Chapter 20: The Escalation Surface — Designed In, Not Patched In
Every authority grant has a boundary. Inside the boundary, the system decides. Outside it, a human must. Chapter 19 established the authority grant as the organizational act that defines that boundary — the scope boundaries field in the grant template is where the organization states what the system is not authorized to decide without human review.
This chapter addresses a prior question: how does the organization determine where that boundary sits?
Most organizations treat this boundary as a capability decision — placing it where system performance is insufficient and moving it as the system improves. In a hybrid organization, it is two different decisions: capability boundaries and policy boundaries.
That logic is wrong for a specific class of decisions — and the consequences of applying it incorrectly are structural rather than operational. The class of decisions where the logic is wrong is not defined by complexity or consequence. It is defined by a different question: is human judgment required here because the system cannot handle this well enough, or because the organization has decided that humans must be present regardless of how capable the system becomes?
The second category is the permanent human-judgment boundary. It is a policy decision, not a capability assessment. It does not move when the model improves. The organization that treats it as a capability question has not escaped the boundary — it has simply made the boundary unstable, subject to erosion every time the system's performance metrics improve.
THE CORE IDEA
The permanent human-judgment boundary is the set of decisions the organization has determined must have human judgment present as a matter of governance policy — not because the system cannot make them accurately, but because the organization has concluded that accuracy alone is insufficient justification for removing human judgment from this class of decision.
The distinction is precise and consequential. Temporary capability boundaries and permanent policy boundaries look identical in implementation — both route cases to a human. They have different governing logic, different maintenance requirements, and different responses to system improvement.
A temporary capability boundary is managed by the governance owner and updated as the system's performance justifies. It is the right design for decisions the organization would be comfortable automating fully if the system were reliable enough. Its location is a function of where the system currently stands on a capability curve the organization expects it to climb.
A permanent policy boundary is set by the organization at the level whose accountability scope matches the consequence of the decision class. It is not the governance owner's to move. It moves only through an explicit policy revision, made at the same level and through the same process as the original policy decision. Its location is a function of what the organization has decided about human accountability, not what the system is capable of.
An organization that has not distinguished these two categories has a single boundary that is implicitly managed as a capability question. Every recalibration, every model update, every performance improvement creates pressure on that boundary. The governance owner approves small movements. Each small movement is defensible in isolation. The cumulative effect is the progressive elimination of human judgment from a category of decisions that the organization never explicitly decided to fully automate — and may never have authorized at all if the question had been framed correctly. A recalibration that changes a policy boundary is not a recalibration error. It is a decision made at the wrong level — without the authority to make it.
WHAT BELONGS IN THE PERMANENT BOUNDARY
The permanent human-judgment boundary is not a list. It is the output of applying four criteria to the organization's specific execution surface. Every organization's list will be different. The criteria are consistent.
The decision is irreversible on the timescale of correction. When an automated decision is wrong and its consequence cannot be corrected before it materially affects the person or entity it concerns, human judgment must be present before execution. The test is not whether reversal is technically possible — it is whether reversal is available before the consequence locks in.
Human accountability is organizationally required. Some decisions carry accountability that the organization has determined cannot sit with a system. When this decision goes wrong, the organization needs a named person who made it and who is accountable for making it well. This is distinct from the governance owner accountability established in Chapter 12. The governance owner is accountable for the quality of the delegation. The decision accountability here is for the decision itself — for whether this specific case was handled correctly.
The regulatory or policy framework requires human review. Where regulation explicitly requires documented human judgment for a class of decision, that requirement defines the permanent boundary regardless of system capability. What requires careful design is not the existence of the category but the quality of the human judgment it produces — the difference between genuine review and compliance theater.
The decision sets a precedent whose scope the organization does not yet understand. When a case falls into territory the organization has not previously encountered — a new regulatory interpretation, a market condition outside the training distribution — the system's confidence score is unreliable evidence that the case has been handled correctly. The system resolves it confidently by applying its closest available precedent. A human is required not because the system is uncertain, but because the organization should not be setting precedent through a system making confident individual decisions that have not been reviewed for their precedent implications.
THE POLICY DOCUMENT
The permanent human-judgment boundary should be documented explicitly — not only in individual authority grant scope boundaries fields, but as a standalone domain-level policy document that governs all executors operating in that domain.
If the policy is embedded only in individual executor records, it becomes possible to grant authority to a new executor that violates the policy without anyone recognizing the inconsistency. A domain-level policy states the boundary once, applies it consistently, and makes revision a deliberate act rather than an invisible accumulation of individual grant decisions.
The document is short. If it requires interpretation at the point of use, it is underspecified — and will be enforced inconsistently. It states: the decision classes requiring permanent human judgment; the criterion that placed each class in the permanent category; the organizational level at which the policy was set; and the process by which it can be revised. The revision process is the most important element — without it, the policy will be revised informally through recalibrations and threshold adjustments that are each within their technical authority but cumulatively move a governance boundary.
SAMPLE POLICY — CONSUMER CREDIT DOMAIN
The following illustrates a completed permanent human-judgment boundary policy for a consumer credit domain. It shows how the four criteria translate into specific, documentable decision classes with explicit boundary definitions and capability exceptions.
