T=0 Process Reward Models for Agent Decision Scoring

AWARE v2.8.0 shipped today. One of the three things in this release is worth a 1-page explainer — because it's the difference between "we ran a model" and "we can prove what happened."

It's the Process Reward Model — the layer that scores an agent's decisions — and in v2.8.0 it runs at temperature = 0 by default.

The problem

When an autonomous AI agent takes an action in production — files a Jira ticket, queries a database, calls an API — boards and regulators ask: “Was that the right call? How do you know?”

Today's answer is usually "we ran it through a model that scored it." But that model is itself non-deterministic. The same agent action on Monday can score 0.7; on Friday, 0.4. Auditors can't reproduce the verdict. Boards can't replay the decision. Regulators can't verify the rubric.

When the auditor comes back in a year and asks "show me why this agent did this thing," the best we can offer is a model output that we can't recreate — because the model that produced it had temperature set somewhere above zero, and the API decided what that meant on a given day.

That's not a compliance posture. That's a hope.

What T=0 PRM fixes

The Process Reward Model in AWARE is the layer that scores an agent's decision. It applies a rubric — a set of policy-driven criteria — to the agent's proposed action and produces a score that downstream layers use to allow, constrain, or block.

In v2.8.0, the scoring phase now runs at temperature = 0 by default. The same input produces the same output, every time, across days, environments, and replays.

Three things fall out of that single change:

Auditable. Log the score, replay the model, get the same number. The audit trail isn't "the model said 0.72" — it's "the model must say 0.72 because the rubric, the prompt, and the temperature are all fixed."

Replayable. Six months from now, an auditor can re-run the scoring on the same agent action and verify the original decision. Not a similar decision — the same one. That's the bar for "reproducible AI" that ISO 27001, NIST AI RMF, and the UK Cyber Security and Resilience Bill all gesture at without naming.

Deterministic. No "the model was having a weird day." No "the API gateway was throttling us that morning." No "we changed the system prompt last week, sorry." The decision is the decision.

Where it sits in the agent pipeline

The PRM is a separate process from the agent's own reasoning. It applies the rubric, not the conclusion. The agent thinks; the PRM judges. And the PRM is the only layer whose verdict needs to be reproducible.

The audit log entry is the artifact your board signs off on. It's the artifact your auditor comes back to in a year. It contains the score, the model version, the score temperature, and the rubric that was applied. If your PRM is at T=0, that log entry is a contract, not a recollection.

What this enables

“Prove which AI agent took which action.” The three-question test for boards, now with a deterministic grading layer. Not "the model was 70% confident" — "the model returned 0.72 by rubric, reproducibly, under the same model version and temperature that was live at the time."

Compliance. ISO 27001, NIST AI RMF, the UK Cyber Security and Resilience Bill, the EU AI Act — every compliance framework with teeth asks some version of "can you reproduce the decision your AI made?" T=0 PRM is the reproducible part. It's not the whole answer to AI compliance, but it's the foundation that everything else sits on.

Incident response. When an agent does the wrong thing, the first question is always "did our scoring layer fail, or did the rubric pass and we got lucky?" With T=0 PRM, you can replay the exact scoring and know for certain. The same inputs produce the same verdict. The audit is the audit, not an approximation of it.

What ships with v2.8.0

Three things in this release, beyond T=0 PRM:

Vendored inference. Heavy-think v0.2.2 is now vendored at backend/heavy-think/ in the AWARE repo. The security-critical scoring path no longer depends on a third-party inference endpoint. Your audit trail and the model that grades it live in the same repo, same build, same supply chain.

Schema rigor (BLOCK-13 closeout). The rlm config surface now has 6 missing field groups added back, plus additionalProperties: false across the load-bearing arrays. Pre-fix: 10 of 30 BLOCK-level attack mutations were accepted by the schema. Post-fix: 0 of 30. Sounds boring until you try to ship a regulated agent and realize typing matters.

481 of 502 tests green. The 21 failures are pre-existing dormant tests in rl-pipeline-bridge and audit-retention — flagged separately, not regressed. Public-surface scrubbed, gitleaks clean, no third-party model dependencies on the security path.

Get the explainer

If you want the 1-page version — the rubric, the pipeline diagram, and the audit-trail contract on a single page — it's in the v2.8.0 release assets:

And if you want the code:

git clone https://github.com/GoodCISO/aware
cd aware && npm install

Open source. Apache-2.0. The T=0 default lives at backend/heavy-think/src/clients/minimax.js — if (opts.phase === 'prm_score') return 0; — line 27. Everything else around it is the audit story.

I spent 20+ years inside regulated environments (BT, Sage, Worldpay) building the controls that auditors sign off on. T=0 PRM is the AI-native version of those controls. AWARE is the open-source answer to "we trust the model" → "we can prove what happened."