The Core-and-Edge Model for Trustworthy Compound AI Systems

Compound/hybrid-system architecture and integration engineering decides which parts of an AI system must stay deterministic and which can be left to a model's judgment, then enforces that boundary in the design itself. The defensible answer, consistent across 2026 research on compound systems, is a small, stable core that owns arithmetic, permissions, state and the commitment of external effects, with every model, retrieval source and provider treated as a replaceable adapter bound by an explicit contract. Executives should care because a model's fluent output mistaken for a validated fact or an authorized action turns a productivity story into a liability story.

What it is

A compound AI system combines more than one component: a model alongside retrieval, business logic, memory or other models. A hybrid system pairs learned inference with symbolic or deterministic computation, so judgment and arithmetic sit in different mechanisms. An agent adapts its own actions based on what it observes rather than a fixed script. The three overlap: a system can combine components without being agentic, and an agent can run on a single model alone.

An adapter translates between the system's domain contract and a provider's interface, so replacing a model or data source never means rewriting the logic that depends on it. A schema alone is not a contract.

Why it matters now

Enterprises are wiring models into systems touching money, permissions and customer decisions, and no single architecture is yet proven to win in general. A February 2026 study of an information flow calculus, LLMbda, proved noninterference and secrecy results, but only under its own formal semantics in a 16 task banking evaluation. An August 2026 paper on agent transactions tested database style consistency on 104 data science tasks: one model's task success rose from 64.0 to 74.6 percent as cost rose from $0.08 to $0.10, a second model's smaller gain cost $0.12 to $0.61, and the paper's own tables and prose disagree on some figures. A January 2026 paper on resource bounded agent contracts found a token budget on code review tasks cut consumption from 34,606 tokens to 3,461, but task success fell from 60.0 to 52.9 percent alongside a change in the iteration cap.

The architecture

I call this shape the core-and-edge model: a small, stable core surrounded by a ring of replaceable, contract bound components. The core is one controller: it owns bounded state transitions, decides what the system currently believes to be true, and alone is authorized to treat an effect as committed. Everything else sits at the edge behind an adapter, so a model, retrieval source or provider can be swapped without touching the logic depending on it.

Work flows through the core and returns through a ledger. A task arrives with its authority attached, the controller draws evidence through an edge adapter carrying source, version and trust, and a model interprets that evidence and proposes an action rather than performing it. A validation and policy step checks the proposal against typed rules and permissions, and routes what it cannot resolve to a person. Only then does an executor commit the action, and a ledger records it as pending, committed, failed or unknown, feeding status back to the core.

The failure modes live at the seams: a boundary without source and trust turns stale evidence into apparent authority, a missing permission epoch hides a revoked authorization, and treating a timeout as a failure, not as unknown, can double commit an effect on retry. An April 2026 Anthropic account of separating agent reasoning from sandboxed execution is one implemented example, though its comparisons are the vendor's own. Add a second model or agent only after an ablation shows the single controller fails a named requirement.

How to lead it

One architecture owner should hold the core-and-edge model as a standing decision record, not a diagram drawn once at kickoff. Assign a single owner to each invariant, arithmetic, permissions, state, effect commitment, and fund a capability registry and dependency graph so a release shows what just became unverified. Measure verified outcomes, total cost, and tail completion time, not the average.

Two decisions belong only to an executive: which constraints are hard feasibility conditions, a cap on verified failure probability and on authorization violations, that must never trade for a higher quality score, since a model only optimization will make that trade if nobody stops it, and the fallback policy: a backup provider must meet the same authority bar as the primary, or the system degrades to a safer mode.

What it is worth

Money shows up first in review labor, not the model bill: a $0.20 model step paired with $3 of review costs more per case than an $0.80 step paired with $1 of review. Risk shows up in how often the ledger reports an action as unknown rather than a clean success or failure, the number that predicts double charged customers and silent data loss. Time shows up in tail completion, the slow cases stuck between a model and a retry, more than the average response.

Measure all three before and after any change, holding the task and review rules fixed, and treat the difference as the return. No 2026 study compared a minimal and elaborate architecture under equal access and effort, so a return claim that does not name what it held constant is a proposal, not a result.