AI Research Library
The Certainty Gradient
Rajesh Ranjan Mahapatra
Place each decision in the least expressive mechanism that preserves its real uncertainty, then set action rights separately according to consequence, reversibility and authority.
© 2026 Rajesh Ranjan Mahapatra. 29 min read
The Certainty Gradient
Place each decision in the least expressive mechanism that preserves its real uncertainty, then set action rights separately according to consequence, reversibility and authority.
TLDR
- A decision mechanism and permission to act are two different choices. Evidence should select the mechanism; selective risk, consequence, reversibility and accountable authority should select the release gate.
- The causal mechanism is degrees of freedom. A method more expressive than the evidence requires introduces avoidable variance and verification work; one less expressive than the evidence requires hides ambiguity inside brittle exceptions.
- Query authoritative state, calculate defined quantities, enforce explicit rules, classify bounded patterns, use language models for open synthesis, and involve people where independent information, value judgement or accountable authority remains.
- Calibration and abstention help only on the population they were validated on. Distribution shift, stale world state, correlated human error and irreversible effects can invalidate an apparently safe confidence threshold.
- Approve populations and action classes rather than approving “the agent”. Keep a placement record, test lower-cost challengers in shadow mode, and require fresh authority plus effect verification before consequential release.
The same answer, three different systems
A customer writes, “I was charged twice for the same train ticket. Please fix it.” A language model reads the message, compares two transaction descriptions and returns probable duplicate charge. Its interface also prints 0.96 beside the answer. Nothing else about the prediction changes in the next three versions of the workflow.
In the first version, the label only sorts the message into an internal review queue. A mistake costs a few minutes and the route can be changed. In the second, the label supplies an amount to a refund calculation. A mistake can move money, although a readback and reversal remain possible. In the third, the label closes a formal complaint and records that the customer has received final resolution. The same words now alter an obligation and may be difficult to undo.
A one-dimensional diagram often places rules at the “certain” end, classifiers and language models in the middle, and people at the “uncertain” end. That diagram is useful until it quietly answers two questions as if they were one. It asks which mechanism can form the answer, and it also appears to decide who may release the effect. The complaint example exposes the fault. The prediction is unchanged, but the action right must change.
The core answer is a two-stage placement rule. First, use the least expressive sufficient mechanism: the narrowest method that preserves the uncertainty still present after authoritative data, calculation and explicit constraints have done their work. Second, set an independent release gate from observed selective risk, severity, reversibility, coupling and authority. Confidence may support the first decision. It cannot, by itself, make the second.
This refinement matters because each mismatch has a different causal cost. An unnecessarily open mechanism has more possible outputs than the evidence can justify, so it needs more testing and more verification. An overly narrow mechanism cannot represent the relevant distinctions, so its missing judgement reappears as exception rules, manual workarounds or silent error. The architecture should spend uncertainty only where uncertainty changes the decision.
Two gradients, not one ladder
“Use rules for certainty, models for ambiguity and people for high stakes” sounds sensible because the three often correlate. Structured evidence is easier to verify. Consequential decisions deserve more oversight. Yet correlation is not identity. A tax calculation can be formally exact and still require approval because it releases a large payment. A language model can be uncertain and still be safe to use because it only proposes three alternative email drafts. A person can carry authority while being less accurate than a classifier on a repetitive, well-labelled task.
The first gradient concerns epistemic fit: what form of evidence is available, what transformation is required and how much residual ambiguity remains. The second concerns effect authority: what may happen after an answer, how severe a wrong effect would be, whether it can be reversed before harm, how many downstream decisions depend on it and who is accountable. The two gradients meet at a decision boundary, but they should not be collapsed there.
A thought experiment: change only the effect
Hold the evidence, model, prompt, answer and measured error rate constant. Change only what consumes the answer. When the consumer is an internal search filter, the system may accept a relatively broad coverage because errors are visible and cheap to correct. When the consumer initiates a refund, the policy service must determine eligibility and amount, the action needs an idempotency key, and a readback must confirm the account state. When the consumer closes a regulated complaint, the release may require a named person or independently approved rule.
This single-variable intervention shows why “high confidence” cannot be an authorisation claim. Confidence is evidence about prediction correctness on a measured population. Authorisation is a decision about permitted effects in current context. A calibrated classifier may support an auto-route and still be forbidden to release funds. Conversely, a deterministic calculation may be allowed to prepare a large payment but not submit it.
