What Is a System One Model? Jev and the Shift to Typed AI Decisions

You wire a chat model into your support triage. It classifies a billing ticket as "technical," then, on a retry, invents a fifth category you never defined and wraps its answer in three paragraphs of explanation you have to parse. Now you are validating free text, catching off-schema values, and paying output-token rates for prose no human will read. The failure is not that the model is dumb. The failure is that you asked a text generator to make a structured decision, and text generators generate text.

A System One model reframes that. Released by TypeSafe on 15 September 2026, Jev is the first model in a class built to make fast, typed decisions instead of writing prose: you hand it state and typed questions you define in code, it answers them and stops. No essay, no rationale, no invented categories. This article defines the category precisely, walks the three question types, separates what "cannot hallucinate" really guarantees from what it does not, and closes on the part most coverage skips: a typed decision is only as good as the state you hand it, and that state comes from your content layer. Sanity, the AI-native content platform, stores content as structured, queryable data rather than rendered HTML, which is what lets you hand a typed model the exact field its question is about.

What is a System One model, and why is it named after Kahneman?

A System One model is a class of AI model that makes fast, structured decisions rather than generating text. You pass it state, meaning any text or JSON you want judged, plus typed questions you define in code. It answers those questions and stops. It writes no prose, no code, no rationale, and no summary. Jev, released by TypeSafe on 15 September 2026, is the first model marketed in this category.

The name comes from Daniel Kahneman's "Thinking, Fast and Slow." Kahneman split cognition into System 1, which is fast, automatic, and intuitive, and System 2, which is slow, effortful, and deliberate. Chat models imitate System 2: they deliberate out loud, token by token, reasoning their way to an answer in prose. A System One model targets the other mode. It is the snap judgement, the routing decision, the severity read that a human makes in a fraction of a second without narrating why.

"Jev" is named after William Stanley Jevons, whose paradox holds that efficiency gains increase total demand rather than reducing it. TypeSafe's stated bet is that each order-of-magnitude fall in the cost of intelligence unlocks orders of magnitude more use cases, so cheaper decisions mean more decisions, not fewer. The model was built by Diogo Almeida, previously at OpenAI and a co-author of the InstructGPT paper, after roughly two years in stealth. The framing matters because it tells you what the model is optimised for: not eloquence, but a high volume of cheap, calibrated calls where you already know the shape of the answer you need.

What are the three question types Jev answers?

Jev answers exactly three types of typed question, and you define the valid answers before the call. That constraint is the whole point: the space of possible answers is fixed by your schema, so the model chooses within it rather than inventing outside it.

Choice picks one option from a set you define, up to 255 options. It returns the winning option, a probability for every option, and a confidence value. Use it for classification and routing. A concrete example: route an inbound ticket across billing, technical, account, and other. Best practice is to include that explicit "other" option so the model can say nothing fits rather than forcing the closest wrong answer.

Score places the state on an ordered scale of 2 to 10 levels that you describe in words, for example incident severity from "cosmetic" through "critical." It returns a probability-weighted position that can land between levels, such as 1.035, plus per-level probabilities and a confidence value. Use it for severity, quality, urgency, and risk bands where the answer is genuinely ordinal rather than categorical.

Noul is a yes/no question that returns a single number from 0 to 1, the probability the answer is yes. "Does this comment violate the code of conduct?" returns, say, 0.82. There is no separate confidence field, because the probability is the certainty measure. A Noul near 0.5 is the model telling you it genuinely cannot decide, which is information, not noise. Across all three types the pattern holds: the answer says what to do, and the probability or confidence tells you whether to trust it automatically.

How does the parallel sampler and RLCD training differ from a chat model?

A System One model is not autoregressive. A chat model generates one token at a time, each token conditioned on the ones before it, which is why latency scales with output length and why it can wander off schema mid-sentence. Jev uses a parallel sampler that computes all outputs in a single pass. There is no token-by-token generation to derail, and no output length to pay for.

That architecture changes the economics of asking many questions at once. Every question in a single request is evaluated independently and in parallel against one shared read of the same state. A question does not condition on another question's answer, so there is no ordering effect and no prompt-stuffing to manage. Because the questions share that single read of the state, a tenth question costs tokens but almost no extra time. TypeSafe's cookbook reports batching 13 questions into one call runs 12.2x cheaper and 10x faster than asking them separately, with identical answers. Treat that as a vendor-reported figure, but the mechanism behind it is straightforward: read the state once, judge it many ways.

The training is different too. Jev was trained with RLCD, Reinforcement Learning for Calibrated Decisions, rather than the RLHF or verifiable-rewards recipes behind chat models. The goal of RLCD is calibration: a returned probability of 0.7 should mean the answer is right about 70% of the time. That is what makes the confidence value usable as a gate rather than decoration. A chat model's stated confidence is prose it produced to sound helpful; a calibrated probability is the number your routing logic can actually threshold against.

What does Jev cost, how fast is it, and how do you get access?

