# Model tiers — route by data class, not by habit

`model-routing.md` is the individual's rule of thumb. This is the team's *policy*:
a standing answer to "which model is allowed on which class of data?" — so the
decision is made once, deliberately, rather than per developer, per deadline.

## The two axes

A routing policy is the intersection of two questions:

1. **What class of data does this touch?** (sensitivity / governance)
2. **What does a wrong answer cost?** (correctness / blast radius)

Sensitivity governs *where the data may go*; blast radius governs *how much
capability and verification you buy*. They are different questions — keep them
separate.

## A starting policy

| Data class | Examples | Where it may go | Default tier | Verification |
|------------|----------|-----------------|--------------|--------------|
| **Public** | Open docs, marketing, sample data | Any approved model | Economy | Spot-check |
| **Internal** | Non-customer code, internal reports | Approved models under contract/DPA | Economy → Mid | Verify with data |
| **Sensitive / PII** | Customer data, account info | Only models with the required data agreements and residency; PII scrubbed where possible | Mid, scrubbed | Independent review + audit trail |
| **Regulated / restricted** | Money movement, decisions of record, secrets | Approved enclave only — or not sent to a model at all | Frontier or human | Human sign-off; full audit trail |

Fill in the model names and providers for *your* approved list — the structure is
the point. **Sensitivity is a hard gate (the data may not cross it); blast radius
is a dial (how much you spend and verify).**

## How to operate it

- **Classify at the boundary.** Tag data with its class where it enters the
  system, so routing is a lookup, not a judgement call under pressure.
- **Scrub before you send.** Strip or tokenise PII before a prompt leaves your
  perimeter whenever the task allows it.
- **Default down, escalate on evidence.** Start every task at the lowest tier its
  data class permits; move up only when a wrong answer is demonstrably expensive.
- **Log the route.** Every call records which model saw which data class — that
  record is your `audit-trail.md` and your compliance story in one.
- **Review quarterly.** Approved models, prices and capabilities all move.