The action gate compares unrecovered harm
A compact operating quantity helps separate prediction quality from release. Let selective risk be the observed error rate among cases the system chose to accept. Let severity express the consequence of a wrong effect, recoverability express the fraction of that consequence expected to be prevented or reversed, and coupling express how widely the effect propagates. The following is a decision aid, not a physical law:
If S is a monetary or utility loss, H retains that scale. If S is an ordinal severity band, H only orders scenarios; its numerical gaps have no cardinal meaning.
Raising model accuracy lowers r, but it does nothing to prove current authority, correct stale state or make an irreversible effect reversible. Improving recovery can lower H even when model quality is unchanged. Reducing coupling, for example by writing to a draft store rather than a system of record, can do the same. Architecture can change risk without changing the model.
NIST frames risk through both likelihood and consequence, and its AI Risk Management Framework organises work around governing, mapping, measuring and managing risks in context.[13] The field above turns that general principle into a placement decision. It asks first how an answer is formed, then how much effect that answer is allowed to carry.
The decision chain keeps unlike objects separate
An acting system passes through at least ten distinct objects: intent, identity, world state, context, reasoning, authority, action, evidence, outcome, and release and recovery. Their values may be assembled in one application, but they are not interchangeable. A language model may infer intent from a message. It should not infer identity from writing style. A context compiler may assemble policy clauses. It does not grant authority. A tool may accept an API call. Acceptance is not an observed business outcome.
The certainty gradient applies separately at each object. Identity may come from a deterministic authentication service. World state may require a fresh authoritative read. Reasoning may remain probabilistic. Authority may be a typed permit with scope and expiry. Action may be a schema-validated proposal. Evidence may be an append-only decision receipt. Outcome needs an effect receipt or readback. Release and recovery decide whether the observed effect can stand, must be compensated, or requires escalation.
Deterministic control is not the absence of probabilistic reasoning. It is the external enforcement of the things that must remain true even when reasoning is wrong: identity, scope, freshness, amount limits, idempotency, evidence capture and recovery semantics.
flowchart LR A["The same answer, three<br/>different systems"] --> B["Two gradients, not one ladder"] B --> C["Find the least expressive<br/>sufficient mechanism"] C --> D["Calibration, abstention and<br/>people are measured mechanisms"] D -. "re-test" .-> A classDef first fill:#0a1424,stroke:#7B4CD8,stroke-width:2px,color:#e6f3ff classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff class A first class B,C,D step
Find the least expressive sufficient mechanism
Mechanism selection should begin with a subtraction. Remove what an authoritative source already knows. Perform calculations whose inputs and operations are defined. Apply explicit constraints that have an owner and effective version. Only then inspect the residual. The residual may be a bounded classification problem, an open synthesis problem, a value conflict or a request for accountable judgement.
This order is not a moral ranking in which rules are good and models are suspect. It is a way to limit unnecessary degrees of freedom. A calculator cannot decide to reinterpret addition. A policy engine cannot silently replace the permitted threshold with a plausible alternative. A classifier can represent statistical boundaries that are cumbersome to write as rules. A language model can combine evidence and language across a much larger answer space. A person can bring unrecorded context, moral judgement and accountable authority, while also bringing fatigue, bias and inconsistency.
A second thought experiment: change only the evidence
Keep the requested action constant: prepare a £37.40 refund. In world A, an authoritative ledger exposes two identical settled transaction identifiers, a recorded service failure and a policy table that maps the failure to full reimbursement. The amount belongs to a query, calculation and rule check. Asking a language model to infer it from a prose summary introduces extra routes to the same answer and extra routes to a wrong one.
In world B, the customer sends a photograph of a handwritten receipt, the merchant name has changed, part of the amount was paid with a voucher, and the applicable policy allows discretion where evidence is incomplete. The action has not changed, but the evidence has. Extraction may need a vision model, entity matching may need a classifier, the explanation may need language-model synthesis, and the discretionary exception may need a person. The mechanism follows the evidence structure, not the business noun “refund”.
A minimal worked example: six different operations in one sentence
Consider the request, “Please refund the duplicate £18 subscription and tell the customer why.” A system that treats this as one prompt hides six operations:
- Resolve the authenticated customer and permitted account through identity services.
