Two Falsifiers: Should This Exist, and Was the Promise Kept?

Picture the last engagement you accepted. Everything was green. The reconciliation tied. The report had every section the schedule named. The model cleared its threshold on the held-out set. Somebody said “fantastic work” and the invoice went out.

Now ask the awkward question: what, exactly, was accepted?

Not what was delivered — that part is easy to list. What was accepted. What observation, if it had come out the other way, would have made a named person on the buyer's side say “no, that isn't the thing we bought”? In most engagements the honest answer is that no such observation existed. Acceptance was a feeling, held by several senior people at roughly the same time.

That is not a failure of those people. It is a missing instrument — and worse, it is a single instrument being asked to do two entirely different jobs.

The category error: one test, two questions

There is a distinction that fixes most of this, and it is short enough to put on a card. The outcome is what was sold. The test is the instrument by which we can legitimately say the outcome occurred. If I sell you a verified current-state architecture, the architecture is the outcome; the evidence coverage, the reconciliation checks and the human dispositions are the tests by which I can prove it.

Collapse those two and “outcome-based” reverts to vague consulting language, because there is nothing left that could fail. But separating outcome from test only gets you halfway, because the test itself is being asked to answer two questions that live at opposite ends of the engagement:

• Should this commercial object exist at all? Is this the right problem, the right boundary, the right placement of AI, the right buyer, an economics that closes?
• Was the promise, as written, actually kept? Does the bounded state exist, and is there evidence a stranger could check?

These fail independently. The premise can be sound and the delivery broken. The delivery can be immaculate and the premise dead. Any single instrument covering both moments is guaranteed to be the wrong shape for at least one of them.

The fields that already solved this

This is not a novel observation, and it is worth borrowing the vocabulary of the people who got there first. Systems engineering has separated the two questions for thirty years. Verification is “the confirmation, through the provision of objective evidence, that specified requirements have been fulfilled”¹. Validation is “the confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled”². One is measured against the specification you wrote. The other against what the buyer actually needed. Different processes, different references.

The FDA is blunter still. In its software validation guidance, “software testing is one of many verification activities intended to confirm that software development output meets its input requirements”³ — a regulator demoting the test to a component of a component. And it names the honest reason a promise needs a falsifier rather than exhaustive proof: “a developer cannot test forever, and it is hard to know how much evidence is enough”³.

The sharpest version comes from John Rushby, writing about the most rigorous software assurance standard humanity has built. Modern aircraft are extraordinarily safe and no serious airplane incident has been traced to faulty software — “some have been traced to faulty requirements for systems implemented in software, but that is outside the remit of DO-178C”⁴.

A world-class verification standard, applied perfectly, still leaves failures traced to faulty requirements — because requirement correctness is outside its remit.

That gap has a name in this piece. It is the entry falsifier, and nothing on the right-hand side of an engagement can fill it.

The Falsifiability Spine

The published sequence for a bounded AI-native engagement is Promise → Falsifier → Latitude → Evidence → Acceptance⁵. This piece splits the second joint in two, because the two falsifiers answer different questions, fire at different moments, and are owned by different people:

Read the spine as a load-bearing structure rather than a process. Remove the entry falsifier and production absorbs a dead premise. Remove method latitude and you are back to buying activity. Remove the evidence chain and the exit falsifier has nothing to fire on. Remove the exit falsifier and acceptance resolves to seniority.

The entry falsifier: should this exist?

The entry falsifier is a commercial instrument, written before signature, whose entire purpose is to be able to conclude that the supplier should not be paid to build the thing.

Its shape is a question with seven named answers. What evidence would make us say: wrong problem; wrong client; wrong promise; wrong commercial boundary; impossible economics; inappropriate AI placement; stop or redesign?

This is not risk-register decoration. It is the most under-served question in AI delivery. When RAND interviewed 65 experienced data scientists and engineers about why AI projects fail, the leading root cause was that “industry stakeholders often misunderstand — or miscommunicate — what problem needs to be solved using AI”, with models “optimized for the wrong metrics” or unfitted to the business workflow. Their fifth root cause is the one nobody writes into a contract: sometimes “the technology is applied to problems that are too difficult for AI to solve”⁶.

“Stop” and “reshape” must be valid accepted results

This is the claim most likely to be softened, so let me put it flatly: a responsible bounded service must permit a finding that the intervention should not proceed, and must be able to be paid for it. Without that, the entry falsifier is decoration — a sentence that quietly loses to the pipeline every time the quarter is thin.

Established practice already contains the pattern. Clinical trials run Data Monitoring Committees: independent bodies, chartered before enrolment, which can recommend the sponsor stop the trial because the product “is not effective”⁷. Note the four design rules packed into that guidance — the stop authority is named in advance, it is independent of the party doing the work, “is not effective” is an explicitly listed legitimate reason to stop, and the analysis uses planned interim procedures rather than improvised judgement.

