Part I · Before the state changesPut the control at the commitment claim

A reviewer opens a polished recommendation, sees a green confidence indicator and clicks approve. The underlying evidence, policy interpretation and proposed transaction were all framed by the same system. The payment had already been scheduled.

The audit record contains a human decision. The production system did not. The person saw no independent source, could not alter the transaction and arrived after the point at which the state could be changed safely. Calling this consequential review confuses a recorded gesture with an intervention. Repeating the gesture across every case may also delay harmless work and exhaust the attention needed for the few decisions that are genuinely reserved.

The central claim is that the boundary between automatic completion and review should be set for each commitment claim at the last point where evidence or authority can still change the consequence. The route follows consequence, reversibility, available proof and the unique contribution of a reviewer. It does not follow model confidence alone, a broad risk label or an organisational preference for visible humans.

A commitment claim is a specific assertion or proposed act that must be valid and authorised before business state changes. One fluent model response may contain extracted facts, arithmetic, policy interpretation, a recommendation, a reserved decision, an executable instruction and an external communication. Each has a different verifier and failure route. A correct extraction cannot grant lending authority. A schema-valid object cannot prove that its supplier-risk fields have sources. A lawful rule can calculate an outcome that only a licensed professional is institutionally permitted to commit.

This separates Paper 158 from approval-attention design. Approval fatigue asks how scarce reviewer attention should be allocated among actions. This paper asks an earlier production question: which claim can cross the commitment surface automatically, which control must intercept it, what transaction state binds that decision and which changes reclassify the route. Review capacity appears as one feasibility gate, not the organising thesis.

Part II · Decompose the fluent answerEvery claim needs its own evidence and authority

The Commitment Claim Inventory, introduced here within the Consequence-Review Architecture, prevents one plausible narrative from inheriting proof it does not possess.

Record observed facts and their primary sources; model-extracted candidate facts; deterministic calculations; policy conditions; interpretations; predicted risk; recommended route; reserved human decision; executable transaction; authoritative record update; affected-party notice and appeal; and final residual-risk acceptance. For each claim, name the evidence standard, validator, authority, consequence and failed-proof route. A workflow can then automate some claims while reserving others.

Consider commercial credit. An agent extracts covenant dates and ratios from executed documents. A focused reviewer checks only the cited clauses against primary files. Deterministic code recalculates the ratios. A credit officer separately decides whether the risk is acceptable and holds the commitment mandate. Treating the entire file as one review would either waste the officer’s time on extraction or let verified extraction masquerade as a lending decision.

Part III · Hard proof before automatic actionStraight through is a theorem about one route, not a trust setting

The Straight-Through Admissibility Proof has twelve hard gates. Missing authority or evidence cannot be offset by a high average score.

The eligible population and intended use must be explicit. Identity, consent, eligibility and current state must be deterministically valid. Evidence must be traceable, fresh and in scope. Decisive rules and calculations must run outside the model. Any model contribution must be independently checkable to the required standard. Conflict, novelty and missing information must trigger abstention. Permission must be externally enforced, the transaction atomic or explicitly non-retryable, the consequence bounded or authorised, outcome receipts reconciled, drift and appeals monitored, and stop plus fallback tested.

An invoice with complete structured evidence can satisfy the proof. Duplicate, tax, amount and permission checks run deterministically; the payment instruction binds to the current vendor record and authority envelope; idempotency prevents repeated effects; settlement returns an atomic receipt; samples test the population. Model-assisted extraction may prepare a candidate field, but the route remains straight through only when an authoritative source or rule validates it.

Contrast a supplier-risk output that conforms perfectly to a schema but cites no evidence. Syntax says where a value sits, not whether it is true. The evidentiary gate fails before any review queue begins normalising the object. A reviewer who sees only the unsupported summary cannot repair provenance by agreeing with it. The proper response is source acquisition or stop.

The transaction-state contract makes review perishable

A route decision binds to a particular world state. The transaction contract records the claim identifier, authoritative pre-state, evidence versions, proposed effect, permission version, exposure consumed, idempotency key, decision receipt, execution receipt and expected post-state. Execution rechecks those fields rather than trusting that an earlier approval is still current. If the vendor record, account balance, policy, affected party or cumulative limit changes between decision and action, the claim returns to routing. Approval is not a reusable token detached from its conditions.

The contract also says what an uncertain write means. A timeout may indicate failure, success or a response lost after success. Retrying without correlation can duplicate the consequence, while asking a person to approve the same narrative again still leaves the world state unknown. The recovery path first queries authoritative state, reconciles prior effects and either closes the receipt or constructs a new claim. For external communications that cannot be recalled, the contract marks the action non-retryable and preserves a draft until named authority and delivery state are both current.