- Read current transaction state and detect whether two entries share the authoritative reference.
- Calculate the eligible amount from settled value, prior reversals and policy limits.
- Apply the refund policy, including exclusions and approval thresholds.
- Draft a customer explanation grounded in the decision receipt.
- Release the refund through a typed action, then read back the observed effect.
Only the fifth operation clearly benefits from open language generation. The duplicate test may be a query or classifier depending on data quality. The calculation and policy check should remain inspectable. The release needs authority and idempotency. Decomposition is worthwhile here because each sub-decision has a different truth source and failure mode. It would be ceremony if all six operations shared the same evidence, consequence and recovery semantics.
Negative control: determinism without truth
A deterministic mechanism can be consistently wrong. Suppose a rule says that customers in jurisdiction J receive a fourteen-day cancellation period. The rule is perfectly repeatable, its tests pass, and the implementation has no stochastic variance. Yet the customer record contains an obsolete jurisdiction, or the policy version changed yesterday. The result is deterministic and false.
This negative control prevents “deterministic-first” from turning into a slogan. The real first step is authoritative and temporally valid evidence. World state needs source identity, observed time and freshness. Policy needs version, effective time and supersession. The pre-effect check must confirm that the state used for the decision still holds. If those conditions fail, adding a stronger model does not fix the evidence, and adding more rules merely automates the stale assumption.
The strongest objection: one model may be simpler overall
A capable end-to-end model can sometimes outperform a hand-built pipeline. It may avoid brittle handoffs, use interactions that a decomposition destroys and reduce the number of separately operated components. That is a serious competing explanation. The certainty gradient should not reject it by definition.
The test is empirical and system-level. Run the end-to-end model as a challenger against the decomposed baseline. Compare selective risk at equal coverage, severe-tail performance, shift behaviour, latency, operating cost, traceability, failure recovery and effect controls. If the unified model produces lower total unrecovered loss and equal or better operating evidence for a bounded population, then decomposition has not earned its complexity. It can be removed.
Even then, a model that proposes an action does not need ambient authority to execute it. Identity, current state, policy, action schema, exposure limits, idempotency, effect readback and compensation remain independently testable responsibilities. The thesis is about evidence-fit and action rights, not about maximising component count.
A matched experiment that could prove the gradient wrong
The thesis makes a falsifiable prediction. After authoritative evidence, defined calculations and explicit constraints are exposed, a restricted mechanism should match or beat a more expressive mechanism on the cases it accepts, while creating less verification and recovery burden. Mechanism names do not establish that result. A rule engine with hundreds of interacting exceptions may be worse than one carefully bounded model, and a decomposed pipeline may lose interactions that an end-to-end system retains.
Build the comparison on a public or synthetic case set with a frozen decision definition. Partition it by event time rather than random row alone, so later cases can reveal vocabulary, policy or population change. Record the same authoritative fields, raw evidence, gold disposition, severity class and recovery outcome for every case. Then compare three arms under the same read-only release gate: a single end-to-end language-model proposal; a decomposed path of query, calculation, rules, selective classifier and language-model residual; and an independent human-first baseline. Holding release rights constant prevents a safer action policy from being mistaken for a better reasoner.
| Measure | Why it is needed | Comparison condition |
|---|---|---|
| Selective risk and coverage | Tests accepted-case quality without rewarding universal abstention | Compare at matched coverage and named slices |
| Severe-tail loss | Prevents harmless majority cases from hiding consequential errors | Use the same severity and recovery schedule |
| Shift degradation | Tests whether confidence remains meaningful after population change | Freeze thresholds before the later-time set |
| Operating evidence | Measures whether a result can be reconstructed and challenged | Require source, version, rationale and decision receipt |
| Total decision cost | Includes review, retries, rule maintenance and recovery, not inference alone | Price the same service level and failure horizon |
Add one causal intervention. Run each arm first with the authoritative duplicate-transaction identifier exposed, then with that field withheld while all other evidence remains. The gradient predicts a sharp placement change. With the identifier, query and calculation should dominate. Without it, a classifier or language model may earn value by resolving the residual. If the end-to-end model remains equally accurate in both conditions, inspect whether it reconstructed the missing fact from a leakage path rather than concluding that authoritative state was unnecessary.