The world's most-cited AI governance framework says the same thing in procurement language. NIST's AI Risk Management Framework asks, under MANAGE 1.1, for “a determination… as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed”⁸. Under MANAGE 2.1 it requires “viable non-AI alternative systems, approaches, or methods” to be taken into account⁸ — building nothing is on the table in the standard.

What the standard does not do is attach either determination to a price, a contract, or a named acceptance owner. That is the gap. Our own certainty-product doctrine puts it commercially: “doing nothing remains a legitimate disposition”, and the incentive test is unforgiving — firms that only celebrate exercised options will pressure consultants to recommend builds, while firms that celebrate correct non-exercise keep the mirror honest⁹.

The exit falsifier: was the promise kept?

The exit falsifier states what evidence would show the bounded promise was not kept, regardless of activity or technical elegance. Acceptance then means two things and only two things: the falsifier was not triggered, and the promised evidence chain is complete. Not that the buyer liked the answer.

It is not a stricter acceptance test. It is a differently shaped one — a negative observation rather than a positive threshold, which is exactly what stops it passing by accident. The auditing profession has been drafting in this register for decades. A limited assurance conclusion is “framed in a negative sense: ‘Based on the procedures performed, nothing came to our attention to indicate that the management assertion on XYZ is materially misstated’”¹⁰. That is an exit falsifier written as a professional opinion.

Three diagnostics you can run this afternoon

1. Could a competent third party run it? If it requires the author to interpret it, it is a preference, not a test.
2. Could it come back negative? Write the failing result as a sentence. If you cannot, there is no test.
3. Would a negative result change what the buyer does? If not, you are measuring something nobody cares about.

Write the consequence, not just the measurement

There is a hard-won drafting lesson here from an industry that has been writing bounded promises for a century. In Mears Ltd v Costplan Services (South East) Ltd, the parties had contracted a precise threshold — a room more than 3% smaller than drawn. The Court of Appeal held that the clause “simply provides a mechanism by which a breach of contract can be indisputably identified”, and that materiality attached to the room size, not to the consequence of the breach¹¹. The commentary draws the moral precisely: parties may deem a clause a condition, or deem that its breach precludes practical completion, “but if that option is taken, they should do so clearly”¹².

So: a measurable threshold is not automatically a falsifier. An exit falsifier is a stated observation plus a stated consequence. Write both, or you have written a metric.

Green tests, unkept promise

The reason all of this is worth the effort is a specific, repeatable failure: every implementation test passes and the promised state is still not achieved.

Take a migration sold as a bounded operational state: the target system running as the system of record, with the old one retired. The test suite is genuine and it is green. Row counts match. Checksums tie. Referential integrity holds. Every field maps. Reconciliation passes within tolerance on every account class.

And the promise is not closed — because the promised operational state also required authorised cutover and evidenced rollback capability, and neither is in the test suite. Nobody with authority signed the cutover. The rollback was never exercised against production-shaped data, so “we can roll back” is a belief, not a receipt. The tests answered did the mechanism transform the data correctly? They were silent on is this organisation now safely running on the new system? Both are honest questions. Only the second one was sold.

Medicine has the cleanest external name for this failure, and the most expensive example. A surrogate endpoint “does not measure the clinical benefit of primary interest in and of itself, but rather is expected to predict that clinical benefit”¹³. As Fleming and Powers put it, quoting Fleming and DeMets: “a correlate does not a surrogate make”¹⁴ — because the proxy is silent about off-target effects it was never watching.

The Cardiac Arrhythmia Suppression Trial is the case every acceptance-criteria author should know. Drugs that suppressed arrhythmia after myocardial infarction were in wide use on exactly that reasoning. The trial randomised only patients whose arrhythmia had already been successfully suppressed — the mechanism test passed, by construction, for every patient in the study. Over an average of ten months, patients on active drug had a relative risk of total mortality of 2.5 against placebo, and that arm was discontinued¹⁵. The mechanism worked. The commitment did not survive.

An implementation test does not measure the commercial benefit of primary interest in and of itself. It is expected to predict it. Every failure of this kind follows from forgetting that sentence.

The evidence chain: three instruments, and one hard rule

An exit falsifier is only as good as the evidence it can fire on, so every claim inside the promise gets assigned, in advance, to exactly one of three instruments.

Then the rule that makes the whole map honest: no single-model self-verification may be presented as independent proof.

This is not a prejudice about models; it is an empirical result. A 2025 study across more than 350 large language models found “substantial correlation in model errors — on one leaderboard dataset, models agree 60% of the time when both models err”, and crucially that “larger and more accurate models have highly correlated errors, even with distinct architectures and providers”¹⁶. In the judge setting, the same work finds that a judge “systematically inflates the accuracy of models that are less accurate than itself, due to correlated errors”¹⁶. A parallel study reports the trend plainly: “model mistakes are becoming more similar with increasing capabilities, pointing to risks from correlated failures”¹⁷.

