracts with preconditions, state lives in symbols rather than in a context window, and the trace is the computation itself. Because of the last one, testing becomes proof rather than sampling.

The comparison. Tool-calling frameworks, durable execution engines, hosted runtimes, and enterprise platforms each address part of the problem. None moves decision authority out of the neural side. That is the difference.

This paper stays above implementation detail. It explains what the runtime does and why, not how it achieves it.

Terms used throughout. Apollo-1 is the model and its runtime, identical for every customer. An agent program is the set of typed declaration files a company writes. An agent is the two together, deployed on a desk. Where this paper says the program decides, it means logic the company declared, executing inside Apollo-1.

02. The Job

A cardholder writes to their bank’s agent:

This is a chargeback dispute, and it is the kind of work banks are most reluctant to hand to an agent. To handle it correctly the agent has to identify the cardholder and the exact transaction, work out what kind of dispute this is, and then decide: approve the chargeback and credit the customer, decline it with a reason, or refer it to a human analyst. Every one of those steps is governed.

Thousands of rules. Card-network rules map each dispute to a reason code with its own evidence requirements and time limits. The bank’s own policy adds thresholds, exclusions, and exceptions on top.

Geography. The cardholder’s region sets the regulatory regime: how many days they have to dispute, whether a provisional credit is owed and by when, what the bank must tell them. The merchant’s country and the card’s currency add conversion and cross-border rules.

Card data. Was the card present? Was the transaction authenticated? Is the card reported lost or stolen? Has it been used since?

Customer history. How many disputes has this customer raised? Were earlier ones upheld? Is there a pattern that requires a fraud referral rather than an automatic credit?

Consequences. Approving means money moves and a case opens with the network. Declining means telling a customer no, with a reason that will be reviewed if they complain. Referring means an analyst’s time. All three must be defensible after the fact.

The bank’s requirement is not fluency. It is that every one of these facts is established from the system that owns it, every rule is applied exactly as written, the decision is one the bank’s policy actually permits, and the whole chain from facts to outcome can be shown to an auditor, a regulator, or the customer. That is the standard the rest of this paper is measured against.

03. Why the Usual Way Breaks

The dominant way to build an agent in 2026 is a language model in a loop with tools. The system prompt carries the rules: “always verify the cardholder before discussing a transaction,” “never issue a provisional credit above the threshold without referral,” “refer any customer with more than two disputes this year.” The model reads the message, decides which tools to call, composes the arguments, reads the results, and decides what to say. Every one of those steps is a fresh model decision.

For a dispute desk this design fails in a characteristic way. The rule was declared by the author and promised by the specification, but nothing in the system enforces it. With thousands of rules the prompt cannot even hold them, so the model is given a subset, or a retrieval step, or a summary, and the rule that mattered for this case is the one that was not in context.

• It credits a transaction outside the dispute window because it never checked the posting date.
• It matches the wrong transaction because two hotel charges looked alike.
• It skips the referral because the customer sounded credible.
• It issues the credit twice on a retry.
• Afterwards the only record is a transcript of prompts and completions, from which a second model can guess at why the first one acted.

Controls around the model do not change what decides

The usual response is to add layers: guardrails, an orchestration graph, a state machine, a judge model, an evaluation suite. These help, and every serious agent kit ships them. But they live inside a tradeoff that does not go away. More freedom for the model gives fluent, adaptable conversations that are hard to assure. More predefined control gives tighter execution with more branches, brittle exceptions, and maintenance. Each layer is itself probabilistic, so the system gains layers without gaining guarantees, and the per-step error compounds across the ten or fifteen steps a dispute takes.

Fig. 1. LLM-first. The model proposes; controls accept, reject, or retry.

Fig. 2. Apollo-1. The program governs; neural understanding provides context.

Apollo-1 starts from a different question: what if the rules were not instructions to a model, but logic that runs whether or not anything remembers them? Neural reasoning carries the language. Symbolic logic carries the decisions. In one computation.

04. Why Now

Neuro-symbolic systems are an old idea. What changed is that the two halves of task-oriented work can now be separated cleanly, and each handed to the half of the model built for it.