Part IV · Contribution, not presenceChoose the smallest review that can change the claim

The Review Mode Registry distinguishes deterministic validation, independent model check, population sampling, focused verification, judgement, commitment, affected-party confirmation, second-line challenge and incident review.

Each mode has its own denominator and completion proof. Focused verification checks one cited assertion against primary evidence. Judgement resolves context or values. Commitment supplies a reserved right. Affected-party confirmation supplies consent, correction or choice. Sampling estimates population performance and recovery without pretending to prevent every error. Incident review acts on a population when a common defect makes case-by-case approval ineffective.

Selective prediction and learning-to-defer research formalise routes in which a model can reject or pass work to another decision maker. Madras, Pitassi and Zemel study a two-stage deferral framework with fairness and accuracy objectives in its evaluated setting.[7] SelectiveNet integrates a reject option and studies risk-coverage trade-offs on specific classification and regression datasets.[8] These results do not make deferral safe by definition. A deferred claim needs a capable recipient, usable evidence, authority and service within the consequence window.

The Review Value Contract names the exact claim, why automatic proof is insufficient, primary sources, expertise, independence, authority, alternatives, missing evidence, minimum useful time, ability to abstain or stop, outcome feedback and queue protection. If the person sees only the recommendation, lacks time and cannot reject, the contract fails. Adding the word oversight does not change that result.

Part V · Make disagreement possibleThe workspace must precede the recommendation when the task requires independence

A Decision-First Review Workspace presents the case, consequence and primary evidence before revealing a model view where anchoring matters.

The reviewer records a provisional assessment, then sees the recommendation, supporting and contradicting evidence, uncertainty and permitted alternatives. They can request evidence, abstain, narrow, escalate, reject or stop. The timer follows the consequence window rather than an individual productivity target. The final receipt records what changed between provisional and final judgement and later connects the decision to outcome and appeal evidence.

Cognitive forcing is an experiment, not a universal interface rule. Buçinca, Malaya and Gajos found reduced overreliance in a studied task alongside subjective costs and differences associated with need for cognition.[10] Bansal and colleagues found that explanations increased acceptance of AI advice regardless of correctness and did not produce complementary performance in their studied tasks.[9] Interfaces should therefore be tested with representative people, real evidence and actual time pressure. A forcing step that adds delay without improving decisions should be removed.

Overreliance and underreliance both matter. Dietvorst, Simmons and Massey observed algorithm aversion after participants saw an algorithm err under their experimental conditions.[12] Logg, Minson and Moore observed algorithm appreciation in other experimental settings.[13] Green and Chen showed that human interaction with risk assessments can produce fairness effects not visible in algorithm-only evaluation.[11] None implies a universal preference or interface. Together they make agreement an inadequate quality measure.

Part VI · Coverage can move silentlyMeasure every route, deferral and affected outcome

The Coverage and Residual-Risk Ledger records the eligible population, not merely the cases that completed or reached a reviewer.

Keep straight-through, sampled, verified, judged, committed, abstained and stopped populations separate. Record model, rule, reviewer and combined errors; queue time and evidence expiry; evidence requests; unsupported approvals and rejections; reversals, remediation, complaints and appeals; distributional differences; cumulative and common-mode exposure; full cost; and the owner who accepted residual risk. Automation rate without outcome and review rate without value are both incomplete.

A high-volume, low-consequence classification may use risk-based sampling instead of universal approval. The sample combines random population coverage, changed segments and harm-sensitive cases, and its audit lag stays inside the recovery window. A customer appeal route catches individual errors. If appeals reveal concentrated harm in one language group, the route narrows for that segment while investigation proceeds. Aggregate accuracy does not authorise silent coverage expansion.

Review capacity is a feasibility constraint. Measure arrivals after automation, evidence-ready service demand, reconstruction, rework, expertise, authority and the decision window. Reserve incident, training and recovery capacity. Little’s long-run relationship can connect work in process, effective arrival rate and time when definitions and conditions fit, but it does not design staffing or validate an unstable queue.[18] If waiting expires evidence or changes consequence, a review route that cannot be served is not protective.

The Selective Review Change Rule expands automatic coverage only after type-specific outcome evidence, reliable abstention and tested recovery. Remove review only when the step adds no evidence, judgement, authority or legitimacy. Change one routing dimension at a time where feasible, retain comparison sampling, test displaced errors and restore review or stop when drift, appeal or common-mode exposure exceeds the authorised boundary.

Route reclassification follows changed consequence and proof

A case does not remain straight through merely because its model score stays stable. A new downstream integration can turn a reversible record update into an external payment or message. A policy revision can reserve authority that was previously delegated. Evidence ageing can remove a once-valid oracle. Higher volume can create cumulative exposure from individually modest acts. Each change alters the admissibility proof even when model behaviour is identical, so monitoring must cover the surrounding transaction and affected population as well as predictive drift.

