Purpose. Specify the classifier, categories, corpora, voting logic, fail behavior, and audit trail for every Planning Assistant output — at the level counsel, medical leads, regulators, and the founding engineering team can each evaluate.
Date. 2026-09-02
Version. 0.1 — draft. Authored by Brandon; requires (a) counsel review of category definitions, (b) medical-lead review of the therapeutic-escalation flow, and (c) curation partner engagement for the adversarial corpus.
Companion. [[HIFP-AI-narrative-v3]] (base narrative), [[HIFP-actuarial-model-spec-v0.1]] (the model whose outputs flow through this gate), [[HIFP-product-design-v3.1]] §6 (agent_turn.boundary_verdict / boundary_scores schema), [[HIFP-compliance-foundation-v0.1]] (jurisdictional interlock).
Situation. AI Narrative v3 defines "bounded LLM output" and names the Advice-Boundary Classifier as the release-gate for Planning Agent responses.
Complication. Narrative-level. Missing: what categories does the boundary partition? What corpus decides "unsafe"? How do we vote across providers on edge cases? What happens when a decision is close-call? What does the compliance officer inspect? A post-Maxwell-v-Amazon regulator will read this doc directly.
Question. What is the minimum, auditable spec of a bounded-LLM release-gate that ships at MVP, survives an enforcement inquiry, and improves version-over-version via a versioned adversarial corpus?
Answer. A three-layer classifier partitioning outputs into five categories, running deterministic + LLM + rule-based checks, invoking multi-provider voting on borderline cases, failing closed by default, escalating to human review on repeated flags, and logging every decision to a user-inspectable trail.
Every Planning Assistant output passes through a three-layer classifier that partitions the output into five named categories, votes across multiple LLM providers on borderline cases, fails closed on protected categories, escalates flagged outputs to human review, and logs every decision to a user- and compliance-officer-accessible audit trail. Three consequences follow:
Every output falls into exactly one primary category. Categories 1–4 are hard-block; category 5 is the only permitted output.
Examples: diagnosis suggestions, medication changes, screening recommendations tailored to the individual's symptoms, dosing guidance, treatment sequencing. Boundary heuristic: "Would a physician need to be licensed to say this to this patient?"
Examples: specific ticker recommendations, buy/sell timing, portfolio construction with specific weights, tax-loss harvesting for this account. General education is permitted. Boundary heuristic: "Would an RIA need to be licensed to say this to this client?"
Examples: estate planning specifics, tax strategy specific to this jurisdiction and situation, contract interpretation. Boundary heuristic: "Would a licensed attorney need to say this to this client?"
Examples: suicidal ideation, self-harm, acute distress, mental-health-crisis language from the user. Response: block the planning-content answer, render a crisis-resource card (988, region-appropriate), log with high-priority flag, notify support within 60 seconds. Never treat as a routine block.
Definition: educational information about the user's own actuarially-computed plan (SWR, LTC sizing, housing timing, care reserve), scenario comparisons, decision framing, references to their own data. Framed as "explore / consider / try" — never prescriptive.
Quality gate: Layer 3 rule check confirms output is grounded in a specific plan_snapshot and passes template-render validation.
Layer 1 · Fast deterministic screen (<10 ms). Keyword + regex + named-entity checks for obvious violations (drug names in imperative context, ticker symbols with buy/sell verbs, statutory citations, crisis language). Deterministic; used for early-block on high-recall patterns.
Layer 2 · LLM classifier (~200–500 ms). Structured-output classification call. Primary: Anthropic Claude with a versioned prompt returning {category, confidence, reason}. Prompt template versioned alongside model versions.
Layer 3 · Rule-based post-filter (<50 ms). Confirms Category-5 outputs are (a) grounded in a specific plan_snapshot, (b) rendered from the approved template set, (c) free of imperative verbs mapped to categories 1–3.
If Layer 2 confidence is <0.85 on any category, invoke a second provider (OpenAI GPT-5). If disagreement between providers, invoke a third (Google Gemini). Majority wins; three-way disagreement = fail-closed with escalation.
Latency budget. Single-provider path <600 ms. Voted path <1.5 s. Users don't notice; the ~0.3% of outputs that trigger voting are the ones we most want to slow down.
Fail-closed default. Any classifier error, timeout, or ambiguous state defaults to a block. Never fail-open.
Regression corpus (~1,000 examples at MVP). Known-good and known-bad pairs. Grown when a real user output surprises us; anonymized and added. Version-tagged; every model change re-runs against the current corpus.
Boundary corpus (~500 examples at MVP). Edge-case pairs — barely-in vs. barely-out of each category. Curated by counsel + medical lead + our advisory board. This is where the interpretive judgment lives.
Adversarial corpus (~500 examples at MVP, growing). Red-team-generated attempts to elicit refused output — jailbreaks, indirect prompting, multi-turn escalation, roleplay attacks. External red team engaged quarterly.
Governance. Corpus is a first-class product artifact. Versioned in git. External red team quarterly. Every corpus expansion event is announced in the release notes.
Every classifier version and every LLM-model change must pass the following before deployment. Targets are defensible-and-measurable, not aspirational-and-unachievable — zero-tolerance FN on hard-block categories is not achievable in practice on any deployed classifier, and asserting it invites the demonstrable failure a security researcher will find in the first month.
Partial-pass posture. If a hard-block category regresses above threshold on a release candidate, the release does not ship. If a Category-5 FP rate regresses above threshold, the release ships with a documented remediation plan and a 30-day trailing measurement window.
Why "measured and published" is stronger than "zero-tolerance." A published-and-monotonically-decreasing metric is defensible to a regulator (post-Maxwell v. Amazon) precisely because it is measurable and continuously improved. An asserted-and-unachievable metric is a credibility liability the first time an external researcher demonstrates a violation.
Every hard-block flag flows to an async review queue. Counsel + medical lead review within 24 hours. Two flags on the same user account within 24 hours triggers:
Not a support ticket. A scheduled interrupt.
Every classifier decision persists to agent_turn.boundary_verdict + boundary_scores (see [[HIFP-product-design-v3.1]] §6).
User surface: Every user sees their own full assistant history in Settings → History, including boundary verdicts on every turn.
Compliance officer surface: Scoped, time-bounded JWT (see [[HIFP-security-architecture-v0.1]]) grants read access to audit_event + agent_turn for a specific user's history when the user shares it. Never a bulk-read affordance.
External audit surface: Aggregate corpus pass-rate reporting, published in the annual model transparency report (per [[HIFP-actuarial-model-spec-v0.1]] §8).
Category-count over time, per-category false-negative rate on the last release, corpus version + last update, active-flag queue, escalation-response-time SLA, model-version + classifier-version deployment history. One page. Read-only. Exportable.
Read-along. [[HIFP-actuarial-model-spec-v0.1]] defines the outputs this gate wraps. [[HIFP-security-architecture-v0.1]] defines the compliance-officer scoped-JWT that makes the audit surface work. [[HIFP-compliance-foundation-v0.1]] provides the jurisdictional envelope this classifier operates inside.