Every dispute conversation contains two different things. The first is structure: a dispute is a record with states, crediting is an action with preconditions, a referral must precede any decision above a threshold, a rule either holds or does not, an open question stays open until it is answered. Structure is small, finite, and the same across industries. A chargeback, an insurance claim, and a product return are all records with states, gated actions, and outcomes. The second is context: what the cardholder actually says, which of three hotel charges “the one in Lisbon” refers to, what a network reason code means, how a decline should be worded. Context is unbounded and different everywhere.

Earlier symbolic systems failed because they had to encode both. The structure they got right was buried under rules for context that never finished. Language-model agents have the mirror-image problem. They carry context effortlessly, but must infer the structure on every step from a prompt and a transcript, and structure is exactly what they get wrong: the precondition forgotten, the state not checked, the action repeated.

What structure means

The difference shows up in a single rule. Written over content, the bank’s referral policy reads: if the message mentions a hotel abroad and the amount is over four hundred, refer. That rule breaks on a new phrasing, a different currency, another language, or a merchant category nobody listed. Written over structure, the same policy reads: an action that moves money requires an authority whose approval is recorded, when the amount exceeds the limit for the claimant’s risk class. There is not a word of any industry in it. It holds for a Portuguese cardholder and an English one, for a hotel and an airline, for a card and an invoice.

Structure is made of a few kinds of thing: entities, the roles they play, the relations between them, the state that constrains what is legal next, and the provenance of every fact. Logic written over those is graph work rather than text matching, which is why it does not care what the conversation was about.

Isomorphism. Two tasks that share no vocabulary can share a structure. A chargeback dispute, an insurance claim, and a training reimbursement are the same graph with different labels: a claimant in a role, a claim against a counterparty, an amount subject to limits, evidence with a provenance, an authority whose approval must be recorded, and a state that constrains the next legal move. Logic written over that graph runs on all three. Logic written over the words runs on none of the others. That is the reason one frozen model can serve a dispute desk, a claims desk, and an HR desk.

Provenance is structure. Where a fact came from is part of the shape of the work, not a note attached to it. “The customer says the card was not present” and “the card system reports the card was not present” carry identical content and are not the same fact. A system reasoning over content flattens them into one string. A system reasoning over structure keeps the role of whoever asserted the thing, so a rule can gate on the second and never on the first. Much of what makes an agent safe to trust with money is that distinction, applied without exception.

How many such structures there are, which ones proved invariant across millions of real task dialogues, and the language that expresses them, is what nine years of that work produced. It is also the part this paper does not enumerate.

Fig. 3. Language becomes program facts; decided outcomes become words. Neural context and symbolic structure share one runtime.

In every diagram, orange marks symbolic work: establishing facts, applying rules, governing actions. Yellow marks neural work: interpreting language and expressing replies. One model, one computation.

Stop forcing meaning into the symbols

Three things had to be true for that to work, and as of 2026 all three are.

A symbolic language for the structure had to exist. AUI spent nine years on task-oriented conversation, across millions of dialogues and tens of thousands of human agents, and found that the structure of the work is shared: a small language of facts, tasks, permissions, and outcomes that describes a dispute desk as well as a returns desk. That language is what an Apollo-1 program is written in, and it is why the runtime is domain-agnostic.

Neural reasoning had to solve understanding. Intent, ambiguity, and reference can now be read across domains and languages without being told how. Meaning can stay neural instead of being encoded by hand, which is the part that sank every earlier symbolic attempt.

Coding agents had to unlock authoring. A symbolic language nobody can write is a research artifact. Coding agents can now write, test, and revise executable agent programs, so a bank’s team can author behavior without learning the language themselves. That is what the builder, described in section 09, is for.

In Apollo-1 the split is literal, inside one model. The symbolic half holds structure and nothing else: the fixed turn pipeline, rule evaluation, state machines, the ledger of what the conversation owes, the sealed record. It carries no phrase lists, no domain patterns, no meaning. The program supplies context in the symbolic language: the vocabulary of facts and what they mean, where they come from, the authored wording of questions and refusals. The neural half translates between the two. The seam is each fact’s declared origin, and moving a fact across it moves work from one half to the other without touching the logic on either side.

