AI Control Library / CF-11: Objective & Policy Constraints
Designation: Core | Control types represented: Operational, Technical and Contextual
Control requirement
Enforce justified decision thresholds for supported AI confidence or uncertainty measures, routing insufficient evidence or out-of-scope conditions to abstention, review or a safe alternative. Verify the measure’s meaning for the intended task.
Why this matters
A generated confidence statement may not be a calibrated probability of correctness. A threshold only controls useful risk when the score and its operating limits have been evaluated.
How the control types work together
Operational controls define review and intervention duties. Technical controls enforce limits or supply relevant evidence. Contextual controls shape the information, interface and conditions in which people interpret results and decide whether to act.
When it applies
AI workflows that use scores or uncertainty to authorize automation, select review or determine whether outputs can be relied on.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The decision owner approves thresholds with model and domain evaluators; engineering enforces the handling path.
Implementation guidance
- Define the measured quantity and relevant task outcomes, validating calibration or other evidence needed for the proposed decision.
- Choose thresholds from consequences and evaluation, documenting false acceptance, false rejection and uncertainty.
- Enforce routing outside model discretion, including missing scores, out-of-distribution cases and unavailable evaluators.
- Test threshold boundaries and review workload, monitoring behavior after population, model or process changes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Test a score near the boundary | The approved decision and routing are applied consistently. |
| Remove the score or required evidence | The workflow does not default silently to consequential automation. |
| Evaluate changed conditions | The threshold’s continued suitability is assessed rather than presumed. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Score definition and evaluation
- Threshold and tradeoff decision
- Routing configuration and tests
- Calibration and workload monitoring
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unsupported scores or excessive erroneous acceptance to decision and model owners. Restrict automation and use the approved review path until evidence supports the threshold.
Example in practice
Hypothetical example: A model’s self-reported certainty is replaced by a task-validated assessment. Missing supporting evidence routes the case to review even when the generated answer sounds confident.
Related controls
- CF06-009: AI Output Uncertainty & Confidence Disclosure
- CF07-002: Human Review Gates for Consequential Decisions
- CF09-002: AI Model Performance Monitoring
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Objective & Policy Constraints
Version 1.0