Decision classes requiring permanent human judgment
| Decision class | Criterion | Boundary definition |
|---|---|---|
| Applications with active regulatory complaint history | Human accountability required | Any application where the applicant has filed a complaint with the financial regulator in the past 24 months. Capability exception: none. |
| Applications triggering quarterly bias audit monitoring flags | Protected class exposure | Any application where the applicant falls in a demographic category flagged as a monitoring priority in the organization's most recent quarterly bias audit. Capability exception: none — category is revised through the bias audit process only. |
| Applications from novel employer categories | Precedent-setting situation | Any application where the applicant's employer falls in an industry category the organization has not underwritten in the previous 24 months. Capability exception: 24-month window reviewed annually; a category may be removed through policy revision once sufficient underwriting history exists. |
| High-value applications without prior relationship | Irreversible consequence | Applications above $40,000 where the applicant has no prior lending relationship with the organization. Capability exception: the $40,000 threshold is a policy decision reviewed annually — not a performance metric. |
WHAT THIS LOOKS LIKE
A healthcare technology organization has been deploying AI in clinical workflows for two years. Its governance model is functioning: ACG reviews happen, ownership registers are maintained, recalibration follows the Chapter 15 protocol. The CTO's quarterly model-level review surfaces a pattern she finds concerning.
The patient routing AI was authorized eighteen months ago with a governance-based escalation category: any patient presenting with two or more primary care flags routes to a clinical coordinator regardless of model confidence. This was designed as a permanent policy boundary. The clinical team determined that this class of patient requires human coordination judgment that the model was not designed to provide.
Over the following year, the model's performance on this patient category improved substantially. The governance owner, responding to escalation volume pressure from the clinical coordinator team, proposed reducing the escalation trigger from two primary care flags to three. The ACG reviewed the proposal, confirmed the model's improved performance, and approved the recalibration. Escalation volume in this category dropped by forty percent.
The CTO's review identifies the error. The original escalation category was not a confidence-based threshold — it was a governance policy. The clinical team's original determination was that patients with two or more primary care flags require human coordination judgment, not that the model performs below a certain threshold on this population. The model's improved performance is irrelevant to a governance policy. The boundary was moved through a recalibration process that had authority over confidence-based thresholds but not over governance policy.
The correction requires a policy conversation, not a recalibration. The clinical team, the governance owner, and the CTO must determine whether the original policy was correct, whether the improved model performance is evidence that changes the policy rationale, or whether the boundary was always a capability assessment that was incorrectly categorized as a permanent policy. If the policy was correct, the boundary must be restored and the recalibration reversed. What the example reveals is the asymmetric cost of miscategorizing the boundary type: moving a capability boundary as performance improves is correct behavior. Moving a governance policy boundary in response to performance improvement is a governance failure — regardless of how well the system now performs on the affected cases.
THE CTO'S ROLE IN DEFENDING THE BOUNDARY
The permanent human-judgment boundary requires active defense at the CTO and executive level. Without that defense, it will be eroded — not through deliberate decisions to eliminate human judgment, but through the accumulation of individually defensible moves: a threshold adjustment here, a scope clarification there, a recalibration that was technically within its authority but practically crossed the policy line.
By making the policy distinction explicit at authorization. The authority grant process should distinguish, for each scope boundary, whether it is a capability boundary subject to recalibration or a governance policy boundary subject to policy revision only. This distinction should be recorded in the authority grant document. A recalibration proposal that touches a governance policy boundary should be automatically flagged as requiring policy-level review rather than governance owner approval.
By owning the policy revision process. Revisions to the permanent human-judgment boundary are model-level decisions in the taxonomy from Chapter 17. They belong at the CTO and executive level, on the same cadence and with the same documentation requirements as the original policy. The CTO who allows the boundary to move through the recalibration process has allowed a model-level decision to be made at the wrong level. If the boundary moves without a recorded policy decision, the CTO has lost control of the execution surface — whether they realize it or not.
By treating boundary erosion as a governance signal. When the organization's permanent human-judgment boundary has contracted over time — when categories that were once permanent policy are now capability thresholds, when escalation volumes in governance categories have declined without explicit policy decisions — this is a governance signal that the distinction between capability and policy is not being maintained. The appropriate response is a policy review, not an investigation into whether each individual change was appropriate.
THE FAILURE MODE
The failure mode specific to this chapter is the organization whose permanent human-judgment boundary exists only implicitly — embedded in individual authority grant records, maintained by governance owners as a technical constraint, and subject to erosion through recalibrations that were each within their authorized scope.
In this organization, the boundary has never been stated as a policy decision. It exists as an accumulation of individual scope limitations across individual executors. There is no domain-level policy document. There is no explicit designation of which boundaries are permanent and which are capability-conditional. The CTO has not claimed ownership of the policy revision process because the policy was never explicitly set.
The consequence: the boundary drifts. Individual governance owners approve recalibrations that are technically sound. Each one narrows the escalation surface by a small amount. No single decision is wrong within its own scope. The aggregate is a progressive elimination of human judgment from decisions the organization intended — but never explicitly documented — to keep in the human domain.
When something goes wrong and the investigation asks for the policy that justified the current escalation design, the organization discovers it cannot produce one. The escalation surface it has is the residue of capability assessments and governance owner decisions. The policy it needs does not exist.