Own the Loop – Part III: What Belongs in the Weights of an Enterprise AI Model

Part 2of this series found that an open language model reading your organization's decision traces builds an internal representation of your evaluator's judgment accurate enough to predict verdicts at 0.97 F1. It also found that this representation resists intervention: a random direction moved the model's output more than a carefully derived judgment direction at every amplitude tested. The judgment was legible and not steerable. 

That left an obvious next step. If you cannot grab the judgment inside a general model, stop trying to grab it. Train the judgment into a small model you own outright, one whose entire purpose is your organization's evaluation policy and nothing else. Two reasons drove this decision. The first is practical: an owned model running your judgment is an organizational asset, available offline, on your own infrastructure, with no inference cost and no API dependency. The second is interpretability-driven: a model whose only job is your organization's judgment is a far cleaner thing to study than a large general model where that judgment is one faint signal among trillions of others. To understand a mechanism, first concentrate it. 

Part 3 is the account of that concentration: what we distilled, how, what it got right, where it failed, and what the failure taught us about how organizational cognition should be architected. The failure is the most important part.

The base model was Qwen2.5-3B-Instruct, the same three billion parameter open weights model used in Part 2, running in a quantized four-bit form during training to fit the process on a single Apple Silicon machine. The training method was QLoRA, which stands for Quantized Low-Rank Adaptation, a technique that trains small adapter layers on top of a quantized base rather than modifying the base model's weights directly. This keeps the training footprint small while still producing a model whose outputs are meaningfully shifted. 

The training data was not facts, not documents, and not general knowledge. It was decisions: 597 decision traces from our Engram memory store, spanning four task types: judge (182 examples), coach (193 examples), email-judge (133 examples), and assess (89 examples). The dataset was split by time, meaning the test set consisted of the most recent decisions in the store, none of which the model had seen during training. This matters: a time-ordered split tests whether the model has internalized a generalizable policy or merely memorized a pattern. The training ran for 600 iterations across 16 layers on a single machine, took approximately 40 minutes, and peaked at around 5 GB of memory.

Base model   Qwen2.5-3B-Instruct, 4-bit quantized 

Method      QLoRA via mlx-lm, adapter on quantized base 

Compute     16 layers, 600 iterations, one Apple Silicon machine 

Time       approximately 40 minutes, 5 GB peak memory 

Data       597 decisions from Engram: judge 182, coach 193, email-judge 133, assess 89 

Split      time-ordered; test set is the most recent decisions, none seen during training 

The scale is worth pausing on. This is not a frontier lab budget. It is a laptop.

Overall verdict accuracy went from 0.50 for the untouched base model to 0.98 for the fine-tuned version. On the core judge task alone it went from 0.85 to 0.96, against a majority-class floor of 0.82, which means the improvement is clearing the "always predict the common answer" baseline by a real margin. On the email screening task, the base model scored zero, defaulting to rejecting every input, and the fine-tune recovered all of them. 

Past the numbers, the qualitative result is the one that matters for how organizations should think about this. In a live test on a decision made the same morning, the fine-tuned model reached the same verdict our evaluator had recorded and justified it using our own vocabulary, our categories and our priorities. The base model reached a vaguer version of the same call and reasoned like a generic consultant. The fine-tune did not imitate the surface of the judgment. It internalized the policy well enough to apply it to situations it had never seen. For any organization asking whether its decision standards are transferable to a model it controls: they are, with less than 600 training examples and 40 minutes of compute. 

The organizational implication is immediate. A specific, valuable, relatively slow-moving piece of organizational cognition, the accumulated judgment your most experienced evaluators have developed over time, can be captured in a model you own and run on hardware you control. That model runs offline, does not call any external API, and accumulates no inference cost. It is an organizational asset in the same category as a trained human, except it is reproducible, auditable, and available at any hour. 

When we asked the same model to also produce work, not just evaluate it but write decisions, draft communications, and execute tasks, it broke down. The model had become so specialized at judging that it had lost the general fluency the base model started with. Instructions it could have handled easily before training now produced degraded output. 

This is not a defect to engineer around. It is the definition of what fine-tuning does. Fine-tuning does not add knowledge to a model. It shifts the model's existing habits. Teaching it to do one thing with high precision suppresses its readiness to do other things. A model distilled to hold your judgment will be worse, not better, at execution. The practical rule that falls directly from this observation is architectural rather than empirical: one model, one job. The model that holds your evaluation policy should judge. A different model, or the untouched base model inside your agent scaffold, should write and act. Any architecture that asks a single distilled model to both decide and execute is fighting a fundamental property of fine-tuning and will lose. 

There was a second finding with structural teeth. On tasks where organizational standards change over time, our plain written rulebook, a small set of explicit weighted rules our agents maintain as a live document, outperformed the fine-tuned model. The reason is architectural and worth internalizing. A distilled model is a frozen snapshot of your judgment at the moment of training. It is fast and cheap to run, but the day your standards evolve, its weights are quietly out of date. The only correction is retraining. A written policy is a living document. Change one line and it is current immediately. The mature architecture uses both, in a defined order. The written rulebook is the source of truth. The distilled model is a cached reflex of that rulebook, retrained periodically when the two drift apart. This is, not incidentally, how a nervous system is organized: a slow deliberate policy above, a fast automatic reflex below, with the reflex periodically updated by the deliberate layer. 

The findings above collapse into one architecture decision. Organizational cognition has three components, and they belong in three different substrates. 

Facts, meaning your deals, prices, org chart, team status, and current operational state, are fast-changing and must be exact and correctable at the record level. They belong in retrievable memory. Putting them into model weights is a known failure mode: weights go stale, and you cannot correct a single record without retraining. 

Actions, meaning the writing, the tool calls, the API work, and the execution of tasks, are things a capable general model already handles well and that vary constantly with context. They belong in the agent scaffold and a general model, not in a specialized fine-tune. 

Judgment, meaning the slow-moving organizational policy that determines what constitutes a good decision, is the one component worth distilling into model weights. But even then, those weights should be treated as a cached reflex of a living written policy rather than the truth itself, periodically retrained when policy and weights diverge. 

Get this division wrong and you will either fine-tune facts into a model and watch it hallucinate stale information, or fine-tune actions into a model and watch general capability collapse. Both failures are now directly evidenced in our own experiments. Get it right and each component sits in the substrate where it is strongest, and the architecture becomes genuinely composable. 

The distilled model that emerges from this phase is not just a useful production asset. It is the right specimen for the next phase of the research. In the general model used in Part 2, our organizational judgment was a faint, distributed signal, readable statistically but impossible to locate or influence at a specific site. In this concentrated model, the mechanism should be close to the surface. A model whose entire job is our organization's judgment has no other signal competing with it. 

Part 4 stops treating this model as a box that judges correctly and opens it. We applied mechanistic interpretability, specifically a technique called a sparse autoencoder, to the internals of the distilled model. The question the series has been building toward is not whether an organization can read its judgment from the outside but whether it can see, inside the weights, the actual concepts its AI uses when it decides. That is what Part 4 investigates.

Umar Bilal, Co-Founder, CodeNinja 

Previous: Part 2 — Activation probing found organizational judgment at layer 17, 0.97 F1. Steering failed. The residual analysis follows.

Next: Part 4 — We opened the distilled model with a sparse autoencoder. Reading worked. Grabbing did not. And the failure, confirmed now by two independent methods, points at something real.