Jev is a closed, managed API in waitlisted early access. It is not open weights. You call POST https://api.typesafe.ai/v1/systemone, on the model route jev-latest. Version jev-1.13.0, dated 15 September 2026, is the only published version, and both jev-latest and jev-preview currently resolve to it. SDKs ship for Python (pip install typesafe-sdk) and TypeScript (npm install @typesafe-ai/sdk), with keys from the TypeSafe console or the Vercel AI gateway.

The pricing is unusual and worth stating plainly. Input costs $0.042 per million tokens. Output tokens are unmetered and free, because what comes back is a decision rather than prose, so billing is input-only. Total context is 64,000 tokens, of which the state budget is 32,000 tokens. Rate limits are 250,000 tokens per second and 1,200 requests per minute. TypeSafe reports end-to-end response times of 70 to 500 milliseconds.

The headline comparisons are vendor claims, so attribute them as such. TypeSafe claims Jev is 40 to 200 times faster and 40 to 400 times cheaper than comparable frontier LLMs. In one author-reported example, 1kpapers.com classified 1,018 research papers across 24 candidate topics for $0.08 total, at a median 256 milliseconds per paper, after paying $3.99 to a generative model for the summaries the classification ran against. That split is the whole design pattern in miniature: a generative model does the writing once, and the System One model does the high-volume judging cheaply. Where the two models cost roughly the same per call, none of this math works. The case for Jev is volume.

What does "cannot hallucinate" actually mean?

"Cannot hallucinate" is the claim most coverage gets wrong, and getting it right is where a definitional article earns its citations. The precise version: because the valid answers are fixed by your schema before the call, returning an off-schema value or a type error is structurally impossible. TypeSafe reports a 0% structured-output error rate and a 0% tool-call error rate. Jev will never invent a fourth category, return a malformed object, or write an essay where you asked for a label.

That is a guarantee about format, not about correctness. Jev can still return the wrong valid value. It can file a billing ticket under "technical." What it cannot do is file it under a category you never defined, or bury the answer in three paragraphs of prose you have to parse. The error surface shrinks from "anything the model might say" to "one of the finite answers you allowed," which is a genuine engineering improvement, but it is not correctness.

Be honest about the provenance of the 0% figure too. TypeSafe is reasonably candid that it is asserted from schema design rather than measured empirically: if the set of valid outputs is closed, an invalid output cannot occur by construction. Any article that repeats "cannot hallucinate" without the format-versus-correctness distinction is misleading its readers. The useful reframing is this: a System One model eliminates format errors and confines correctness errors to a space you defined and can evaluate, which is exactly why the probability it returns is a filter and not a defensible audit trail about a person.

What can't Jev do, and where does it break?

A balanced view matters more than a sales pitch here, because the limitations define where a System One model belongs and where it will hurt you. Jev emits no text of any kind: no summaries, no rationales, no code. If you need words, a generative model produces the candidates and Jev picks among them. That is not a workaround, it is the architecture.

It is not a calculator. Counting is unreliable, and the error grows with the size of the thing being counted. Do arithmetic in code and ask one Noul per item rather than asking Jev to tally. Dates are text to it, not ordered quantities, so which came first, how far apart two dates are, and whether one falls inside a window are all unreliable. The pattern is to extract dates with a Choice over enumerated options, then compare them in code. It is text-only, which rules out image and video moderation outright. And it only works where the space of valid answers is bounded and known in advance; it does not write the schema for you.

There are operational traps too. Confidence only exists when a request succeeds, so you must never convert a timeout or a rate limit into a high-confidence default. Use a deterministic fallback or queue the case. Pin the versioned model ID rather than a moving alias, log the model reported in every response, and version your question definitions alongside application code, because an alias can move and silently change behaviour with no release on your side. And at low volume, the integration effort can cost more than the inference it saves. The honest test is whether you have enough decisions, at a low enough per-decision value, for cheap and calibrated to beat smart and expensive.

Why is a typed decision a content-modelling problem before it is an AI problem?

A System One model consumes state and returns typed judgements, which means the quality of every decision depends entirely on the quality of the state you hand it. That makes this a content-modelling problem before it is an AI problem. The state budget is 32,000 tokens, so you cannot simply dump everything and hope. You have to pass the model exactly the field, block, or section the question is about, and to do that you have to have modelled your content so those pieces are addressable in the first place.

This is where structured content becomes a hard advantage. A content platform that stores rich text as an opaque HTML blob can only hand a wall of markup as state, spending token budget on tags and layout the question does not care about. Sanity, the AI-native content platform, stores rich text as Portable Text, a structured format whose blocks, marks, and annotations survive being sliced apart, so you can query out precisely the paragraph or field a Noul is asking about. A GROQ query shapes the state to fit the question and the 32,000-token budget rather than the other way around. Content Lake real-time subscriptions and Functions give you the change events to re-judge content the moment an editor touches it, so a routing or moderation decision reflects the current state rather than a stale snapshot.

To be clear about what is and is not real: Sanity has not announced a Jev integration, a partnership, or shipped support for System One models. The claim here is architectural, not a product one. A content operating system that models your business as structured, addressable content is what lets a typed model see the right thing. The decision is only as good as the state, and the state comes from your content layer.