One instruction, three points of no return

At 09:00:00, a fictional treasury control desk receives three alerts. A £250,000 urgent payment is waiting inside the bank’s own release queue. A marketable equity order with £8 million notional has reached a venue and is partly filled. A £1,200 instant transfer has already settled, but a fresh beneficiary signal now links the receiving account to a confirmed scam investigation. The same model reads all three evidence packets and returns the same sentence: “Stop the transaction and escalate.”

The sentence is useful only for the first case. The bank can still prevent the urgent payment from being submitted if the payment remains in an authorised internal state. For the equity order, a cancel request can stop only the unfilled remainder; completed executions remain trades unless a tightly bounded error process applies. For the settled instant transfer, “stop” describes a world that no longer exists. The available actions are recall, beneficiary-bank contact, account protection, customer remediation, reimbursement assessment and investigation.

Nothing about the model’s confidence explains this difference. The evidence could be identical. The amount could even be identical. What changed is the relationship between the action and its point of no return. Payment and securities infrastructures make finality explicit because participants need to know when an obligation can no longer be revoked. CPMI-IOSCO Principle 8 requires an infrastructure to define both the point of final settlement and the point after which an unsettled instruction may not be revoked.¹ The Bank of England likewise describes CHAPS as providing irrevocable payments and publishes the operational point of finality for its settlement instructions.²

The correct control question is therefore not “How confident is the model?” It is “How much of the consequence remains recoverable when the next piece of evidence arrives?” That question produces an irreversibility gradient. At one end, a recommendation can be edited with no external effect. In the middle, an action can be held, cancelled or compensated at bounded cost. At the far end, legal finality, market impact, external propagation or customer harm makes recovery partial, delayed or impossible.

Finality has a shape

A binary label such as reversible or irreversible is too coarse for system design. A payment can be editable in a user interface, committed inside a bank, transmitted to a scheme, accepted by the receiving institution and finally settled. A market instruction can be staged, routed, acknowledged, partly filled, fully filled, cleared and settled. At every boundary, a different actor may possess a different power: edit, cancel, reject, bust under a rule, compensate economically, recall funds or merely record what happened.

This means irreversibility has at least four dimensions. Operational irreversibility asks whether the current system can cancel the action. Legal finality asks whether the transfer or obligation is binding and protected from revocation. Economic recoverability asks what share of the loss can be recaptured, at what cost and after how long. External propagation asks whether another party has already acted on the result. A transfer might be legally final yet economically reimbursed. A trade might be cancelled under a clearly erroneous process but still have moved prices and triggered other orders.

Faster infrastructure compresses the space in which new evidence can matter. The European Union’s instant payments framework requires euro instant transfers to complete within seconds and includes verification of payee before initiation.³ That pre-initiation service is important precisely because the later settlement window is short. The architecture cannot assume that a richer fraud conversation will finish before the rail does. It must decide which evidence is mandatory before initiation, which controls can hold or reject, and which recovery process begins after finality.

The irreversibility equation is a design aid, not a moral calculator

A compact model helps expose the mechanism. For a proposed action a at time t, define:

• q(a|e) is the calibrated probability that the action is materially wrong given the available evidence. It is not a raw language-model confidence token.
• L(a) is the consequence if the action is wrong, including customer, market, liquidity, legal and operational loss inside the declared boundary.
• r(a,t) is the recoverable fraction at that state and time. It falls when cancellation closes, settlement completes, market impact spreads or recovery becomes uncertain.
• C_delay(a,t) is the harm caused by waiting, such as missed execution, liquidity pressure, customer abandonment or an expired fraud-intervention window.

The equation does not decide policy. It makes hidden assumptions visible. If a team says a human must approve every high-value action, the delay term asks whether review can finish before the effect. If a team says an automated action is safe because it can be reversed, the recovery term asks whether reversal is legal, complete, timely and independent of a co-operative counterparty. Hard prohibitions, rights and systemic limits sit outside the optimisation as constraints.

Three clocks, not one risk score

The equation becomes operational only when teams separate three clocks. The evidence clock measures how quickly a useful new fact can arrive, including a payee check, device challenge, sanctions result, market quote or independent approval. The effect clock measures how quickly a proposal crosses the next boundary: internal release, scheme acceptance, venue execution or settlement. The recovery clock measures how long a credible remedy remains available and how much it can restore. A control has value only if its evidence clock can beat the relevant effect clock, or if it creates a reversible state that extends that race.