Run failure injection after the clean comparison. Supply a stale policy version, duplicate the action request, time out the target after command acceptance, and change the account state between proposal and release. These tests should not be scored as language quality. They test whether the surrounding system preserves freshness, idempotency, unknown-outcome handling and effect verification. A model can win the proposal benchmark and still lose the operating comparison.
An observation that would weaken this paper’s thesis is clear. If the unified model shows lower selective risk at equal coverage, smaller severe-tail loss, better shift stability, fewer handoff defects and lower total decision cost, while producing equally reconstructable evidence behind the same deterministic authority kernel, then decomposition has not earned its place for that population. Keep the unified model. The certainty gradient is a challenger discipline, not a presumption that more components are safer.
Calibration, abstention and people are measured mechanisms
The middle of the field contains the most tempting shortcuts. A classifier returns 0.93, so the team calls it confident. A language model says “high confidence”, so a reviewer sees little reason to challenge it. A human signs the recommendation, so the workflow is described as human-controlled. None of those labels establishes the performance of the combined decision system.
Selective prediction gives a cleaner language. Chow’s classical reject-option analysis treated error and rejection as a trade-off rather than forcing a prediction on every case.[1] Modern selective-classification work measures coverage, the share of cases accepted, and selective risk, the error rate within those accepted cases.[4] A useful system therefore states, “At this threshold we automated 42 per cent of this defined population, with 0.7 per cent observed error and these slice limits,” rather than “The model is 96 per cent accurate.”
coverage = accepted cases ÷ all cases Both denominators must name the population, period and slices. A threshold without those boundaries is not portable evidence.
Calibration is necessary, and it is not enough
A probability is calibrated when predictions near a stated probability are correct at roughly that frequency. Brier’s proper score evaluates probabilistic forecasts through squared error.[2] Guo and colleagues found that the modern neural networks they evaluated could be poorly calibrated and that temperature scaling often improved calibration on their tested datasets.[3] Calibration makes thresholds interpretable. It does not guarantee that confidence ranks errors perfectly, nor that the relationship survives a changed population.
Ovadia and colleagues’ large-scale study found that predictive uncertainty and post-hoc calibration could degrade under dataset shift, with some ensemble approaches performing more strongly than alternatives across their experiments.[6] More recent selective-classification research explicitly treats shifted and out-of-distribution samples rather than assuming deployment matches training.[12] The operational conclusion is narrow: calibrate on the intended population, measure risk-coverage by slice, monitor shift, and send invalidated populations back to shadow mode.
Language-model confidence needs semantic and task evidence
Free-form generation complicates confidence because many strings can express the same answer. Token likelihood can be high for fluent wording while the underlying claim is false, and low because several equivalent phrasings compete. Work on semantic uncertainty groups answers by meaning before estimating uncertainty, and reported stronger prediction of question-answering accuracy than comparable baselines in its experiments.[11] That is useful evidence for an uncertainty signal. It is not a universal certificate for tool use.
For an operational decision, the system still needs task-specific outcome labels or verifiers. A claim-support checker can test whether cited evidence entails the proposal. A calculator can independently recompute numbers. A policy service can evaluate constraints. A model can sample alternative hypotheses. Each signal may improve error ranking. The final acceptance threshold must still be calibrated against observed correctness for the defined case population and must be invalidated when that population moves.
A person is a fallible, context-rich mechanism
Deferring everything difficult to a person is not the same as solving it. Learning-to-defer research treats the downstream expert as another predictor whose strengths and errors vary by case.[7][8] The useful question is not “Is a human in the loop?” It is “Does this reviewer add independent information, better comparative accuracy, normative judgement or accountable authority on this slice?”
Human review can also amplify a wrong recommendation. In mixed-method studies across three tasks, Bansal and colleagues found that explanations increased acceptance of AI recommendations regardless of correctness and did not increase complementary performance over recommendations with confidence in their setting.[9] This does not show that explanations are generally harmful. It shows that a rationale and a signature cannot be assumed to provide independent verification.
A reviewer design should therefore measure at least four quantities: accuracy without assistance, accuracy with the proposal, correction of model errors, and introduction of new errors. Review queues also need capacity and time evidence. A person who must process hundreds of apparently high-confidence cases may supply ceremony rather than challenge. The system should expose disagreement, missing evidence and counter-hypotheses, not merely a fluent rationale that encourages acceptance.
