flowchart TD
  A["The missing hundred"] --> B["On this page"]
  B --> C["The model is one gate"]
  C --> D["Fairness metrics are policy<br/>choices expressed as equations"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#D95545,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

The model is one gate

Most fairness dashboards begin after a dataset has been assembled. They compare predictions with labels, split by a protected attribute, and calculate rates. Those calculations can be correct while answering a narrower question than the organisation believes.

A consequential decision usually starts earlier. Someone must know that an opportunity exists, reach an application route, satisfy an identity or eligibility screen, provide evidence in an accepted form, appear in a retrieval result, receive a score, survive a policy rule, obtain review capacity, and execute the approved outcome. An appeal or correction route may reopen the path. Every transition changes the effective population.

A serial gate has exact accounting

Let S0=1 denote membership in the in-scope population. Let Sk=1 mean that a person has passed stage k. Let Q=1 denote the legitimate positive condition, such as being able to repay under the offered terms. For group g, end-to-end opportunity through K serial gates is:

The symbols do modest work. A is the group attribute used for audit; it is not presumed to cause the result. Each factor asks what fraction of qualified survivors pass the next gate. The product returns the fraction of qualified people in the original scope who receive the final positive decision.

Compare group b with reference group a. Taking logarithms turns multiplication into an additive ledger:

If both groups pass a stage at the same conditional rate, that stage contributes zero to the log gap. A rate ratio below one contributes a negative amount. This does not establish why the gap exists or whether it is unlawful. It prevents the gap from disappearing inside changing denominators.

Worked example: one fair model, two unequal decisions

The opening case can be read as expected counts. Begin with 10,000 people in each group, of whom 6,000 are qualified under the same ground-truth definition. Atlas supplies usable evidence for 5,700 qualified people; Beacon supplies it for 4,200. The shared retrieval process keeps 90 per cent. The model then correctly recommends 80 per cent of the qualified cases it sees, and review confirms 95 per cent of those recommendations.

Every row after evidence preserves the inherited ratio because the conditional transition is equal. The model’s audit population begins at 5,130 and 3,780, so it correctly sees identical 80 per cent true-positive rates. The decision audit begins at 6,000 and 6,000, so it sees 64.98 per cent and 47.88 per cent end-to-end opportunity.

This distinction also explains why a fairness dashboard needs both conditional and population views. Conditional rates identify the stage where behaviour differs. Population rates show the accumulated consequence. Reporting only the first can hide attrition; reporting only the second can blame the wrong component.

Thought experiment: move only the scanner

Imagine the same lender runs two branches. Every policy, model and reviewer is shared. In Branch One, applicants upload payroll PDFs directly. In Branch Two, staff photograph printed records under uneven lighting. Move only the document scanner from Branch One to Branch Two. If the opportunity gap follows the scanner, model retraining becomes an implausible first remedy.

Now keep the scanner fixed and swap applicant populations between branches. If the gap remains with the branch process, the evidence points towards channel quality or operating practice. If it follows a particular document type, the construct may be measured less reliably for people whose income is expressed that way. One causal feature changes at a time.

This experiment illustrates the lifecycle view developed by Suresh and Guttag, who distinguish sources of downstream harm across data collection, development and deployment rather than reducing bias to training data.[1] NIST likewise separates systemic, computational and statistical, and human-cognitive bias.[2]

Fairness metrics are policy choices expressed as equations

A metric does not discover fairness by itself. It formalises a particular concern using an observed population and label. The choice determines whose error matters, which comparison is relevant and what can compensate for what.

Hardt, Price and Srebro formalised equal opportunity and equalised odds as group criteria over predictions, outcomes and a protected attribute.[3] Dwork and colleagues instead begin from a task-specific similarity metric and require similar individuals to receive similar treatment.[4] Kusner and colleagues use causal models to define counterfactual fairness.[5] These are different claims, with different informational burdens.

