The fastest way to kill an AI deployment is to let it guess in public. One confidently wrong answer to a customer and the feature gets switched off — usually permanently, because nobody wants to be the person who turned it back on.
The systems that survive share one property: they are visibly willing to not answer.
Confidence has to mean something
A raw model probability is not a confidence score. Calibrate against a graded test set: when the system reports 0.8, it should be right about 80% of the time on your data. Until you have measured that, thresholds are decoration.
Once calibrated, the threshold becomes a business decision rather than an engineering one — and it can be set by the person who owns the consequences.
Escalation is a product surface, not an error path
- Route to a named role, not a shared inbox
- Attach the full context: input, what the system tried, why it stopped
- Make the human's correction one action, not a re-do from scratch
- Feed every override back into the eval set
- Show the ops lead the escalation rate on a dashboard they already look at
Give the controls to the people who get the complaints
In every deployment of ours that has stayed on, the operations lead can raise a threshold, disable a category, or reroute escalations without an engineer. It sounds like a small feature. It is the difference between a system that gets tuned and a system that gets switched off.
Ask who will be blamed when it's wrong, and give that person the dial.