Machine learning made progress by giving up on certainty, and that was the right trade. A field that had spent decades trying to write down every rule discovered that it could get further by accepting a distribution instead — by building systems that are usually right and knowing how usually. The willingness to report ninety-four percent rather than pretend to a hundred is not a weakness in that culture. It is the discipline that made the last fifteen years possible.
Then the model gets deployed into payroll, and the number stops meaning what it meant.
Accuracy is a property of a distribution. Payroll is not a distribution. It is three hundred and forty people, each of whom is paid once, and each of whom experiences the entire system as a single number arriving on a single day. Ninety-nine percent across four hundred timesheet lines is four wrong payslips. Four wrong payslips is four people who cannot pay something this month, and — the part that outlives the correction — four people who now know that the number they are given is a number somebody guessed. Trust in an operational tool is not an average either. It is granted whole and withdrawn whole.
But the accuracy figure is not the real problem, and treating it as the real problem is how these systems get built wrong.
The real problem is the shape of the failure.
An error that surfaces is an incident. It costs an hour, it embarrasses someone, it gets fixed, and the system is more trusted afterwards than it was before — because it demonstrated that it announces its own limits. An error that does not surface is not an incident. It is a liability that accrues quietly, gets discovered months later by the person it harmed, and then does something that no correction can undo: it retroactively invalidates every output the system has ever produced. Not because those outputs were wrong. Because from that moment nobody can tell which ones were right.
This is the asymmetry that governs everything else in the design. Loud failure is cheap and recoverable. Quiet failure compounds, and its true cost is not the wrong number. Its true cost is the audit.
So the constraint is not a target for accuracy. It is a prohibition on absence.
Every input row must produce an output. Not necessarily a value — a value, or an explicit refusal with a reason attached and a place for it to go. A line that cannot be matched must arrive on someone's screen as a line that could not be matched. A file with a column the layer does not recognise must halt at that column and say which one. What is forbidden is the third outcome: the row that enters the system and does not leave it, dropped by a filter that was written to handle a different problem, absent from the output and absent from the error log, because nothing in the code considered its absence an event.
That is the failure mode we design against hardest, and it is the one that almost never appears in a demo, because a demo is built from the rows that worked.
Which means a system operating at this altitude needs a first-class way to say that it does not know. Not a low confidence score buried in a response object. A refusal, in the interface, addressed to a named person, that stops the process rather than continuing past it. A system without that capability does not become cautious under uncertainty. It guesses — and a guess, once it is formatted like an answer, is an answer.
This is also the reason trace-native design is a structural requirement and not a governance feature. The claim "every row produced an output" is only worth making if it can be demonstrated on a specific Thursday for a specific site. Without a trace, the claim is a hope about the code. With one, it is a fact about the run. And human-commanded is what gives the refusal somewhere to land: a system that escalates into an unattended queue has not escalated. It has deferred, more quietly.
None of this is a higher standard than the industry's. It is a different standard, and it belongs to a different altitude. Where the cost of an error is a worse recommendation, optimise the distribution. Where the cost of an error is a person's wages, a shipment, or a regulatory filing, the distribution is not the object. The tail is.
We do not ask whether a system is accurate.
We ask what it does when it is wrong, and whether anyone will find out.