Let the harm choose the first metric

Metric selection becomes clearer when the decision is stated as a harm question. In a screening programme where missing a treatable condition is the dominant concern, equal opportunity may be the first group diagnostic because it compares sensitivity among people who have the condition. It does not settle whether the programme reaches both groups, whether the clinical label is measured equally, or whether false positives impose unequal follow-up burdens.

In a scarce apprenticeship programme, allocation may be the immediate policy object. Demographic parity can reveal who receives places, but it says nothing about whether the qualification construct reflects the skills the programme could develop. A representation target might be defensible as a temporary corrective policy, yet it should be described as an allocation choice rather than evidence that the score became intrinsically fair.

In a fraud queue, reviewers consume a ranked list. Exposure, false-positive burden and delay may matter more than a binary threshold measured after review. Equal average scores would be a weak control if one group’s cases are consistently placed at the top and subjected to more intrusive investigation. The correct unit may be attention minutes, holds, escalations or customer friction.

These examples show why there is no universal ordering of fairness metrics. The first metric should correspond to the first material harm, then be accompanied by checks for reach, measurement, competing errors and remedy. Formal criteria make the chosen concern testable. They do not remove the obligation to justify the concern.

Why several attractive criteria conflict

Suppose two groups have different observed base rates for the labelled outcome. A calibrated risk score means that a score of 0.2 corresponds to the same observed event rate in both groups. Equalised odds requires equal error rates at the chosen decision threshold. In general, a non-perfect score cannot satisfy all calibration and error-balance conditions when base rates differ. Kleinberg, Mullainathan and Raghavan prove a related incompatibility among three risk-score conditions; Chouldechova derives the tension for recidivism instruments.[6][7]

The impossibility result transfers the burden from optimisation to governance. A team must state which harm it is controlling and why that choice fits the decision. Selecting whichever metric looks best after training is outcome shopping.

A serious negative control

Now give both groups identical stage treatment and identical true-positive and false-positive rates, but set observed qualification prevalence to 60 per cent in one group and 40 per cent in the other. Their final selection rates will differ. That difference may arise from historical injustice, label distortion, a legitimate scope distinction or some combination. The rate alone cannot decide which.

This is the necessary negative control for a pipeline audit: an observed disparity is not proof that the measured component caused unfair treatment. Corbett-Davies and colleagues argue that equitable system design requires context-specific consequences rather than automatic allegiance to an axiomatic metric.[8] The audit must test rival explanations, including whether the label and population represent the policy goal.

The label is already a theory

“Creditworthy”, “high potential”, “likely fraud” and “needs support” are not directly observed substances. They are constructs operationalised through measurements. Repayment may reflect product terms, income volatility, collection practices and access to refinancing. Past promotion may reflect opportunity and managerial judgement. A label can be reliable in repetition and still invalid for the construct the decision claims to measure.

Jacobs and Wallach use measurement modelling to show how mismatches between a theoretical construct and its operationalisation create fairness harms.[9] This is why changing a fairness metric cannot repair a target that encodes the wrong concept.

Where disparity enters, compounds and changes form

The pipeline view does not mean every stage deserves the same test. Each stage creates a different object and therefore a different failure mode. The useful question is: what relation should this stage preserve, and what harm follows when it does not?

Access and data determine who can become a case

Access failures include language, disability, device, location, timing, awareness and the cost of supplying evidence. If a service begins its denominator at “completed applications”, it treats abandonment as outside the system. That may be operationally convenient and substantively wrong.

Data then converts lives into variables. Sampling can under-represent a group. Features can measure the same construct with different error. Labels can inherit previous decisions. Aggregation can force distinct subpopulations into one relation. Buolamwini and Gebru’s intersectional evaluation of commercial gender classifiers showed how aggregate accuracy concealed far larger errors for darker-skinned women than for lighter-skinned men.[10] The enduring lesson is methodological: test intersections where the mechanism suggests different error, rather than assuming one protected axis at a time is sufficient.