Exceptions are reclassified just as explicitly. A missing document may require focused verification; contested meaning may require judgement; unavailable reserved authority may require deferral; a shared-source defect may require population stop. The route state records the failed claim, capable receiver, deadline and next proof required. It never treats abstention as completed protection. If the receiver lacks capacity before evidence expires, the workflow must narrow or suspend rather than leave an apparently safe defer state to age silently.

Part VII · Sixteen production decisionsThe same model earns different routes

Part VIII · Executable routing instrumentProve one claim before choosing its path

The Straight-Through and Consequential Review Designer tests whether a commitment claim has hard proof, a value-adding review route and a feasible decision window.

Choose consequence and reversibility, evidence condition, deterministic verification, model scope, authority, transaction state, reviewer contribution and lifecycle condition. Named cases exercise all five routes and failure controls. The result is a routing hypothesis tied to the declared population, not a compliance opinion or universal policy.

A positive result permits only the route and population described. A negative result identifies the gate that failed. The instrument cannot prove factual correctness from user-selected inputs, establish legal compliance, predict every rare harm or turn reviewer availability into authority. Use representative cases, ordinary and peak operations, adversarial evidence, common-mode failures and recovery exercises before production approval.

Part IX · Strong rival and boundaryMore routing can create more system than the work deserves

The strongest rival argues that claim decomposition, selective routes and review contracts add complexity, delay and organisational caution without guaranteeing better decisions.

A human can add noise or bias rather than wisdom. Independent evidence may not exist. Sampling can miss rare harm. Deterministic checks can become brittle. A formal review gate can serve risk avoidance instead of customers, while low-consequence user correction after the event may work better than approval before it. In small teams, one knowledgeable owner may integrate verification and decision more reliably than an elaborate segregation design.

The rival weakens any review-by-default policy. It does not weaken the contribution test. Use hard straight-through paths when evidence, authority and transaction controls genuinely close the claim. Use sampled outcome monitoring when effects are bounded and repairable. Use focused checking instead of whole-case approval. Reserve human judgement for contextual or legitimacy-bearing choices. Stop when neither automated proof nor feasible human contribution can make the transition acceptable. The small-company case remains a negative control: document its combined role and compensating checks rather than copying enterprise ceremony.

Human-factors evidence supports caution without proving one universal allocation. Parasuraman, Sheridan and Wickens distinguish automation across information acquisition, analysis, decision selection and action implementation.[4] A meta-analysis by Onnasch and colleagues examines routine and failure performance, workload and situation awareness across experimental settings.[5] Bainbridge warns that people left with abnormal and recovery work may lack the practice and support to perform it.[6] NASA’s Task Load Index offers multidimensional subjective workload evidence; it is not an individual productivity score.[14]

Current governance sources provide context, not an automatic route. The currently published NIST AI RMF remains version 1.0, a voluntary framework whose revision is in progress; its Core addresses intended purpose, differentiated roles, validity, monitoring, appeal, override, incidents and change.[1] NIST AI 600-1 adds generative-AI risk and testing considerations.[2] The GAO accountability framework covers governance, data, performance and monitoring for federal agencies and other entities.[3] The UK Government AI Playbook applies meaningful human control and redress in its public-sector setting.[15] The EU AI Act has jurisdiction-specific and phased duties for covered systems.[16] ISO/IEC 42001:2023 describes an organisational AI management system.[17]

The Consequence-Review Assurance Docket records population, claims, proof gates, review contribution, evidence, authority, interface, coverage, queue feasibility, appeals, distributional evidence, residual risk and recovery. The Consequence-Review Reauthorisation Rule reopens the route after material changes to outcome, population, evidence, model, prompt, validator, threshold, reviewer, authority, queue, affected-party right, vendor, law or distribution, and after unsupported approval, hidden expansion, deskilling, expiry, harm or incident.

ConclusionCross the commitment surface only with the proof the consequence requires

Straight-through processing and consequential review are not rival ideologies. They are different answers to a claim-level question. Automatic completion is strongest where primary evidence, deterministic rules, enforced permission, transaction integrity, bounded effect, reconciliation and lifecycle control form a hard proof. Review is strongest where an identifiable person or independent service can add evidence, judgement, legitimacy or reserved authority before the point of no return.

The practical discipline is to decompose the answer, bind each claim to a verifier, locate the consequence, select the smallest valuable control and keep every route visible in the population ledger. Drift, appeals, common defects, queue expiry and changing rights can reclassify the path. The aim is neither maximum automation nor maximum human presence. It is a business-state transition whose evidence, authority and residual risk can still be defended after the interface has disappeared.