# Decision Model

Confidence engineering exists to support a decision, not to maximize testing activity.

## Decision Vocabulary

| Decision | Meaning |
| --- | --- |
| `SHIP` | Evidence supports broad release for the evaluated population and scope. |
| `CANARY` | Evidence supports limited exposure with monitoring, stop conditions, and tested rollback. |
| `HOLD` | A blocker exists or the evidence package is materially incomplete. |
| `ROLL BACK` | Production evidence shows harm or regression beyond the accepted boundary. |
| `MORE EVIDENCE` | Current evidence cannot distinguish the outcomes that matter. |

## Risk Dimensions

Score each important risk from 1 to 5:

- **Impact:** harm if the failure occurs.
- **Exposure:** how many people, transactions, or systems encounter it.
- **Reversibility:** difficulty of undoing the outcome.
- **Detectability:** likelihood of noticing before harm grows. Reverse this score so hard-to-detect failures score higher.
- **Uncertainty:** how little reliable evidence is available.

Use the score to order investigation, not to manufacture a precise probability. A rare catastrophic and irreversible failure may remain a blocker even when its numerical rank is lower than common annoyances.

## Release Logic

1. Block on unacceptable outcomes, even if the average is good.
2. Prefer canary when the remaining uncertainty is observable and reversible.
3. Hold when the most important claim lacks evidence.
4. Roll back when production signals cross a predefined stop condition.
5. Narrow the decision scope instead of pretending a small sample represents the whole system.

A release decision must state evaluated versions, population, assumptions, evidence, uncertainty, severe failures, blind spots, monitoring, stop conditions, rollback, owner, and date.