This is why one frozen model runs a dispute desk, a claims desk, and an HR desk without retraining, why changing an agent means editing a program rather than a model, and why the structure, once separated, can be validated, measured, and certified in ways context never could.

05. The Inversion

In Apollo-1, the bank does not write a prompt. It writes a program: a folder of typed declaration files that describe the dispute desk. There is no goal prompt, no orchestration, and no conversation flow. Conceptually, the files say the following.

What the agent may know. Facts such as the cardholder’s identity; the transaction’s merchant, amount, date, and country; whether the card was present and authenticated; the customer’s dispute count for the year; the reason code the dispute maps to. Each fact declares where it may come from: the channel at the start of the session, the conversation, a bank system, or a calculation from other facts.

Where thousands of rules live. Facts computed from other facts hold the bank’s decision tables: the reason code from the dispute type and card data, the dispute window from the cardholder’s region, the provisional-credit deadline from the regulatory regime, the referral threshold from amount and history. These are ordered, first-match tables the runtime evaluates, not prose.

What the agent acts on. Records such as transaction and dispute case, each with fields, an identity, and a declared state machine. A case is opened, credited, referred, resolved, or declined, and only certain moves between those states are legal.

Where facts come from. The card system, the transaction ledger, the customer profile, and the case management system, each declaring what it can read and what it can change.

What the agent can do. Capabilities such as open dispute, issue provisional credit, refer to analyst, and decline dispute. Each declares the facts it needs, what it changes, whether it requires a read-back confirmation before firing, and which outcomes it can report.

What must hold. Policies: crediting requires a verified cardholder, a transaction inside the dispute window, and an amount below the referral threshold or a referral already made; discussing a transaction forbids an unverified session. Each policy carries its refusal wording and, where possible, the fact the customer could supply to clear it.

Fig. 4. The bank declares the pieces; the compiler checks their relationships. Conversation paths are computed from the program.

A compiler checks it before anyone talks to it

A compiler reads the files, refuses anything malformed by name, builds a graph of which facts depend on which, and checks it statically: every needed fact has a producer, every policy reads only facts that can be established, every irreversible write has a confirmation, every decision table is complete. The result is stamped with a fingerprint that changes on any edit.

The neural half is asked exactly two questions

First: what did the cardholder say, in the program’s vocabulary. Which facts were mentioned, which capability is being asked for, in what manner. Second: given a decided outcome, how should it be worded. It is never asked what to do, whether a rule holds, whether to call a system, or whether an answer is true.

The seam is a per-fact choice

The most consequential line in the program is each fact’s declared origin. A fact from the conversation is the neural half’s to extract. A fact from a bank system is the symbolic half’s to fetch. A rule may only gate on facts the program has actually established, so a policy that gates on something the customer merely claimed is a build error, not a risk. Moving a fact across that line moves work between the two halves without changing any logic on either side.

The practical consequence is that the same model, with no retraining and no industry-specific code, runs the dispute desk and any other governed desk. The symbolic half carries structure. Meaning lives in the program, so the model is also language-agnostic: a Portuguese cardholder and an English one are read into the same facts.

06. One Dispute, One Turn

Every customer message passes through the same fixed sequence of six stages, in one computation. Here is the Lisbon hotel message walking through them.

Fig. 5. Read → Establish → Check → Act → Reply → Seal. Neural work interprets the message and phrases the reply; the compiled program governs the turn.

Read

The message becomes program vocabulary: one ask, open dispute, with a merchant, an amount, a currency, and a reason of the kind “I did not make this.” The read is bounded by what the program declares, so a fact the vocabulary does not name cannot be bound. A value the customer denied never binds as true. Where the reading points at a specific record, such as which of several hotel charges is meant, the symbolic half requires evidence it can verify against the record rather than accepting the reading on its own.

Establish

The facts the capability needs are gathered by the establishment ladder, a fixed order: already known, computable from other facts, readable from a bank system, or genuinely the customer’s to supply. The cardholder is already verified from the channel. The ledger returns the posting date, the merchant country, and whether the card was present. The card system reports the transaction was not authenticated. The customer profile reports one prior dispute this year. The reason code, the dispute window for this cardholder’s region, and the referral threshold are computed through the bank’s decision tables. Nothing is asked of the customer that a system already knows, and nothing is invented to move on. If the transaction could not be found, the authored “I cannot locate that charge” reply ships, not a guess.

