Find your next learning step
Promotion gives a topology successor bounded permission; it does not freeze the network, evidence process or user behaviour. Monitoring must therefore follow the claim’s boundary, not merely a global accuracy score. When a defined signal crosses a rollback boundary, authority steps down to a safer stage while evidence is examined. If a new derivation, contamination path or shared mechanism changes what the successor inherited, its lineage reopens as an explicit provenance event.
Open the chapter contents · Topology root · Gold Standard of Education · How X Works
Chapter contents
Choose the route closest to the decision, or read from Chapter 1. The chapters remain open; these grouped routes are a navigable index.
Route 1 · Define the decision
Route 2 · Work the ledgers
Route 3 · Transfer the method
Route 4 · Check limits and evidence
Route 5 · Ask and continue
CHAPTER 1 OF 12 · DEFINE THE DECISION
1. Restate the promoted authority as a monitorable claim
Record the topology, population, endpoint, operating stage, permitted actions, exclusions, abstention path, approvers and evidence that supported promotion. Every monitor should map to one of these claims or safeguards.
Keep the release and promotion decision immutable. New thresholds, graph features or exclusions create a candidate state, not a silent continuation of the accepted one.
CHAPTER 2 OF 12 · DEFINE THE DECISION
2. Distinguish rollback from revocation and retirement
Rollback reduces authority to a previously supported stage, such as bounded automatic action to dual approval. Revocation removes permission for a decision role. Retirement closes that claim’s operational life and controls its archive.
Predefine which signals produce an automatic step-down, urgent review or longer investigation. This avoids negotiating the safety boundary after a troubling result arrives.
CHAPTER 3 OF 12 · WORK THE LEDGERS
3. Build a post-promotion monitoring register
Successor S has bounded automatic authority to unlock low-risk graph components.
| Monitor | Promoted boundary | Rollback trigger | Observed | Response |
|---|---|---|---|---|
| False unlocks | At most 1 per 200 | Two in rolling 200 | 2 | Step to dual approval |
| Abstention | 15% to 30% | Below 8% or above 40% | 6% | Check threshold drift |
| Novel topology | Manual review | Any automatic action | One blocked | Safeguard passed |
| Lineage exposure | No hidden R5 tuning | Any new exposure | Shared script found | Reopen lineage |
| Operator override | Below 10% | Above 20% | 12% | Continue monitor |
The false-unlock trigger rolls authority back, while the shared script independently reopens lineage. One response does not substitute for the other.
CHAPTER 4 OF 12 · WORK THE LEDGERS
4. Work a rollback and lineage-reopen decision
Investigators compare the promoted release with the newly found R5 script and review the exposed cases.
| Gate | Rule | Finding | Result | Decision |
|---|---|---|---|---|
| Operational containment | No new automatic unlocks | Disabled | Pass | Dual approval only |
| Shared feature effect | No material decision change | Changes 4 of 60 | Fail | Reopen derivation |
| Locked evidence independence | No tuning exposure | Analyst saw 12 outcomes | Fail | Relabel subset |
| Unaffected stratum | Stable below error budget | Passes | Pass | Keep advisory use |
| Fresh confirmation | New independent stream | Not yet available | Open | Commission study |
The provenance record links the new investigation to both S and R5. It does not overwrite the earlier promotion decision, which remains a historical event supported by what was then known.
CHAPTER 5 OF 12 · WORK THE LEDGERS
5. Monitor the decision process, not only outcomes
Track topology shifts, missing nodes or edges, abstention, threshold proximity, overrides, delayed labels, operator adaptation and safeguard activation. Outcome error alone may arrive too late or hide falling coverage.
Use denominators and exposure windows. Zero failures during ten easy cases is weaker evidence than one hundred representative opportunities with known follow-up.
CHAPTER 6 OF 12 · TRANSFER THE METHOD
6. Reopen lineage when provenance changes
Reopen when a hidden derivation, shared code, exposed outcome, transferred feature, undocumented analyst access or changed population alters the independence or scope claim. Record the discovery time, affected entities, activity and agent.
Reopening does not automatically invalidate every descendant. Trace the actual path, relabel contaminated evidence, identify unaffected branches and define the fresh evidence required for any restored authority.
CHAPTER 7 OF 12 · TRANSFER THE METHOD
7. Changed-context transfer: adaptive routing authority
Transfer the method to an adaptive routing graph promoted to reroute low-risk packets automatically. A new traffic class changes connectivity, and a cached rule from the retired graph is discovered in preprocessing.
Automation rolls back to operator approval after two boundary failures. Lineage reopens because the cache changes several choices, while an unaffected class retains advisory use. A fresh stream tests the cleaned release before any re-promotion.
CHAPTER 8 OF 12 · TRANSFER THE METHOD
8. Connect successor promotion, monitoring and prior restart rules
Start with successor promotion and retirement-lineage closure. Use promoted-rule monitoring and evidence-lineage audits for the broader promoted-rule controls.
Return to successor-claim boundary review and fresh-evidence design when reopening changes the claim or exposes prior evidence.
CHAPTER 9 OF 12 · CHECK LIMITS AND EVIDENCE
9. Limits and common misconceptions
Rollback is not proof that the successor has no value; it restores a safer authority level while evidence is resolved. A passing average metric cannot cancel a breached safety or provenance boundary.
A provenance graph shows asserted relations but does not itself prove independence or causal effect. Reopening lineage is not permission to retest until success; exposed evidence must be labelled and fresh confirmation designed.
CHAPTER 10 OF 12 · CHECK LIMITS AND EVIDENCE
10. Practical evidence and authority checks
Archive the promoted claim, release hash, authority stage, exclusions, monitoring code, denominators, exposures, alerts, overrides, safeguard activations, incident cases, containment time and decision owners.
For lineage reopening, retain the discovered relation, code or feature comparison, affected evidence, exposure map, relabelling, rollback scope, surviving authority, fresh-study protocol, restoration gates and provenance links.
CHAPTER 11 OF 12 · ASK AND CONTINUE
11. Frequently asked questions
Must every alert roll authority back?
No. Follow the predeclared persistence and consequence rules. Some alerts open review; safety-critical or lineage triggers may require immediate containment.
Can an unaffected branch remain operational?
Yes, when the branch is genuinely separable and its evidence, implementation and safeguards remain supported.
When can authority be restored?
After the cause is resolved, affected evidence is correctly labelled, fresh gates pass and the named authority explicitly approves the defined stage.
CHAPTER 12 OF 12 · ASK AND CONTINUE
12. Sources and next reading
The W3C PROV-O Recommendation defines entities, activities, agents, derivation, generation and invalidation for explicit provenance. Ramdas and colleagues’ review of game-theoretic statistics and safe anytime-valid inference explains evidence processes suited to repeated monitoring when their assumptions match the information flow. These sources support lineage and monitoring structure; the graph examples are original teaching cases.
Continue through the Topology root, the Gold Standard of Education and How X Works.
Top · Contents · Previous · How X Works