Accountable AI: what we refuse to show you
Everyone is shipping assistants. Almost nobody is accountable for what comes out of one. The complaint engineers keep making is the same: confident forecasts, no way to see the assumptions, old correlations wearing new language. So here is our side of it, stated as refusals rather than promises — each one tied to the code that enforces it and a test that fails if that code goes away.
The short version
- • A number from a fitted model is labelled an estimate, next to the number.
- • A run that did not converge shows no answer — the residual is shown instead.
- • An impossible input is refused by name. Nothing is quietly snapped into range.
- • Every export carries its caveats inside the file and in its filename.
- • Re-runs are labelled: reproduces, drifted, or trained on different data.
The Verified Design Record
Every claim below is worth nothing if you have to take our word for it inside our app. So any run here exports a single file that judges itself: the inputs as typed, which of them were defaults you never chose, each result marked solved or estimate, the residual, every refusal in the run's own words, the validation status, and a fingerprint of the case.
The verdict on the file is derived from its own contents and can only be made harsher — a withheld run can never be exported as an accepted one. Hand the file to a partner, a regulator, or yourself in two years: they open the public verifier, with no account, and it tells them whether the file was edited after export, whether its verdict matches what is actually in it, and what it does not claim.
Estimate versus solved
A fast approximation and a solved run are different things, and the difference is printed next to the number — not buried in documentation.
Fast answers are labelled ESTIMATE, not results
Anything produced by a fitted model rather than a solved run carries an ESTIMATE label next to the number — including driver rankings and input-swing charts. The label is attached where the value is computed, so it travels with the number into panels and exported files.
Map shading says whether it was calibrated
Stimulated-probability shading on pad and cluster views is marked CALIBRATED when it is tied to measured stress and offset history, and GEOMETRY ONLY when it is not. There is no unlabelled middle state.
In-sample fit is never presented as predictive accuracy
A trained model shows its in-sample fit and its hold-out error side by side, with the fit figure explicitly noted as not being predictive accuracy. Rows are dropped with a named reason rather than filled in.
What we refuse to show you
The hardest part of an honest tool is the blank space. When the inputs or the solve cannot support an answer, you get a named reason instead of a number.
A run that did not converge shows no answer
When the solver fails to converge, the number is withheld and the residual is printed instead. We would rather show you nothing than a confident figure the physics did not support.
Impossible inputs are refused by name, never quietly clamped
Negative slurry volumes, perforation counts or rates, fracture pressure below pore pressure, a zero time step, an impossible diverter schedule: each is refused with the reason stated in the engineer's words. Nothing is silently snapped into range behind your back.
Too little data means no score
Scores computed from a handful of samples are withheld rather than reported with false precision, and the page says how many rows it would need.
Records you can hand to someone else
A file you hand to a partner, a regulator or your own future self has to carry its own caveats. Ours do, and they cannot be stripped off.
Any run exports one record that judges itself
A Verified Design Record carries the inputs as typed, which of them were defaults, each result labelled solved or estimate, the residual, every refusal in the run's own words, the validation status and a fingerprint. Its verdict is derived from those contents and can only ever be made harsher, so a withheld run cannot be exported as an accepted one.
Anyone can check the record without our app
The record is readable text with a checksum. Drop it into the public verifier and it reports whether the file was edited after export, whether its stated verdict matches its own contents, and everything in it that is an estimate, withheld, refused or unvalidated. No account, nothing uploaded.
Exports carry their caveats inside the file
One shared gate decides every download. Conditions that invalidate the record block the file outright; conditions that qualify it stamp lines into the file and a suffix onto the filename, so the caveat cannot be separated from the data later.
Overrides need a name and a reason
A blocked export can only be released by an audited override that records who accepted the caveat and why. An anonymous override is refused.
Run it again and prove it
Run the same case again and we tell you whether it reproduced. That is the part most tools leave to your memory.
Every run is fingerprinted and kept
Runs are stored with a fingerprint of their inputs, so re-running the same case is checked against the earlier one rather than trusted.
Re-runs are labelled Reproduces, Drifted or New dataset
Compare two runs and the app tells you which it is: identical within tolerance, drifted from the earlier answer, or trained on different data entirely — plus improved or degraded where an error metric exists.
Anything the assistant changes can be put back
Every AI action writes a restore point to the journal before it touches your case, and each suggestion carries the reason codes behind it.
Where we are not finished
Some cases in our own validation suite do not converge to the tolerance we want, and those results stay withheld rather than quietly loosened. One fracture-network geometry case is deliberately not implemented and marked as such. We would rather publish the gap than round it off.