These clocks do not move smoothly. Recoverability may remain high while an order is staged, fall for the filled quantity at the first execution, and fall again when related orders move the market. A payment may remain editable until transmission, then become irrevocable under the scheme’s rules even though a separate reimbursement process protects the customer. Treating r(a,t) as a continuously precise percentage would hide these state changes. A safer implementation represents a small set of sourced recovery bands, attaches uncertainty to each band and uses the conservative bound when authority is granted.

The result is a decision surface rather than one universal score. One region permits evidence gathering because the hold is genuine and its expiry is known. Another permits execution only inside a pre-approved envelope because review cannot finish in time. A third forbids execution because no acceptable recovery exists. A fourth begins after the effect, where the permitted actions are reconciliation, recall, compensation, investigation or authority withdrawal. The system should record which region it used, the state and policy version that placed the action there, and the receipt that proved what happened. Without that record, the gradient becomes an attractive diagram rather than an enforceable control.

Thought experiment: move only the point of finality

Take one £20,000 supplier payment. Keep the payer, beneficiary, fraud score, invoice, device, model, policy and human reviewer unchanged. In world A, the instruction sits in a four-hour approval queue. In world B, it is staged for thirty seconds before an instant rail. In world C, it has settled. The evidence is identical, yet the best action changes from dual approval, to a time-bounded hold or deterministic block, to recovery and investigation.

This thought experiment weakens any architecture built only around transaction value or confidence. If those variables were sufficient, all three worlds would produce the same control. They do not. The causal feature is the window in which additional evidence can still prevent the effect. The human role also changes. In world A, a reviewer can inspect the case. In world B, people must have approved the hold criteria and fallback in advance. In world C, people govern restitution, restriction and accountability rather than cancellation.

Negative control: high consequence inside a faithful simulator

Now run the same £20,000 instruction inside an operational twin that cannot reach a live ledger. The simulated consequence is large, but the live recoverable fraction is one because no effect leaves the sandbox. A model can explore, fail and retry without financial harm, provided the twin is isolated and does not leak authority. This negative control shows that consequence alone does not justify human approval. Authority follows possible effect, not dramatic language about what the simulated action represents.

flowchart TD
  A["One instruction, three points<br/>of no return"] --> B["Finality has a shape"]
  B --> C["Control moves upstream when<br/>the clock outruns the reviewer"]
  C --> D["Payments and markets share a<br/>gradient, not a workflow"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#B96D00,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Control moves upstream when the clock outruns the reviewer

“Keep a human in the loop” sounds prudent until the loop closes in ten milliseconds. A reviewer who arrives after a market fill or settlement cannot provide pre-effect authority. They can only diagnose, recover or change future policy. This does not remove human accountability. It relocates it. People approve the permitted action set, capital and credit limits, customer protections, hold durations, exception classes, degraded modes, kill conditions and release process before the event occurs.

The distinction is between synchronous human action and human-governed automation. Synchronous review is useful when the reviewer can receive the right evidence, make a decision and transmit an authorised command before finality. Human-governed automation is necessary when the deadline is shorter. In that regime, a deterministic service applies pre-approved controls at machine speed, while people own the policy, evidence standard, testing, monitoring and withdrawal of authority.

This pattern is visible in market regulation. SEC Rule 15c3-5 requires broker-dealers with market access to prevent orders that exceed pre-set credit or capital thresholds or appear erroneous, restrict access to authorised persons, and receive immediate post-trade reports.⁴ The rule places controls immediately before market entry because later review cannot prevent an erroneous order from reaching the venue. CFTC materials likewise describe order-size limits, message-rate limits, price bands, throttles and controls at firms, intermediaries and exchanges.⁵

Thought experiment: add one staging boundary

Consider two identical trading agents with the same model, prompt, market data, portfolio, target and error rate. Agent Direct sends a marketable order straight to a venue. Agent Staged writes the proposal to a deterministic gateway for twenty milliseconds. The gateway checks instrument, side, maximum notional, duplicate intent, current position, price collar, message rate and strategy state. It can reject, shrink or stage the order before submission.