Retrieval and ranking allocate evidence and attention

Retrieval is often described as a neutral prelude to reasoning. In a decision pipeline it allocates visibility. A candidate outside the top k, a policy document not retrieved, or a weak entity match cannot influence the next stage. Singh and Joachims formalise fairness in ranking as the allocation of exposure, making clear that relevance and attention are distinct quantities.[11]

For a hiring assistant, audit recall of qualified candidates before auditing the ranking of retrieved candidates. For a credit investigation, audit whether contradictory or exculpatory evidence appears with comparable probability and authority. For a language-model workflow, inspect whether context truncation, chunking or query formulation removes evidence unevenly across document types.

Models and thresholds distribute error

The model stage is where familiar group metrics are most useful. Report confusion matrices by relevant groups and intersections, calibration with uncertainty, abstention, and performance under realistic shift. Keep the score separate from the decision threshold. A score may be calibrated while the threshold creates an unacceptable error burden. Conversely, a threshold may equalise one error rate while damaging calibration or another error rate.

Removing a protected attribute is not a general solution. Other features can act as proxies, and the protected attribute may be needed to detect or correct unequal performance. The right question is whether a feature, pathway or decision rule is justified for the specific purpose, with legal and ethical review where required.

Tools and policy rules can reverse a model result

A compound system may call income calculators, identity services, sanctions screens, pricing engines or eligibility rules after scoring. These components are frequently deterministic, which makes them auditable, not automatically fair. A postcode rule, minimum document age, name-matching threshold or exception policy can have group-specific reach and consequences.

Audit the effective decision function, including rules that dominate the model. A perfectly balanced score is irrelevant when a later rule rejects all applicants with a form of evidence concentrated in one group.

Human review changes the joint system

Human oversight can catch model errors, interpret context and preserve accountable judgement. It can also introduce anchoring, automation bias, inconsistency, capacity constraints and differential willingness to override. Green and Chen’s work on algorithm-in-the-loop decision making centres the actual interaction between people and risk assessments rather than assuming the human is a corrective oracle.[12]

Measure who is referred to review, what evidence reviewers see, override direction, time spent, requests for more information, agreement on blind cases and outcomes after appeal. If one group reaches review mostly through borderline adverse cases while another reaches it through random quality sampling, raw override rates are not comparable.

Intersections, uncertainty and missing group data

Single-axis averages can conceal a mechanism concentrated at an intersection. Document extraction may work well across gender in aggregate and across language in aggregate, yet fail for older applicants using one language through a low-resolution mobile channel. The relevant slice is suggested by the failure mechanism, not by an unlimited search for the worst cell.

Intersectional analysis creates a statistical burden. As cells shrink, point estimates become unstable and the apparent worst group changes across samples. Report raw counts, intervals and suppression rules. Use hierarchical or pooled estimates where appropriate, but retain the distinction between a modelling assumption and observed evidence. A small group deserves protection; it does not deserve a confident percentage invented from three cases.

Protected attributes may be unavailable, inaccurate or restricted. That limitation should be recorded in the assurance case. Operational slices such as channel, evidence type, disability accommodation request, language route or service location can reveal quality-of-service mechanisms, but they are not substitutes for every protected group. Proxy inference can create fresh privacy and classification harms. Where direct fairness measurement is lawful and necessary, sensitive attributes should be purpose-bound, access-controlled and separated from operational decision use.

Selbst and colleagues warn that abstraction can detach a technical fairness solution from the social system in which it acts.[15] The practical response is not to abandon metrics. It is to bind each metric to the institutional process, people and remedy it is meant to improve.

Outcome and remedy complete the path

An approval that never reaches the system of record is not a benefit. An adverse decision with an inaccessible appeal route is not fully characterised by its initial confusion matrix. Observe execution, pricing or terms, delay, abandonment after approval, appeals, corrections and downstream outcomes. Where the decision changes future data, monitor feedback loops: previous denials can reduce later evidence, opportunity or labels.