Fig. 6. Use known state, compute the fact, read its owning system, then ask the customer if it is theirs to supply. If it cannot be established, report the blocker.

Check

Every applicable policy is evaluated against the established facts. The transaction is within the dispute window. The amount is above the referral threshold for a not-present, unauthenticated transaction with prior dispute history, so the policy that allows automatic credit refuses, names its reason, and the program’s authored path is a referral. The verdict, the facts it read, and the direction of the rule are written to the record.

Act

A read-back of the exact proposal is composed: open a dispute case for this transaction and refer it to an analyst. The facts the proposal rests on are frozen, and the turn waits for the customer’s yes. A yes given after those facts moved is not consent; the proposal is re-posed. On consent the case opens in the case system exactly once, keyed so a retry cannot open it twice, and the dispute record moves to referred only because that transition is legal from opened. Had the amount been below the threshold, the same stage would have issued the provisional credit and moved the record to credited.

Reply

The outcomes to voice are selected: the case is open, it has been referred, and what the customer should expect. Only established facts are ever voiced. The neural half turns the decided outcomes into natural wording. Before the words ship, a mechanical check compares the draft with the record. Does it state a fact that was never established? Does it promise a credit that was not issued? Does it contradict an earlier answer? A failing check falls back to the author’s own wording or drives one correction. The check decides.

Seal

The turn writes its full record: what was understood and learned, which systems were read and what they returned, every rule verdict, what ran and what was written, which record transitions applied, which outcome fired, and what the reply rested on. Card numbers and other sensitive values are masked. Every turn seals, including turns that crash after a write, so a side effect that happened is never denied.

Two later moments

If the cardholder pushes back, “I’m telling you I was never in Lisbon, just refund it,” the checks are not re-run and presented as a new decision. The runtime asks whether the answer would differ. It would not, so the agent stands by the referral once, with the facts it rests on, and on a further push says plainly that the decision is with an analyst.

And if the cardholder changes the request mid-conversation, “actually, the other Lisbon charge is wrong too,” nothing in the program anticipated that sequence. The new ask routes to the same capability, establishes what it needs for the second transaction, and applies the same rules. The request changed; the fact sources and permissions stayed explicit. No author drew a branch for it.

07. Four Properties

The walk-through works because of four properties built into the symbolic half. Each closes a class of failure rather than an instance of one.

1. Unknown is not false

All logic is three-valued: true, false, and unknown. A fact nobody looked up is different from a fact that was looked up and found empty. A rule that requires a fact holds only when the fact is proven true, so unknown refuses. A rule that forbids a fact refuses only when the fact is proven true, so unknown allows. The two directions deliberately fail opposite ways, because getting either wrong would silently invert the bank’s intent.

The unknown column is the whole point. If the ledger had been unreachable, the posting date would be unknown, the in-window requirement would refuse, and the agent would say it cannot confirm rather than credit. Most production agent bugs are a missing value treated as a known one. This property removes them at the root.

2. Actions are contracts, not tool calls

There is no such thing as a neurally invoked tool. Every bank system sits behind one source layer, which is the one place authentication is enforced, reads and writes are recorded, and “never looked” is kept distinct from “looked and found nothing.” A capability declares what it needs, what it changes, and whether it must be confirmed, and it will not fire until every needed fact is established and every applicable rule holds.

• Writes are keyed, so a retry is “already done,” and what a write returns is recorded on the case as a receipt.
• Record state machines are checked on every transition.
• Escalation to an analyst is a declared outcome that can freeze further writes, so no money moves after a referral.
• Attachments such as a receipt photo enter through the same door, becoming words at the platform boundary; the symbolic half never sees bytes.

Fig. 7. Only declared moves are legal. Referred cases can later be credited or declined; declined and resolved are terminal.

3. State lives in symbols, not in a context window

Nothing is remembered neurally and nothing is summarized. The session between turns is a set of typed structures, each documented with what it holds and when it expires. Three kinds of state are kept apart by construction: record state, which persists and constrains what is legal; standing conditions such as “a referral is pending,” which are recomputed every turn from facts and can never go stale; and conversational moves, such as standing by an answer, which are not state at all.