Selective classification can trade coverage for lower risk, calibration can make probabilities more interpretable, and learning-to-defer can model a fallible expert. The cited results are task- and distribution-bound. None establishes a general confidence threshold for language-model agents.
Turn placement into an operating control
A journey-level label such as “automated complaint handling” is too coarse to govern. The journey contains retrieval, calculation, policy interpretation, classification, drafting, approval and effect verification. Each operation has its own population, truth source, risk evidence and action right. The practical unit of approval is therefore a decision population plus an action class.
A production-shaped worked example
Return to the duplicate-charge complaint, now as a complete synthetic workflow. Intent is inferred from the message and confirmed if two plausible intents remain. Identity is resolved outside the model. World state is read from the servicing and payment systems with version identifiers. Context is compiled from the applicable product and complaint policy. Reasoning produces a category, evidence map and proposed next action. Authority is evaluated against customer, amount, purpose and delegation. The action is typed and idempotent. Evidence records the proposal and policy decision. Outcome is obtained through readback. Release and recovery decide whether to stand, retry, compensate or escalate.
| Decision | Lowest sufficient mechanism | Release gate | Evidence retained |
|---|---|---|---|
| Resolve customer and account | Identity and entitlement service | No model override | Principal, purpose, scope, expiry |
| Read duplicate transaction state | Authoritative query plus reference match | Internal observation only | Source, version, observed time |
| Infer complaint intent from free text | Calibrated classifier with abstention | Auto-route only on validated slices | Coverage, selective risk, cited spans |
| Calculate refund amount | Deterministic calculation | Bound by policy and exposure limit | Inputs, formula, calculation hash |
| Apply eligibility and complaint obligations | Versioned policy rules | Permit, review or deny | Policy version, reasons, obligations |
| Draft explanation | Language model grounded in receipt | Prepare only, no release right | Claims, sources, model configuration |
| Issue refund | Typed action gateway | Automatic only within approved reversible budget | Capability, idempotency key, effect receipt |
| Close complaint | Workflow transition after obligations | Named authority where consequence requires | Approver, completed obligations, closure readback |
The placement decision record
A workflow diagram shows where a component runs. It rarely preserves why a population was assigned to that mechanism, what evidence supports the threshold or what change invalidates the decision. A placement record should travel with each material step. It names the population, exclusions, authoritative sources, expert agreement, baseline mechanisms, calibration and selective-risk evidence, tail slices, action class, authority, recovery path, change triggers, owner and expiry.
The record also separates two thresholds that teams often merge. The acceptance threshold decides whether a prediction is good enough for the next stage. The release condition decides whether the resulting action may occur. A complaint category can be accepted at a validated classifier threshold while the associated closure remains review-only. The first is a measurement decision. The second is an authority and consequence decision.
Mechanism placement tool
This runnable browser artefact uses synthetic inputs and makes no network calls. Choose a preset or alter the evidence and consequence fields. Expected positive case: deterministic calculation with typed automatic release. Expected negative case: a language-model proposal inside a human-led decision, with named approval or dual control.
Mechanism
Calibrated classifier with abstention
The problem has bounded labels, representative data and high expert agreement, while explicit rules do not fully cover the residual.
Release gate
Automatic only for reversible action
Observed risk is modest, but shift exposure requires readback, rollback and a monitored exposure limit.
The tool is deliberately conservative about missing evidence. It will not recommend a classifier simply because labels are bounded; it also asks for representative labelled evidence and expert agreement. It will not grant automatic release merely because the mechanism is deterministic; severity, recoverability, coupling and accountable judgement can still force review. Its harm index is a comparison aid, not a universal threshold.
Movement down the gradient must be earned
Teams often treat automation as a maturity ladder: begin with human review and move steadily toward autonomy. The certainty-consequence field permits movement in either direction. A classifier can move left toward rules when stable features and policy become explicit. It can move right toward language-model synthesis when a new population contains open evidence. A release gate can move upward after a policy change or downward after recovery improves. Placement is a current evidence claim, not a permanent rank.