Thought experiment: two routes to the same parity

Return to the opening case. Intervention A repairs evidence capture for the second group from 70 to 95 per cent. Intervention B leaves evidence capture untouched but lowers the downstream threshold so that every qualified person who reaches the model is approved, while false positives rise from 10 to 18 per cent at the model stage.

The threshold patch improves the final selection ratio, yet it cannot recover people whose evidence never entered the model. It also raises the second group’s end-to-end false-positive rate above the first and lowers positive predictive value. The upstream repair restores opportunity without purchasing parity through extra erroneous approvals. Equal-looking output rates can encode different causal stories and different people harmed.

stateDiagram-v2
  [*] --> Claim
  state "A serial gate has exact accounting" as Claim
  state "Worked example: one fair<br/>model, two unequal decisions" as Test
  state "Thought experiment, move only<br/>the scanner" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Audit the decision, then choose the intervention

An end-to-end fairness programme needs more than a longer metric dashboard. It needs an explicit contract that fixes the meaning of the claim before results are inspected, plus evidence that lets a reviewer trace disparity to stages without mistaking arithmetic attribution for causal proof.

The fairness contract

The contract is a small governance artefact. It should be approved by the decision owner, domain and legal or policy specialists, measurement experts, system builders and people able to represent affected experience. At minimum it records:

1. Decision and authority. What benefit, burden, rank, price, route or escalation is being decided, and who remains accountable?
2. Population and denominator. Who could reasonably be affected, who enters each stage, and which exclusions are intentional?
3. Construct and label. What property is the system trying to estimate, how is it observed, and where can measurement differ?
4. Harm and fairness claim. Which allocation, error, exposure, treatment, quality-of-service or remedy concern is primary?
5. Groups and intersections. Which legally or ethically relevant slices can be measured lawfully and with adequate statistical power?
6. Metric and threshold. Which quantity operationalises the concern, what uncertainty is acceptable, and which criteria are deliberately not being guaranteed?
7. Path and intervention point. Which stages can create or amplify the harm, and which owner can change each one?
8. Monitoring and remedy. What outcome, appeal, complaint, drift or incident evidence can invalidate the release claim?

NIST’s AI Risk Management Framework recommends context-specific fairness measures, disaggregation, intersectional analysis and lifecycle attention, while warning that a system with harmful bias mitigated is not necessarily fair.[13] Raji and colleagues similarly frame internal algorithmic auditing as an end-to-end organisational process whose stage records combine into an audit report.[14]

Run the audit in six passes

First, map the path. Start from the affected population and draw every gate, branch, retry, review queue, action and appeal. Name the authoritative record for each transition. A diagram without event counts is architecture; the audit needs both.

Second, preserve denominators. Record the original in-scope count and the survivor count by stage, group and relevant outcome label. Missing protected attributes, lawful-use constraints and small samples become visible limitations rather than silent blanks. Do not infer sensitive attributes merely to make a dashboard complete.

Third, measure stage relations. For each gate, compare reach, missingness, quality, exposure, TPR, FPR, calibration, abstention, rule effect, referral and override as appropriate. Report confidence intervals and raw counts. A percentage based on twelve cases should not carry the same authority as one based on twelve thousand.

Fourth, reconnect the outcome. Calculate end-to-end allocation and error from the original denominator. Verify executed state, terms, delay and remedy. Compare predicted fairness with observed operating outcomes.

Fifth, test explanations. Swap channels, replay cases under alternative evidence, blind reviewers, perturb ranking position, remove a disputed feature, hold qualification constant, or randomise a non-material presentation detail. Each intervention should separate at least two plausible causal stories.

Sixth, release a bounded claim. State which metric, groups, stages, time window and decision configuration the evidence supports. Name defeaters, monitoring limits and the owner authorised to pause or change the process.