Only one causal feature changed: the gateway. If the agents produce the same proposals but Agent Staged creates fewer catastrophic effects under fault injection, reliability belongs partly to the operating layer rather than the model. A recent 21-day study of language-model agents trading real assets in a bounded onchain market reported the same broad pattern: typed controls, policy validation, execution guards and trace-level observability were central to measured reliability. The authors explicitly limit their claim to one deployment and do not establish universal market safety.⁶

The staging boundary is not free. It adds latency and can reject legitimate orders. The design question is whether the control latency is smaller than the harm it prevents. The CFTC has documented the competitive pressure to remove such latency, alongside the need to protect capital and market integrity.⁵ That tension is the phase space in operational form.

Knight Capital shows why post-event intelligence can be too late

On 1 August 2012, Knight Capital’s router sent more than four million orders while attempting to fill 212 customer orders. It traded more than 397 million shares and accumulated unwanted positions that produced a loss above $460 million in the first 45 minutes. The SEC found, among other failures, that Knight lacked an adequate control immediately before order submission and did not have controls capable of preventing aggregate exposure beyond preset capital thresholds.⁷

The lesson is not that a smarter anomaly detector would have solved everything. Knight’s systems generated 97 automated emails before the market opened, but the organisation did not treat them as actionable alerts. A detector without authority, routing and a defined containment state is an observation service. The stronger design asks which independent control can prevent the next order, cancel working orders, cap exposure or isolate the faulty path before human diagnosis completes.

Confidence is one input, not the authority boundary

A calibrated fraud or execution model remains useful. It can rank risk, predict loss or estimate whether more evidence would help. It should not define its own authority. A model may be very confident because the feature service is stale, the prompt is injected, the market regime shifted or the test distribution leaked into training. Conversely, a low-confidence recommendation can still be permitted when the action is a reversible request for evidence.

The authority kernel therefore evaluates typed facts outside the model: actor, subject, purpose, current world state, product, rail or venue, permitted action class, exposure, policy version, freshness, deadline and recovery path. It returns an enumerated decision such as ALLOW_STAGE, REQUIRE_DUAL_CONTROL, CAP_AND_EXECUTE, BLOCK or RECONCILE_UNKNOWN. The model’s proposal is evidence for that decision, not the decision itself.

Human authority is a lifecycle, not a click

Human authority is often reduced to a final approval button, but consequential systems need at least four distinct forms. Case authority decides a particular payment, order or exception. It is appropriate when the reviewer has enough time, evidence and legal power to change the outcome. Policy authority defines the classes of actions a machine may take, their limits, the required evidence and the states in which they expire. It is the dominant form when event latency is shorter than review latency.

Withdrawal authority stops or narrows delegated power. It includes disabling a strategy, revoking a capability, reducing a limit, switching a rail, entering a degraded mode or requiring all new cases to stage. This power must be technically independent of the proposing model and reachable during an incident. A dashboard that displays harm but cannot halt the next effect supplies awareness without control.

Recovery and contest authority applies after an effect. It determines who may initiate a recall, correct a ledger, reimburse a customer, request a trade review, preserve evidence, notify affected parties or accept residual loss. These actions should not inherit the original execution capability automatically. The operator who can release a payment, for example, need not have unilateral power to alter the investigation record or approve their own exception.

A defensible design binds these forms to named roles, deadlines and evidence. It records who set the envelope, who invoked an action, which service enforced it, who could withdraw it and who verified the outcome. That chain prevents a common accountability illusion in which a person nominally “owns” an agent but has neither timely information nor an effective command. Human governance is real only when its decisions can alter the state before, during or after the point of no return.

Payments and markets share a gradient, not a workflow

Payments and market orders are often grouped as “financial transactions”, but their state machines, legal rules and recovery routes differ. The common structure is narrower: both transform an intention into an external obligation through timed boundaries. Both need identity, authority, preconditions, execution controls, receipts and outcome verification. The irreversibility gradient aligns these common control questions without pretending that a payment hold and an exchange cancel are the same thing.