Use a challenger period before changing action rights. Run the proposed mechanism beside the current path without releasing its effects. Compare coverage, selective risk, high-confidence wrong cases, slice performance, human correction, cost and latency. Inject stale state, missing evidence, tool timeout, duplicate submission, policy unavailability and partial completion. Set a rollback threshold before the challenger starts. A successful average is insufficient if severe-tail cases fail.
Rudin’s argument for interpretable models in high-stakes decisions supports testing whether a simpler model can achieve the required performance rather than defaulting to a black box and explaining it afterwards.[10] The NIST Generative AI Profile similarly treats governance, provenance, pre-deployment testing and incident disclosure as primary considerations for generative-AI risk management.[14] The PRA’s current SS1/23 expects in-scope banks to manage model identification, governance, development and use, independent validation and mitigants, including AI where applicable.[15] These sources do not prescribe this placement tool. They establish why context, measurement, validation and mitigants need an operating record.
Human oversight also needs design rather than decoration. Article 14 of the EU AI Act addresses human oversight for high-risk AI systems, aiming to prevent or minimise relevant risks.[16] A queue that presents a fluent recommendation with no disagreement signal, no time and no power to stop the effect may satisfy a process diagram while failing the practical purpose. The placement record should state what the person can observe, challenge, veto and recover.
Organisations that approve bounded decision populations and action classes, rather than approving an “agent” as one object, will change systems faster with less uncontrolled exposure. This is testable through approval lead time, incident rate, rollback quality and the proportion of changes handled inside pre-agreed envelopes.
Explicit failure boundary
The certainty gradient ceases to justify automation when correctness cannot be operationally defined, evidence cannot be kept current, severe-tail loss cannot be bounded, or no mechanism and reviewer demonstrate acceptable selective risk. In that region, the correct move is to narrow the claim, collect evidence, improve reversibility or decline the action right.
The method also loses value when decomposition creates more error than it removes. Handoffs can drop context, duplicate transformations and produce inconsistent versions. The placement record must therefore include end-to-end outcome tests, not only component scores. If a unified proposal path wins those tests for a bounded population, keep it. If a human reviewer adds no measured lift and carries no required authority, remove performative review. The instrument serves the decision, not the other way round.
stateDiagram-v2 [*] --> Claim state "A thought experiment: change<br/>only the effect" as Claim state "The action gate compares<br/>unrecovered harm" as Test state "The decision chain keeps<br/>unlike objects separate" as Revision Claim --> Test: expose mechanism Test --> Decision: evidence survives Test --> Revision: rival survives Revision --> Claim: narrow or rebuild Decision --> [*]
Compact glossary
- Residual ambiguity
- Uncertainty remaining after authoritative state, defined calculation and explicit constraints have been applied.
- Selective risk
- The observed error rate among cases accepted by a mechanism at a stated operating point.
- Coverage
- The share of the defined population accepted rather than abstained or deferred.
- Model proposal
- A probabilistic recommendation that has not acquired action authority merely by being generated.
- Action gate
- The deterministic decision that permits, reviews or denies a typed effect in current context.
- Effect receipt
- Durable evidence of what the target system actually changed, distinct from command acceptance.
- Placement record
- A versioned control artefact stating why a population uses a mechanism and release gate, what invalidates the evidence and who owns the decision.
Implementation logic and built-in test cases
The browser tool implements the following readable decision logic. It operates only on synthetic user inputs. It does not estimate real model risk, satisfy a regulation or replace a validation study.
choose mechanism from evidence form:
authoritative state → query
defined transformation → calculation
complete explicit constraints → rule engine
bounded labels + representative labels + agreement → calibrated classifier
open synthesis + meaningful expert agreement → language-model proposal
otherwise → human-led decision or evidence gathering
choose release independently:
accountable judgement, severe consequence, or near-irreversibility → named approval
elevated unrecovered-harm index → review before effect
moderate harm or shift exposure → reversible release with readback and rollback
otherwise → typed automatic action inside exposure limitsThe positive built-in case is a structured duplicate-transaction reconciliation. The expected result is deterministic calculation and typed automatic release. The negative case is a high-consequence, low-recoverability source-of-funds judgement. The expected result is a language-model proposal inside a human-led decision, with named approval or dual control.
Method note for the synthetic risk-coverage figure
Figure 5 uses 10,000 synthetic binary cases from a fixed seed. A confidence score is correlated with correctness in the base population. The shifted population reduces correctness, especially in low-score regions and the apparently safest high-score tail. Cases are sorted by score, then selective risk is measured at coverage from 10 to 100 per cent. The chart is an explanatory counterexample, not a benchmark.
