# Confidence & the one rule

The five bases a guardrail finding can carry, when it gets a confidence interval, and when it gets none.

Source: https://tokentriage.com/docs/guardrails/confidence

---
import Callout from '../../../components/Callout.astro';
import GuardrailConfidenceDiagram from '../../../components/GuardrailConfidenceDiagram.astro';
import Screenshot from '../../../components/Screenshot.astro';
import NextSteps from '../../../components/NextSteps.astro';

Every fire may carry a confidence envelope. Its **basis** says what kind of claim the number is —
and four of the five bases can never carry an interval at all.

| Basis | What it means | May carry an interval? |
|---|---|---|
| `exact` | a deterministic validator passed; point is 1.0 by construction | no |
| `fixture` | this detector **version's** measured precision on a seeded corpus | no |
| `calibrated` | a calibration artifact licenses the bound | **yes — and only this one** |
| `reported` | the detector's raw score, explicitly unlicensed | no |
| `insufficient` | a refusal: no number at all | no |

<GuardrailConfidenceDiagram />

## The one rule

<Callout type="key">
**An interval exists if and only if a calibration artifact id is beside it.** Both directions are
enforced — at the write boundary and again on every read surface. An envelope that violates the
rule is **refused and counted**, never downgraded into a bare number.
</Callout>

That counting is the point. Because the refusal is recorded in `confidence_refused` on the row,
**"this detector reported no confidence" and "this layer declined to record the confidence it
reported" are different facts** — on the row and on the page. A system that silently dropped the
interval and kept the point would erase that distinction, and the erased version reads as the more
confident one.

## `exact` does not mean "certainly a card"

<Callout type="warning">
**Read `basis: exact` as "a deterministic checksum passed", because that is all it has ever
meant.** For `pii.card` the checksum is Luhn plus an issuer-range lookup — and an *arbitrary*
16-digit run passes both **3.145% of the time** (629 of 20,000, measured). `exact` is a statement
about the validator, not about the world.
</Callout>

The same distinction applies to `media.inventory`, whose `exact` basis means *the parse found a
part at a known path* — a deterministic read of the request bytes, saying nothing whatever about
what the part contains.

## A calibrated bound changes what `threshold` means

This is a behavior change that arrives from an artifact activation rather than a config edit, so it
is worth stating plainly.

A finding's score is the **licensed point** when one exists, in preference to the raw signal. A
calibrated point is a **version-level aggregate**, so while a bound is licensed every finding of
that detector version carries the same number. Two consequences:

- `threshold` becomes an **on/off switch** — any value at or below the licensed point admits every
  finding, any value above it admits none.
- `severity_bands` cannot separate a strong hit from a weak one, because there is no such
  distinction left to separate. A low/medium/high ladder collapses to one rung.

<Callout type="warning">
**The units change with it.** `threshold` used to mean *raw signal strength*; while a bound is
licensed it means *this detector version's estimated precision*. That is a different question with
the same spelling. `tokentriage guardrails list --config <file>` states it beside the bound.
</Callout>

And the calibrated point is **not a per-finding probability**. It is the version-level share of
this detector's findings adjudicated true positive on **one segment and one endpoint** — constant
across every finding the version produces, and never averaged across coordinates the detector
cannot observe.

## Four detectors never spend a calibrated bound at all

`pii.card`, `pii.crypto`, `pii.iban` and `pii.mac` carry only exact rules — a checksum, a Luhn
digit, or a fixed structural form — so no calibration artifact is ever consulted for them, on
either lane. Their `threshold` and `severity_bands` always read the raw signal and mean the same
thing buffered or streamed.

<Callout type="note">
**For the detectors that *do* spend one, the streaming lane does not.** A calibration subject is
`(detector, version, endpoint)` and the frozen stream-matcher seam carries no endpoint, so a stream
matcher cannot ask the store a question it has the coordinates for. Every stream finding therefore
mints the unlicensed basis. The operator-visible consequence: while an artifact is licensed, a
`threshold` set above the raw signal but at or below the licensed point admits findings on a
**buffered** response and none on a **streamed** one. This is a difference in the score used for
threshold admission, not a blanket stream failure posture. Inspection failures still follow the
effective mode and `on_error` policy; enforcing closed protection suppresses unreleased bytes.
The streaming score can never turn a `reported` point into a bound.
</Callout>

## No interval is ever rendered for an adversarial category

<Callout type="key">
**`injection` is the one adversarial category in this build, and it will never carry an interval —
at any basis, under any artifact.** Attacker-chosen traffic is out-of-distribution *by intent*, so
the exchangeability a conformal or binomial bound assumes is simply false for it. A bound fit on
yesterday's attacks does not bound tomorrow's, and publishing one would be the most
confident-looking wrong number this layer could produce.
</Callout>

This is a rule, not a gap awaiting work. `injection.heuristic` and `injection.judge` are permanently
`reported`, and three independent code paths refuse an interval there.

## `insufficient` is a first-class outcome

A page that shows `insufficient` is working correctly. It is not an error state, not a fallback, and
not a `0.0` in disguise — it is the layer declining to state a number it does not have evidence for.

<Screenshot
  stem="guardrail-confidence"
  url="localhost:9090/ui/honesty"
  dark
  label="Synthetic traffic"
  alt="One guardrail evidence lineage for code.patterns: 163 fires over 163 rows, all annotated and all from an irreversible action, a reported basis chip with 163 fires and an exemplar of 0.95, and zero adjudicated findings."
  caption="One lineage on the evidence surface. The basis chip is the census — a count per basis plus one exemplar envelope a detector really produced. It carries no interval, because `reported` may never carry one; and the fires say nothing about whether they were correct."
/>

The same discipline governs the measured figures the detectors themselves publish: **below a
denominator of 20, the harness refuses to render a rate as a decimal**, and prints a tally instead.
`pii.ssn`'s recall rests on 10 positives; `pii.iban`'s and `pii.phone`'s on 6. A perfect tally on a
small corpus is the most quotable and the least honest number this layer could emit, which is
exactly why it is not rendered as one.

<NextSteps items={[
  { title: "Evidence & alerting", href: "/docs/guardrails/evidence-and-alerting", description: "The per-basis confidence census, and why it never averages two envelopes." },
  { title: "How calibration works", href: "/docs/calibration/how-calibration-works", description: "Where a calibration artifact comes from, and what licenses it." },
  { title: "Guardrail detectors", href: "/docs/reference/guardrail-detectors", description: "Which basis each detector mints, and what its measured figures rest on." }
]} />