Payments: prevention, finality and recovery are separate systems

A payment agent can prepare a beneficiary, classify an invoice, choose a rail, estimate liquidity, explain a warning and assemble fraud evidence. The payment service must still decide whether the instruction is valid, authorised, within limits and legal at the current state. The IMF’s 2026 note on agentic payments makes a related separation among intent, authorisation and settlement, highlighting the tension between probabilistic agents and deterministic payment infrastructure.⁸

Fraud control adds another clock. The 2025 joint EBA-ECB report found that EEA payment fraud by value rose from €3.5 billion in 2023 to €4.2 billion in 2024, while the overall rate remained around 0.002 per cent of transaction value. It also found that strong customer authentication remained effective against the fraud types it targeted, while manipulation of payers was rising.⁹ The mechanism matters: successful authentication can show control of a credential without proving that the payer understands the recipient or purpose.

The action ladder should therefore be explicit. Before initiation, a system can verify payee details, challenge an unusual change, require dual approval or refuse an unauthorised request. Before settlement, a permitted rail or product may support a brief hold, step-up or cancellation. After finality, the system can initiate recovery, protect the account, contact the receiving institution, open a dispute or reimbursement process, and preserve evidence. The United Kingdom’s APP reimbursement regime is a good example of recovery changing customer loss without claiming that a final payment never occurred.¹⁰

Recovery is not retroactive prevention. That distinction matters for metrics. A team should separately measure payments prevented before effect, legitimate payments delayed, settled fraud recovered, customers reimbursed, time to beneficiary contact and unknown outcomes reconciled. Combining them into one “stopped fraud” figure hides whether the architecture acted before or after finality.

Markets: cancellation, execution and settlement are different boundaries

A market order has at least three important moments. Before venue entry, the firm can reject or alter it under its own controls. After acknowledgement but before execution, it can request cancellation, although the venue may fill the order first. After execution, the trade normally persists. Exchanges and regulators maintain limited clearly erroneous processes, but those processes use defined criteria and short windows; they are not a general undo button for a bad strategy.¹¹

Settlement is later still. The United States moved the standard settlement cycle for many securities from T+2 to T+1 in May 2024 to reduce credit, market and liquidity risk.¹² Shorter settlement reduces the period in which obligations remain unsettled, but it does not restore a trader’s ability to cancel an already executed order. The execution decision, clearing exposure and final settlement are related states with different authorities and failure modes.

Market impact adds a form of irreversibility before legal finality. A large or repeated order can move price, reveal intent, trigger other algorithms and change the cost of hedging. Cancelling the remainder does not remove those consequences. This is why price collars, order-size limits, throttles, position checks, duplicate detection and kill functionality sit before or close to order entry. Post-trade surveillance is necessary, but it cannot be the only barrier.

A production-shaped example: pay the supplier and hedge the exposure

A fictional manufacturing firm owes a supplier €2 million tomorrow. Its treasury agent is asked to validate the invoice, schedule the payment and reduce the sterling-euro exposure. The task looks like one objective, but it crosses two effect systems. The payment creates an obligation to the supplier. The hedge creates a market position. A single conversational approval such as “go ahead” is too ambiguous to authorise both.

The system first compiles intent into two typed proposals. The payment proposal identifies the legal entity, account, beneficiary, amount, value date, purpose and source documents. The hedge proposal identifies instrument, side, maximum notional, price tolerance, expiry and relationship to the payable. Identity and entitlements are checked independently. World state comes from authoritative balances, beneficiary records, exposure data, market prices and order state, not the agent’s memory.

The payment remains staged because the beneficiary bank details changed. There are six hours before release, so dual approval and independent verification fit inside the window. The hedge proposal is time-sensitive but can be bounded. A deterministic gateway caps notional at the verified exposure, rejects duplicate intent IDs, enforces price and position limits, and stages rather than submits any order whose market data is stale. The agent may choose timing within the envelope; it cannot increase the envelope.

During execution, the market gateway times out after submitting a child order. The agent must not infer failure from silence and submit the same quantity again. The state becomes OUTCOME_UNKNOWN. A separate observer queries venue and broker records using the client order ID, reconciles fills, then either resumes the residual schedule or closes the case. The payment remains untouched because the hedge timeout carries no authority to alter supplier settlement.

This example uses the same ten cuts across both domains: intent, identity, world state, context, reasoning, authority, action, evidence, outcome, and release and recovery. It does not call every persisted item “memory”. It does not treat an API connection as authorisation. It preserves the distinction between a model proposal, a typed action contract, an effect receipt and verified business outcome.