A production-shaped credit case

A lender wants to audit a credit-assist workflow. The system ingests applications and documents, extracts income, retrieves bureau and internal records, calculates affordability, generates a risk recommendation, applies policy rules, assembles reasons and routes exceptions to an underwriter. The final decision is written to the origination platform and can be reconsidered when the applicant supplies corrected evidence.

The fairness contract sets the original denominator as complete expressions of interest meeting product scope, not only scored applications. The primary concern is opportunity among applicants who would satisfy policy under accurate evidence. Secondary concerns are false approvals, pricing differences, time to decision and reason fidelity. The audit disaggregates by lawful protected groups and by operational slices such as channel, document type and employment pattern.

The first result shows equal model TPR among scored cases. The stage ledger shows lower income-extraction success for photographed records and a higher exception-queue abandonment rate for applicants asked to resubmit evidence. Blind replay with corrected extraction removes most of the opportunity gap. A threshold intervention improves headline approvals but increases false approvals and fails to reach abandoned applicants.

The architecture decision changes. The lender funds document-quality detection, a supported resubmission path and queue service levels before changing the model threshold. It adds an end-to-end opportunity metric, an extraction-quality metric and a remedy completion metric to release evidence. Model parity remains useful, but it no longer stands in for the process.

Monitor the path after release

Pre-release evaluation freezes a population and process long enough to measure them. Production changes both. Channel mix shifts, document formats change, a policy rule is amended, review queues age and applicants adapt to requests. Fairness monitoring therefore needs leading indicators from the path as well as lagging outcome measures.

Track stage coverage, missingness, extraction confidence, retrieval recall samples, score and uncertainty distributions, rule-trigger frequency, referral rate, queue time, override direction, executed decisions, terms, appeals and corrections. Compare them by the groups and operational slices named in the contract. A sudden gap in evidence completion may be more actionable than waiting for quarterly approval rates to move.

Monitoring also needs stable controls. Keep randomly sampled cases that bypass risk-based selection, because a model-selected review stream cannot estimate its own false negatives. Re-run fixed positive, negative and boundary cases after component changes. Preserve versioned policy, model, retrieval and interface identifiers so that a disparity can be reconstructed rather than debated from screenshots.

Triggers should connect to authority. A threshold breach can pause one route, widen human review, disable a document parser, revert a ranking change or start a lookback. The response should fit the suspected stage. A global model rollback is a poor remedy for a broken scanner, and an interface adjustment cannot correct an invalid label. Monitoring earns control status only when someone can act on what it detects.

"""Synthetic fairness pipeline audit for 'Fairness Across the Decision Pipeline'.

Python 3.10+. Standard library only.
All names, rates and outcomes are synthetic teaching fixtures.

The lab demonstrates three claims:
1. A model can have equal conditional TPR/FPR while the end-to-end decision does not.
2. In a serial gate, group disparity decomposes exactly across stage transition ratios.
3. A downstream threshold patch cannot recover people excluded upstream and can worsen FPR.
"""

from __future__ import annotations

from dataclasses import dataclass, replace
from math import exp, log
from typing import Iterable


@dataclass(frozen=True)
class Rates:
    """Pass probabilities for qualified (+) and unqualified (-) people."""

    qualified: float
    unqualified: float

    def validate(self) -> None:
        for value in (self.qualified, self.unqualified):
            if not 0.0 <= value <= 1.0:
                raise ValueError(f"rate outside [0, 1]: {value}")


@dataclass(frozen=True)
class GroupPipeline:
    name: str
    population: int
    qualified_prevalence: float
    evidence: Rates
    retrieval: Rates
    model: Rates
    review: Rates

    def validate(self) -> None:
        if self.population <= 0:
            raise ValueError("population must be positive")
        if not 0.0 <= self.qualified_prevalence <= 1.0:
            raise ValueError("qualified_prevalence must be in [0, 1]")
        for stage in self.stages():
            stage[1].validate()

    def stages(self) -> tuple[tuple[str, Rates], ...]:
        return (
            ("evidence", self.evidence),
            ("retrieval", self.retrieval),
            ("model", self.model),
            ("review", self.review),
        )