Obligations are ledgered: for every ask, whether it is open, answered, refused, or expired, accounted for even when the turn crashed. Offers and pending confirmations expire, so a “yes” several turns later is not consent. The neural half receives a focused context, never the transcript, which is why lightweight language models suffice for the neural work and cost does not grow with conversation length.

A long conversation does not change that. What the neural half receives is assembled for each turn from what that turn needs: the facts in play, the questions still open, and the wording available to it. That set follows the task, not the number of messages behind it, so the hundredth turn costs about what the third one did. Symbolic state does accumulate as more records are touched, but it is typed and addressed, and only the slice a turn actually reads is ever put into language.

4. The trace is the computation

The record a turn seals is not a log written beside the decision. It is the decision, in the program’s vocabulary: every fact learned and where from, every rule verdict with its direction, every read, write, refusal, transition, and outcome. The runtime cannot decide one thing and trace another.

For a bank this is the difference between “the agent usually follows policy” and “here is the rule, the facts it read, and the verdict, for this customer, on this day.” An explanation is a read of the trace, not a second model’s guess. The next section shows what else that makes possible.

08. From Trace to Proof

Most agent testing is statistical: run many conversations, have a judge model score them, report a pass rate. Apollo-1’s testing is closer to a test suite, and the reason is the trace. Because every decision is recorded in the program’s own vocabulary, a test can check what the agent did rather than guess from what it said.

Fig. 8. Validation and scenario replay need no neural work. Live tests produce traces for symbolic checks and neural review, with evidence tied to a program version.

Scripted scenarios replay symbolically. Every neural read has a deterministic stand-in, so the entire pipeline runs offline. A program carries a suite of scripted turns with expectations. They replay and are graded by the same mechanical check that grades live replies. This is free, so it runs on every validation. In production the same property means a language-model outage degrades quality, never safety, because nothing downstream of a fact depends on neural work.

Regression cases are declarations about the trace. A case says what a whole conversation must show and must not show, naming the program’s own ids: the ledger was read, the automatic-credit policy refused, a referral confirmation was posed and confirmed, the case reached referred, no credit was written. A symbolic judge answers each declaration yes or no from the trace. No model, no prose, no reading of the reply. A separate neural judge grades the same conversation against the plain-language need it was meant to serve. The final verdict is green only when both pass, and a trace violation fails the case even with the neural judge switched off. For the bank, the case for “high-value unauthenticated dispute with history” declares that a referral happened and no credit did. If a future rule edit lets the credit through, the case turns red on the trace, not on a judge’s opinion.

Evaluations drive real conversations. A simulated cardholder, drawn from a declared world of identities, personas, and complications, holds a full conversation with the deployed program through the ordinary turn path. Each scenario runs several trials. Because the customer is simulated, its phrasings are never counted as verbatim customer language, and the two lanes are kept separate.

Coverage has a denominator. Because the program is compiled, its declared behavior is finite: every outcome, rule, transition, question, and escalation is a branch that can be enumerated. Offline instruments map each case to the branch it exercises. After any edit, the runtime computes the blast radius: everything that edit could affect, and what must be re-proved before it ships. A prompt has no blast radius, because nothing about it is enumerable. Coverage of what the program declares and completeness against what customers actually ask for are reported separately, so full coverage with unmet demand shows as the signal it is.

Evidence is tied to the version. Evidence gathered against one fingerprint is refused as proof for another. Publishing a version is a human act, and rolling back is publishing an earlier one. The lifecycle refuses to pass any rung it cannot measure.

The loop closes. A field finding arrives as trace evidence: which rule refused, which fact stayed unknown, which question went unanswered. It becomes a regression case. The program is repaired against it, validated, and re-proved on the branches the edit touched. Nothing is retrained. That repair is the builder’s job.

09. The Builder

A dispute desk’s rules change constantly: a network updates a reason code’s evidence requirements, a regulator shortens a deadline, the bank raises a referral threshold for one region. In a prompt-based agent each change is a prompt edit followed by a statistical re-evaluation. In Apollo-1 it is a program edit, and the builder is what makes that edit fast without making it unsafe.