Spend uncertainty where it changes the decision
The certainty gradient changes one architecture habit. Do not begin by asking where to put the language model. Begin by asking what the system already knows, what it can calculate, what policy can decide, what uncertainty remains and what effect the answer may carry. That sequence prevents both over-modelled lookups and under-modelled judgement.
The mechanism should be the least expressive one that preserves decision-relevant uncertainty. Query facts rather than reconstructing them. Calculate defined quantities rather than narrating them. Enforce explicit constraints rather than hoping they are remembered. Use calibrated classification for bounded statistical distinctions. Use language models for open synthesis and proposal. Use people where they add independent context, value judgement or accountable authority, and measure whether they actually do.
The release gate should be set separately. Selective risk is population-bound. Consequence, recoverability and coupling determine how much error the action can carry. Identity, world state and policy must be fresh. A typed contract restricts the effect. A decision receipt preserves the basis. An effect receipt proves the outcome. Release and recovery decide what happens when reality differs from the proposal.
The practical decision is therefore narrower than “automate or do not automate”. It is: which population has earned which mechanism, at what coverage, for which action class, under what authority and recovery evidence? Record that answer, give it an expiry and challenge it with cheaper, simpler or safer alternatives. A lower-cost placement is earned by evidence, and a higher action right is earned independently by controlled consequence.
sequenceDiagram participant Q as Question participant M as Mechanism participant E as Evidence participant D as Decision Q->>M: The same answer, three different systems M->>E: A thought experiment, change only the effect E-->>M: compare rival explanations E->>D: Sources and evidence limits D-->>Q: revise scope or act
Sources and evidence limits
The article combines published research, official risk and regulatory material, and practitioner synthesis. Synthetic figures and scenarios expose the mechanism; they are not deployment results. Thresholds in the interactive tool are illustrative and require local validation.
- C. K. Chow, “On Optimum Recognition Error and Reject Tradeoff”, IEEE Transactions on Information Theory, 1970. Primary paper.
- Glenn W. Brier, “Verification of Forecasts Expressed in Terms of Probability”, Monthly Weather Review, 1950. Primary paper.
- Chuan Guo, Geoff Pleiss, Yu Sun and Kilian Q. Weinberger, “On Calibration of Modern Neural Networks”, ICML, 2017. Primary paper.
- Yonatan Geifman and Ran El-Yaniv, “Selective Classification for Deep Neural Networks”, NeurIPS, 2017. Primary paper.
- Yonatan Geifman and Ran El-Yaniv, “SelectiveNet: A Deep Neural Network with an Integrated Reject Option”, ICML, 2019. Primary paper.
- Yaniv Ovadia and colleagues, “Can You Trust Your Model’s Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shift”, NeurIPS, 2019. Primary paper.
- David Madras, Toniann Pitassi and Richard Zemel, “Predict Responsibly: Improving Fairness and Accuracy by Learning to Defer”, NeurIPS, 2018. Primary paper.
- Hussein Mozannar and David Sontag, “Consistent Estimators for Learning to Defer to an Expert”, ICML, 2020. Primary paper.
- Gagan Bansal and colleagues, “Does the Whole Exceed its Parts? The Effect of AI Explanations on Complementary Team Performance”, CHI, 2021. Primary paper.
- Cynthia Rudin, “Stop Explaining Black Box Machine Learning Models for High Stakes Decisions and Use Interpretable Models Instead”, Nature Machine Intelligence, 2019. Primary perspective.
- Lorenz Kuhn, Yarin Gal and Sebastian Farquhar, “Semantic Uncertainty: Linguistic Invariances for Uncertainty Estimation in Natural Language Generation”, ICLR, 2023. Primary paper.
- Hengyue Liang, Le Peng and Ju Sun, “Selective Classification Under Distribution Shifts”, 2024. Primary paper.
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. Official framework.
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1. Official profile.
- Prudential Regulation Authority, SS1/23 Model Risk Management Principles for Banks, current version effective 23 April 2026. Official supervisory statement.
- European Union, Regulation (EU) 2024/1689, Article 14 on human oversight, consolidated text. Official legislation.