@dataclass(frozen=True)
class Metrics:
    end_to_end_tpr: float
    end_to_end_fpr: float
    selection_rate: float
    positive_predictive_value: float
    model_conditional_tpr: float
    model_conditional_fpr: float


def product(values: Iterable[float]) -> float:
    result = 1.0
    for value in values:
        result *= value
    return result


def evaluate(group: GroupPipeline) -> Metrics:
    group.validate()
    tpr = product(stage.qualified for _, stage in group.stages())
    fpr = product(stage.unqualified for _, stage in group.stages())
    prevalence = group.qualified_prevalence
    selection = prevalence * tpr + (1.0 - prevalence) * fpr
    ppv = (prevalence * tpr / selection) if selection else 0.0
    return Metrics(
        end_to_end_tpr=tpr,
        end_to_end_fpr=fpr,
        selection_rate=selection,
        positive_predictive_value=ppv,
        model_conditional_tpr=group.model.qualified,
        model_conditional_fpr=group.model.unqualified,
    )


def disparity_ledger(reference: GroupPipeline, comparison: GroupPipeline) -> list[tuple[str, float]]:
    """Return additive log-rate contributions for qualified people.

    For a serial gate:
      log(TPR_comparison / TPR_reference)
        = sum_k log(pass_k_comparison / pass_k_reference)
    """

    rows: list[tuple[str, float]] = []
    for (name_a, rate_a), (name_b, rate_b) in zip(reference.stages(), comparison.stages()):
        if name_a != name_b:
            raise ValueError("stage mismatch")
        if rate_a.qualified == 0.0 or rate_b.qualified == 0.0:
            raise ValueError("log ledger requires non-zero qualified pass rates")
        rows.append((name_a, log(rate_b.qualified / rate_a.qualified)))
    return rows


def pct(value: float) -> str:
    return f"{100.0 * value:6.2f}%"


def print_comparison(title: str, atlas: GroupPipeline, beacon: GroupPipeline) -> None:
    a = evaluate(atlas)
    b = evaluate(beacon)
    print(f"\n{title}")
    print("metric                         Atlas     Beacon    B/A")
    print("-" * 58)
    rows = (
        ("model TPR, conditional", a.model_conditional_tpr, b.model_conditional_tpr),
        ("model FPR, conditional", a.model_conditional_fpr, b.model_conditional_fpr),
        ("end-to-end TPR", a.end_to_end_tpr, b.end_to_end_tpr),
        ("end-to-end FPR", a.end_to_end_fpr, b.end_to_end_fpr),
        ("final selection rate", a.selection_rate, b.selection_rate),
        ("positive predictive value", a.positive_predictive_value, b.positive_predictive_value),
    )
    for label, x, y in rows:
        ratio = y / x if x else float("nan")
        print(f"{label:29} {pct(x)}  {pct(y)}  {ratio:5.3f}")


BASE_ATLAS = GroupPipeline(
    name="Atlas",
    population=10_000,
    qualified_prevalence=0.60,
    evidence=Rates(qualified=0.95, unqualified=0.95),
    retrieval=Rates(qualified=0.90, unqualified=0.90),
    model=Rates(qualified=0.80, unqualified=0.10),
    review=Rates(qualified=0.95, unqualified=0.95),
)