The builder is an authoring agent whose only workspace is the agent program. It reads the authoring guides, edits the declaration files, runs validation, and can pause for a human’s approval. It is the third enabler from section 04 made concrete: a symbolic language is only useful if a bank’s team can author in it without learning it, and a coding agent under gates is how that happens.

Fig. 9. The coding agent proposes; the compiler validates. Findings return to the repair loop. A validated diff reaches a person for review and publication.

It is governed by one rule: the agent may propose changes, but only deterministic validation and a human may declare the program valid and shippable. Three consequences follow.

• Every edit is judged. Each edit returns the compiler’s verdict for the whole program, so the agent cannot pile up unvalidated changes and discover the damage later.
• Completion is granted, not claimed. A builder turn ends as complete only after a full validation passes. Findings go back as repair feedback within a bounded budget.
• There is no publish tool. The strongest thing a turn can produce is a validated diff. Landing it is a human act.

A general coding agent holds its own feedback signal, decides its own completion, and can publish. The builder shares its loop mechanics and deliberately holds none of those. Who holds authority inside the loop is the difference.

10. How It Compares

Enterprise agents in September 2026 are built in roughly four ways, and they differ most on one question: who answers “what happens next?”

What the field reports going wrong

The picture is consistent across academic surveys, vendor post-mortems, and analysts, and each finding maps onto something in the earlier sections.

Errors compound. A July 2026 synthesis of 19 benchmarks finds that failures “compound nonlinearly with task length” and that “additional scaffolding does not consistently improve reliability” (Beyond the Leaderboard). An ICML 2026 paper proposing twelve reliability metrics finds that “recent capability gains have only yielded small improvements in reliability” (Towards a Science of AI Agent Reliability). This is the case for decisions that do not go through the neural half.

Guardrails bypass. When the reasoning system is compromised, “prompt-level guardrails provide zero protection because they exist only within the compromised system” (Parallax). The OWASP Top 10 for Agentic Applications opens with goal hijack, tool misuse, and privilege abuse (summary by NeuralTrust). This is the case for gates with no path around them.

Unpredictable selection. Microsoft’s documentation for generative orchestration states that overlapping topic descriptions make selection “unpredictable” and that “changing the model can change the result” (Copilot Studio). This is the case for routing that is computed and stamped.

Unreliable judges. Agent success rates vary by up to nine percentage points depending on which model plays the user (Lost in Simulation). This is the case for a symbolic judge over the trace.

Governance after incidents. Gartner predicts that by 2027 governance gaps discovered only after production incidents will lead 40% of enterprises to demote or decommission autonomous agents (via CIO). Practitioners describe 2026 as a “rebuild era” in which first-generation agents must be redesigned around orchestration, observability, governance, and recovery (VentureBeat). This is the case for a trace that is the computation.

Logging obligations. The EU’s Digital Omnibus on AI defers the AI Act’s high-risk obligations to December 2027, pending formal publication (Gibson Dunn). When they apply, they require automatic logging over the lifetime of the system, and practitioners argue an agent’s logs must cover every decision point and be tamper-evident (Help Net Security). A bank’s dispute desk is exactly the kind of system those obligations are written for.

The industry is moving this way

Decagon’s procedures combine natural language with “key validation steps in code” (Decagon). A Google customer describes the new agent platform as “combining deterministic business rules with probabilistic reasoning” (Google Cloud). Microsoft’s framework guidance opens with “if you can write a function to handle the task, do that instead of using an AI agent” (Microsoft). Rasa predicted in December 2025 that using language models for understanding and predefined flows for decisions “will become the industry’s de facto best practice” (Rasa). The separation Apollo-1 started from is becoming mainstream. The differences are in how far it goes.

Where the nearest approaches stop

Compiled procedures. Decagon keeps natural language as the source of truth and adds code-executed validation steps. In Apollo-1 the typed program is the source of truth, and there is no prose to interpret.

Supervisory validators. Sierra’s supervisory agents and the Parallax proposal put an independent validator between reasoning and action. In Apollo-1 the validator is not another model, and it does not wrap the decision. It makes it.

