The economic case for compiled AI.

Each tool was generated by an LLM, verified for syntax, executed in an isolated V8 sandbox, approved by the governance engine, and sha256-locked. Average compilation cost: $0.002. After that, the tool runs indefinitely with zero additional LLM cost.

The Safebots line is flat. The agent line grows linearly. At 1,000 runs the gap is over two thousand to one. Model: Claude Haiku 4.5, the cheapest available. Every number is measured, not projected.

The input-to-output ratio for agentic tasks is 153:1 — versus 1.33 for chat and 0.16 for reasoning. Your agent isn't expensive because it writes a lot. It's expensive because it reads a lot, repeatedly. Every loop iteration re-ingests the repo state, error logs, tool outputs, and accumulated conversation history. The context snowball is the cost.

The same task, run multiple times on the same model, produced token counts that varied by up to 30×. Higher token consumption does not produce higher accuracy. Accuracy peaks at intermediate cost and saturates or drops as cost increases. The cost-accuracy relationship the industry assumed does not exist in the data.

API providers are pricing inference below cost to capture market share. OpenAI lost roughly $1.35 for every dollar earned in 2025. The per-token price your product currently optimizes against is partially subsidized by venture capital and will not survive market maturity. When the subsidy compresses — and the paper's findings make clear that consumption growth will force it to — every product built on today's cheapest rate has a hidden liability on its balance sheet.

A workflow with 40 tool invocations and 4 LLM calls uses ~5% of what a 300-LLM-call swarm uses. The unit of parallelism is the tool, not the model.

Tools read scoped, immutable references — not the full accumulated context. Cache layers serve cache-hit reads at a fraction of the original cost.

The same workflow runs the same steps in the same order — token consumption is a function of the workflow design, not stochastic agent improvisation.

Tokens are spent where they buy outcomes — explicit workflow structure, plus on-demand tool generation when novel work appears. Not where the agent's improvisation happens to lead.

Every step logs actual input/output tokens to a stream. Budget enforcement is deterministic — the infrastructure stops the workflow when the budget is exceeded, regardless of what the LLM thinks. Best self-prediction correlation in the paper: 0.39.

The essential distinction:

Workflows execute known processes. They are faster, cheaper, reproducible, testable, auditable, permissionable, easier to monitor, easier to roll back, resistant to prompt injection, and predictable in resource consumption.

Agents search for a process when it is not yet known. They remain valuable when the environment is unfamiliar, the task has never been performed before, the necessary sequence can't be specified in advance, tools must be discovered or generated, failures require diagnosis rather than a predetermined response, or conditions change faster than workflows can be manually maintained.

A workflow can still contain LLM steps. The difference is that the model is invoked for a bounded function — classify this document, extract these fields, draft this response — rather than being placed in an open loop and asked to figure out what to do indefinitely.

This is not "workflows versus AI." It is: AI inside governed workflows, with agency invoked only when the workflow reaches something it can't handle.

"Process this invoice according to company policy" should be a workflow. The steps are known. The rules are known. Run it as compiled, deterministic code — no LLM needed.

"Investigate why invoices from this supplier suddenly stopped reconciling" may require an agent. The problem is novel, the diagnosis is open-ended, and the solution isn't known in advance.

Even then, the agent operates inside a controlled envelope: snapshot the state, give it scoped capabilities and a budget, let it explore in isolated branches, verify its proposed outcome, promote the result only after authorization. And if it finds a recurring pattern, turn that pattern into a workflow so next time it runs at deterministic-compute prices.

A conventional agent pays the reasoning cost again every time. Safebox learns a successful path once, encodes it as a workflow or generated tool, verifies it, and reuses it forever at deterministic-compute prices.

Over time: agentic exploration → verified trajectory → reusable workflow → cheap deterministic execution.

Each cycle through this loop converts expensive, unpredictable inference into cheap, predictable computation. The more cycles the system completes, the less agency it needs, and the wider the cost gap grows against systems that re-improvise every task from scratch.

ZFS strengthens this by making experiments, checkpoints, isolated branches, and rollback inexpensive. Local models handle the remaining long tail of novelty. Streams preserve provenance and reusable results. The entire architecture is designed to make this lifecycle — discover, verify, crystallize, reuse — as fast and cheap as possible.

Think of it like version control for everything — not just code, but the entire workspace. Safebox can snapshot the current state, create several parallel branches, try different approaches simultaneously, evaluate the results, and promote the winner. Or roll everything back instantly.

What this makes cheap: snapshots (instant), writable copies (instant), rollback after a failed step (instant), parallel experiments (share unchanged data, only store what changes), and clean before/after states for auditing.

What still costs money: the AI computation itself. If you run ten parallel experiments, you pay for ten runs of inference. But Safebox reduces that cost by using cheap local models for initial candidates, stopping weak branches early, and sending only the strongest result to an expensive frontier model. The branching is free. The intelligence about which branches to keep is where the savings compound.

Safebox makes state branching nearly free, allowing parallel experimentation without duplicating entire environments. Compute stays proportional to work performed, but model routing, caching, and early termination sharply reduce wasted inference.

These numbers assume current subsidized API pricing. When prices normalize, the gap widens.

The 50% annual increase is one plausible scenario — API prices could also fall as hardware improves. But even if they do, the savings from reducing tokens per outcome remain. Safebots wins in both directions: if prices rise, the gap widens; if prices fall, the workflow efficiency advantage persists.

Per-engineer API cost: $500–$2,000/month. Uber's AI spending grew so fast that the company capped employee AI spend at $1,500/month per tool — a sign that even large companies are hitting the ceiling on API-based AI economics.

Microsoft halted internal Claude Code licenses company-wide, shifting toward their own self-hosted tooling. When the company that invested $13B in OpenAI decides external API costs are unsustainable for internal use, the signal is clear.

The marginal cost of adding a low-utilization tenant is small — ZFS datasets, MariaDB databases, and systemd resource limits make provisioning nearly free. The compute cost scales with aggregate workload, not with tenant count. So ten tenants sharing the same inference capacity cost far less than ten separate deployments.

Beyond ~100 tenants, GPU/inference capacity must scale with aggregate workload. The tenant provisioning cost stays low, but the compute is proportional to the work performed.

The compiled-workflow model has an advantage even over blockchain's cost disruption: a blockchain transaction has a marginal cost per execution, however small. A compiled workflow's marginal cost for pure-compute tasks is literally zero. The gap widens with usage.

Individual developers adopted Polygon and Solana first. Then projects migrated. Then enterprises. Then institutions. Each layer validated the economics for the next. Safebots follows the same sequence: community leaders adopt first (B2C). Enterprise follows (CISO pipeline). Institutions follow enterprise.