BASE_BEACON = GroupPipeline(
    name="Beacon",
    population=10_000,
    qualified_prevalence=0.60,
    evidence=Rates(qualified=0.70, unqualified=0.70),
    retrieval=Rates(qualified=0.90, unqualified=0.90),
    model=Rates(qualified=0.80, unqualified=0.10),
    review=Rates(qualified=0.95, unqualified=0.95),
)


def main() -> None:
    print_comparison("BASE CASE: model parity, pipeline disparity", BASE_ATLAS, BASE_BEACON)

    ledger = disparity_ledger(BASE_ATLAS, BASE_BEACON)
    total_log_gap = sum(value for _, value in ledger)
    observed_ratio = evaluate(BASE_BEACON).end_to_end_tpr / evaluate(BASE_ATLAS).end_to_end_tpr
    reconstructed_ratio = exp(total_log_gap)

    print("\nqualified-person disparity ledger (log rate ratio, Beacon / Atlas)")
    for stage, contribution in ledger:
        print(f"  {stage:10} {contribution:+.4f}")
    print(f"  {'total':10} {total_log_gap:+.4f}  -> rate ratio {reconstructed_ratio:.3f}")

    # Positive case: repair the upstream evidence channel rather than only the model.
    repaired = replace(BASE_BEACON, evidence=Rates(qualified=0.95, unqualified=0.95))
    print_comparison("POSITIVE CASE: upstream evidence repair", BASE_ATLAS, repaired)

    # Negative case: compensate downstream. It cannot recover people never observed.
    patched = replace(BASE_BEACON, model=Rates(qualified=1.00, unqualified=0.18))
    print_comparison("NEGATIVE CASE: downstream threshold patch", BASE_ATLAS, patched)

    # Attribution negative control: equal treatment with different prevalence can still
    # create a demographic-parity gap. A rate gap alone is not proof of unfairness.
    prevalence_control = replace(BASE_ATLAS, name="Beacon-control", qualified_prevalence=0.40)
    print_comparison(
        "ATTRIBUTION CONTROL: identical stages, different qualified prevalence",
        BASE_ATLAS,
        prevalence_control,
    )

    # Assertions turn the article's claims into executable checks.
    a = evaluate(BASE_ATLAS)
    b = evaluate(BASE_BEACON)
    p = evaluate(patched)
    r = evaluate(repaired)
    c = evaluate(prevalence_control)

    assert a.model_conditional_tpr == b.model_conditional_tpr
    assert a.model_conditional_fpr == b.model_conditional_fpr
    assert b.end_to_end_tpr / a.end_to_end_tpr < 0.75
    assert abs(observed_ratio - reconstructed_ratio) < 1e-12
    assert abs(r.end_to_end_tpr - a.end_to_end_tpr) < 1e-12
    assert p.end_to_end_tpr < a.end_to_end_tpr  # excluded people remain unrecoverable
    assert p.end_to_end_fpr > a.end_to_end_fpr  # compensation raises false positives
    assert abs(c.end_to_end_tpr - a.end_to_end_tpr) < 1e-12
    assert c.selection_rate != a.selection_rate

    print("\nAll assertions passed.")


if __name__ == "__main__":
    main()

The fairness decision moves upstream

A fairness metric becomes useful when it is tied to a specific benefit, harm, population and decision right. Detached from that contract, it can be precise and still function as theatre.

The pipeline view changes the architecture. Preserve the original denominator. Treat evidence capture and retrieval as allocative stages. Audit deterministic rules and human overrides. Observe the executed outcome and remedy. Keep model metrics, because they isolate important error. Refuse to let them certify stages they never measured.

The practical decision is to intervene at the earliest stage that credible evidence identifies, then replay the whole path. A threshold should not compensate for a broken evidence channel unless the organisation has consciously accepted the new error trade-off and the people excluded upstream have another route. A human review label should not satisfy oversight unless referral, information, authority and outcome are tested.

The defensible release statement is deliberately bounded: for this decision, population, configuration, time window and set of groups, the observed path meets the chosen fairness constraints within stated uncertainty, while named criteria and open harms remain outside the claim. That statement is less dramatic than “fair AI”. It is also one an accountable organisation can test, challenge, withdraw and improve.