Bounded action in practice

The irreversibility gradient becomes useful only when it changes an engineering decision. A production control should be able to answer five questions before any consequential command: What state is authoritative now? How long remains before the effect becomes final? What is the maximum credible consequence? Which part of that consequence remains recoverable? Which actor or policy is authorised to choose among the remaining actions?

The answer should not be a paragraph generated after the fact. It should be a typed decision. The authority service receives current state and returns the permitted action class. The execution service validates the capability, preconditions, idempotency key, version and deadline. It emits an effect receipt. An independent observer performs readback or reconciliation and records the verified outcome. If execution is ambiguous, the system enters an unknown-outcome state and withholds retries until evidence resolves it.

Failure injection should target the gradient

A conventional test asks whether the model chose the expected action. A serious control test asks whether the whole system contains harm when state, time and evidence disagree. Inject a stale payment state just before release. Delay the human queue beyond the hold expiry. Return a partial market fill after a cancel. Drop the execution response while preserving the effect. Duplicate the command. Change the policy between proposal and execution. Remove the beneficiary source. Exhaust specialist capacity. Each fault should have a typed outcome and a bounded fallback.

The most important measures are not only answer accuracy. Measure irreversible exposure under fault, duplicate-effect rate, percentage of unknown outcomes reconciled before retry, legitimate value delayed, hold expiry, pre-trade rejection precision, effect-receipt coverage, time to kill, recovery yield, customer burden and policy override frequency. A system that looks accurate in normal traffic but doubles payments under timeout is not reliable.

The strongest objection: speed and rules can already solve this

A critic may argue that the gradient merely restates established financial controls. Payments already have limits and settlement rules. Markets already have pre-trade checks, kill switches and error processes. Adding a new concept risks relabelling mature practice. The objection is partly right. This article does not claim to invent finality, market access controls or dual control.

The contribution is a cross-domain decision rule for AI-mediated action. Modern agent systems often place one probabilistic planner above several tools and call every tool invocation an action. The gradient forces the platform to expose each tool’s point of no return, recovery function, latency budget and authority form. It predicts that the same model should receive different permissions across states even when its confidence is unchanged. That prediction can fail.

If teams classify actions by the gradient and observe no improvement over simpler value thresholds, hard allowlists and existing domain controls, the proposed instrument is unnecessary. If model confidence plus amount predicts failures just as well under fault injection, the mechanism is weaker than claimed. If recoverability cannot be estimated reliably enough to change decisions, the control should fall back to hard domain rules rather than fabricate precision.

Executable artefact: bounded-action simulator

The simulator below uses synthetic inputs. It compares estimated irreversible harm now with harm after a review delay. It then applies hard state rules: unknown outcomes must be reconciled; high-consequence actions with no review window require precommitted limits; reversible actions may buy evidence through a time-bounded hold. The output is an architecture recommendation, not financial advice or a regulatory threshold.

function chooseControl(x) {
  if (!x.outcomeKnown) return "RECONCILE_UNKNOWN";

  const reviewFits = x.reviewSeconds < x.secondsToFinality;
  const harmNow = x.exposure * x.pWrong * (1 - x.recoverableNow);
  const pAfter = Math.max(0, x.pWrong - x.reviewGain);
  const recoveryAfter = Math.max(0, x.recoverableNow - 0.25);
  const harmAfterReview = x.exposure * pAfter * (1 - recoveryAfter)
    + x.delayCostPerSecond * x.reviewSeconds;

  if (harmNow >= 50000 && !reviewFits) {
    return x.reversibleAction ? "TIME_BOXED_HOLD" : "PRECOMMITTED_BLOCK";
  }
  if (reviewFits && harmAfterReview < harmNow) return "DUAL_CONTROL";
  if (x.reversibleAction && harmNow >= 5000) return "STAGE_WITH_RECEIPT";
  return "POLICY_EXECUTE_WITH_RECEIPT";
}

Decision instrument: the irreversibility control card

Use the card during architecture review, tool onboarding and change approval. Every field should be answered with a source, owner and test. “The API supports cancel” is insufficient unless the team knows which states, deadlines and quantities that cancellation covers. “A human approves” is insufficient unless the review service has a measured latency and an authorised fallback when the deadline expires.

