AxisOverride: a typed, recorded override
Overrides are first-class values, not comments in a Slack thread.
A human override of an AI decision is usually a Slack message or a ticket comment. It is unstructured, unhashable, and gone when the audit happens. The AxisOverride is the typed version: a first-class value, recorded in the chain, sealed with who changed what and when.
Human oversight is a design requirement, not a paragraph in a policy doc. The AxisOverride is how DEINO encodes it: a typed, recorded value that represents a human changing a parameter the model would otherwise use. It is not a comment; it is a value. It carries the axis changed, the old value, the new value, the actor who changed it, and a timestamp. It is part of the manifest provenance record — hash-linked into the same chain as the NodeVersions — so an auditor reading the manifest sees the override alongside the inputs.
Why it is typed
A Slack message that says we are overriding the risk threshold from 0.7 to 0.5 is a string. To know what it means, a human has to read it; to verify it was applied, a human has to check the code. An AxisOverride is a typed value — the axis is an enum, the values are typed fields, the actor is an identity. The compiler checks that the override is well-formed; the manifest records it as a structured field, not a free-text note. An auditor does not have to parse a Slack thread; they read a field.
Why it is in the chain
An override that is not in the chain is an override that can be denied. We never changed the threshold is a claim a Slack message cannot refute, because a Slack message can be deleted, edited, or lost. An AxisOverride in the hash chain cannot be edited without breaking the chain, cannot be deleted without leaving a gap, and is replayable alongside the inputs. The override is part of how the output was produced, and the manifest says so. That is what makes the override an audit artifact instead of a recollection.
An override that is not in the chain is an override that can be denied. The chain does not forget, and it does not edit.
- Typed: axis, old value, new value, actor, timestamp — fields, not prose.
- Hash-linked: in the same chain as NodeVersions; tampering breaks the link.
- Replayable: the manifest records the override; an auditor sees it with the inputs, not in a side channel.
What this does not do
The AxisOverride records that a human changed something. It does not record whether the change was right — that is a separate judgment, and the manifest refuses to assert it, the same way it refuses to assert the forecast was correct. Certified is not True: the override is certified to have happened, not certified to have been wise. The value of the typed override is that the question was there an override, and who made it has a definitive answer in the record, not a recollection in a meeting.
Oversight as a value, not a paragraph
The reason oversight is a design requirement and not a paragraph is that a paragraph does not survive an audit. A policy doc that says a human can override the model is a claim; an AxisOverride in the chain is evidence. The regulator who asks can a human intervene gets a yes from the policy and a record from the chain. We are building the POC; the override type is built, and the chain that holds it is built. The oversight is in the substrate, not the slideshow.
Oversight is a design requirement, not a paragraph. The AxisOverride is oversight as a value — typed, recorded, sealed. The chain does not forget who intervened.
— oversight design note