Drawn flows. Platforms that route a language model’s reading into predefined flows still require the author to map every path by hand, and real deployments accumulate hundreds of branches. Apollo-1 declares logic pieces and computes the path per conversation.

Durable execution. Temporal, Vercel Workflows, and Inngest guarantee a loop resumes after a crash without repeating side effects. Apollo-1 has the same properties at the turn level and, in addition, removes the decision from the step.

Hosted runtimes. Managed runtimes give an agent identity, isolation, and observability. They are complementary infrastructure. Apollo-1 already runs as a service and as a customer-deployed model, but who decides is settled inside the program, not by the host.

11. What It Buys and Gives Up

Return to the cardholder and the Lisbon hotel. The rule that sends a high-value, unauthenticated dispute with prior history to an analyst ran whether or not anything remembered it. The referral named its reason. No credit moved, and the record shows that no credit moved. If the bank changes that threshold next week, the change is a program edit whose effects are computed and re-proved, not a retraining and not a hope. Those are the guarantees, and they generalize.

• A declared rule is always enforced, because the check is symbolic.
• Every decision can be explained from the record, because the record is the decision.
• Behavior changes on a business cadence, as validated program edits with a computed blast radius.
• Cost follows the work, not the conversation, because decisions run symbolically on CPUs, many turns need no neural work, and the rest carries focused context.
• The same program behaves the same everywhere, because swapping the underlying language model changes phrasing, not policy.

AUI reports the following from deployment comparisons. Results depend on task, model, and integration scope, and inference cost is not total cost.

The trade is generality

Apollo-1 is not a general-purpose agent, and it does not try to be. Open-ended creative work, code generation, and low-stakes, high-variation tasks are better served by a language model in a loop. Perception stays probabilistic: the neural reading of a message can be wrong, and what is guaranteed is that once facts are established, the logic over them is fixed, so a reading error surfaces as a task failure rather than a policy violation. Nothing grades itself: neural review advises, the mechanical check decides. And nothing is certified that cannot be proven: a static check predicts the absence of a class of bug, never correctness, and proof comes only from driven evidence.

Moving control out of the model has costs of its own. A rule that was never declared is a rule that is never enforced. The runtime guarantees that declared behavior holds, not that the program is complete, and completeness is the bank’s responsibility rather than the model’s. Authoring work does not disappear either. It moves from writing prompts to writing a program, which is more reviewable but not less work, and section 09 exists because of it. A situation nobody declared produces a refusal rather than a judgment call, which for a dispute desk is the right failure and is still a real limit: the system is deliberately less willing to improvise than a language model in a loop, and it will say so rather than guess.

For work shaped by policy, money, and accountability, that trade has proven to be the right one. Language stays neural. Truth stays symbolic.

12. Sources

Each source below was opened on 22 September 2026 and checked against the claim it supports.

Apollo-1’s public documentation, which already discloses the programming model, the authoring lifecycle, and the trace schema this paper builds on: Introduction, Agent program, Vocabulary, Capabilities and policies, Derivations, CLI workflows, Traces.

Frameworks and runtimes: LangGraph persistence, Google ADK 2.0, Microsoft Agent Framework overview, Claude Managed Agents, Gemini Enterprise Agent Platform, AWS AgentCore release notes, Temporal and the OpenAI Agents SDK, Vercel Workflows, Inngest on durable execution.

Platforms: Salesforce Atlas Reasoning Engine, Copilot Studio generative orchestration, ServiceNow AI Control Tower, Sierra on enterprise-grade agents, Decagon on Agent Operating Procedures, Rasa 2026 predictions.

Research, security, analysts, and regulation: Parallax, Towards a Science of AI Agent Reliability, Lost in Simulation, Beyond the Leaderboard, OWASP Top 10 for Agentic Applications, summarized by NeuralTrust, Gartner on agent governance, via CIO, VentureBeat on the rebuild era, Gibson Dunn on the EU Digital Omnibus on AI, Help Net Security on AI Act logging.

Gartner’s own press pages were unreachable at the time of writing, so its projection is cited through CIO’s coverage. The deployment comparison figures are AUI’s own reported numbers.