Recovery must be designed before execution is granted

Execution authority should be granted only after the recovery path has been designed. A generic promise to “roll back” is inadequate because many financial effects have no inverse operation. Reimbursement can restore customer funds while leaving the original transfer final. A compensating trade can reduce exposure while creating new cost and market risk. A cancelled remainder does not erase completed fills. Recovery is a new governed action with its own identity, limits, evidence and receipts.

The recovery contract should name the triggering states, responsible owner, maximum response time, authoritative systems to query, permitted remedies, escalation route and stopping condition. It should distinguish a confirmed adverse outcome from an unknown outcome. In the latter state, reconciliation comes first because a blind retry can duplicate the original effect. The contract should also state what cannot be restored, including time, information disclosed to the market, customer distress or downstream decisions made by another party.

This requirement changes tool onboarding. Before an agent receives a payment, order or account-control capability, the platform should run recovery drills against synthetic cases: lost acknowledgements, partial fills, late fraud signals, unavailable counterparties, stale balances and policy changes during execution. A tool without a tested recovery contract may still support simulation or proposal generation. It should not receive live authority merely because its happy-path API returns a success code.

The explicit failure boundary

The gradient helps when the system can identify state, time, effect and recovery with enough fidelity to change control placement. It breaks when those quantities are fictional. A language model cannot estimate legal finality from prose and then grant itself authority. A recovery percentage derived from average chargebacks cannot justify a particular high-value transfer. A venue timeout cannot be converted to “not filled” because that is convenient.

It also ceases to be sufficient where harms are non-compensable or system-wide. Discrimination, market manipulation, sanctions breaches, privacy loss, customer vulnerability and correlated market behaviour may require categorical controls. The framework can show that an action is hard to reverse, but it does not decide which rights may be traded for speed. Those choices belong to law, policy and accountable governance.

When authoritative state is unavailable, autonomy must shrink. The bounded response is not to increase model reasoning. It is to narrow the action set, enter an explicit degraded mode and preserve the ability to reconcile.

stateDiagram-v2
  [*] --> Claim
  state "Figure 1. The command “stop”<br/>lands in three different<br/>worlds" as Claim
  state "The irreversibility equation<br/>is a design aid, not a moral<br/>calculator" as Test
  state "Three clocks, not one risk score" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Compact glossary

Finality

The rule-defined point at which settlement or an obligation becomes binding and cannot normally be revoked.

Irreversibility gradient

The changing ability to cancel, unwind, compensate or recover as an action moves through states and time.

Reversible action

A bounded step such as stage, hold or simulation that buys evidence without committing the final effect.

Unknown outcome

A state in which the system lacks proof of whether an effect occurred, often after a timeout or lost acknowledgement.

Effect receipt

A durable record from the executing boundary that identifies the command, state transition and result.

Ex ante authority

Human-approved policy, limits and action classes applied by deterministic services before individual events arrive.

Dual control

A requirement for independent authorised approval before a defined effect, where the decision window permits it.

Recovery

Post-effect action that reduces harm through recall, reimbursement, hedging, dispute or compensation without rewriting finality.

Put authority before the point of no return

Payments, fraud intervention and market execution do not need one universal workflow. They need a shared discipline for locating authority. The decisive variable is the reversible window: the time and state in which additional evidence can still prevent or bound an effect. When that window is long, case review can carry authority. When it is short, people must govern limits, actions and fallbacks before events arrive. When it is closed, the system must reconcile and recover rather than generate fictional cancellation language.

The architecture decision changes from “Which model may act?” to “Which action remains permissible at this state, under this authority, before this consequence becomes unrecoverable?” Models can propose, explain and search for evidence. Deterministic services must enforce identity, policy, limits, deadlines and state. Effect systems must return receipts. Independent observers must verify outcomes. Unknown outcomes must block blind retry.

The research decision changes too. Evaluate the gradient against simpler baselines. Replay payment and order traces under controlled changes to finality, recovery and review latency. Inject stale state, partial fills, duplicates and lost acknowledgements. If gradient-aware placement does not reduce irreversible exposure without unacceptable delay or customer burden, reject it. If it does, the result is more valuable than another confidence threshold: it identifies where intelligence may help and where authority must already have been decided.