Be fair to the other side of the literature: strong model judges can match human preferences at “over 80% agreement, the same level of agreement between humans”¹⁸. That makes model judgment a legitimate link in an evidence chain. It does not make it the closer. Ranking candidates is not the same job as closing a commercial promise, and an exit falsifier evidenced only by a second model — especially one from the same family — is an echo, not a check.

Method latitude: the middle you must not supervise

Everything above concentrates precision at the two ends. The corresponding discipline is that it must not leak into the middle.

The interior of a bounded engagement is supposed to look wasteful from the outside: eight framings built and six discarded, an evidence base assembled twice, a line of analysis that dies in week three on a constraint nobody declared. None of that is a change request. The buyer bought a state; the search that produced it is the supplier's business.

Traditional statements of work do close to the opposite. They protect the supplier by enumerating activity — conduct five workshops, interview twelve stakeholders, develop design, run analysis, hold weekly status meetings, prepare report. Those are descriptions of the middle. Which yields the governing rule of this section: the customer buys precision of intent and precision of outcome. They do not buy precision of internal procedure.

Aviation made this move deliberately. DO-178B was “a total re-write… to move away from the prescriptive process approach and define a set of activities and associated objectives that a design assurance process must meet”, which “allowed flexibility in the development approaches that could be followed”²⁰. Tight intent, loose method, hard verification — in the most safety-critical software domain there is.

Method divergence is not failure

Here is the corollary that gets forgotten. If the interior takes an unexpected route — a different decomposition, a different model, a different order of attack — and still produces the agreed provenance, coverage and acceptance evidence, that is the architecture working. Treating it as a deviation requiring explanation is how latitude gets clawed back one revision at a time.

Watch how that drift actually happens, because it never announces itself. The exit falsifier gets written. Then someone adds an evidence requirement. Then someone specifies the format that evidence must arrive in. The format implies a tool. The tool implies a method. Three revisions later the acceptance criteria are a specification of the interior, and nobody made a decision to supervise the middle — detail simply flowed downhill.

The fence: what a falsifier may attach to

A falsifier must attach to a state the supplier can keep and evidence. Not to the customer's business outcome. This is the fence, and it is the hardest line in the doctrine.

The evidence for taking it seriously is unusually good, because the public sector has run the experiment. The US GAO examined performance-based logistics arrangements and found that of fifteen programme offices, only one had updated its business case with actual cost and performance data — and “in the single case where the program office had updated its business case analysis, it determined that the performance-based logistics contract did not result in expected cost savings and the weapon system did not meet established performance requirements”²¹. Fourteen never re-tested the premise. The one that did, failed. And the performance data itself came from the contractors' own information systems, whose reliability the programme offices had never established²¹ — a correlated-checker problem written into a contract.

The Government Outcomes Lab at Oxford has catalogued what happens when the falsifier attaches to something the supplier only partly controls: “cherry picking”, “creaming” and “parking”, alongside a measurement-and-attribution problem in which it is “difficult to set simple, measurable outcomes that align effectively with complex social problems”²². That is Goodhart's law arriving on schedule — in Marilyn Strathern's formulation, “when a measure becomes a target, it ceases to be a good measure”²³. And there is a reason it bites harder here than elsewhere: “the importance of Goodhart effects depends on the amount of power directed towards optimizing the proxy, and so the increased optimization power offered by artificial intelligence makes it especially critical for that field”²⁴.

A spine, written out

Doctrine is cheap. Here is one complete spine for a bounded decision product — a fixed-price engagement whose promise is a decision-ready options pack for one named, dated decision. Every figure below is a worked model with stated assumptions, not a measured engagement.

Read the entry falsifier row again. It is not a risk statement. It names an observation, a window, and a consequence, and it is written by the party who loses revenue when it fires. That is what distinguishes it from a caveat.

The accepted stop

The case that decides whether any of this is real is the one where the entry falsifier fires and the supplier still gets paid.

A diagnosis engagement is sold: identify whether an AI intervention can reduce a specific operational backlog. In week two, the evidence says the binding constraint is not where anyone assumed — the queue is not slow because cases are hard to assess, it is slow because a single external authorisation step has a fixed turnaround the supplier cannot influence. The proposed intervention would make the assessable portion faster and move the aggregate not at all.

Under the old shape, three bad things happen. The engagement continues because it was sold. The supplier delivers a beautifully executed irrelevance. The buyer discovers it in production, after paying twice.

Under the spine, the entry falsifier fires. What the buyer receives is not a refund and an apology — it is the deliverable they actually needed: the evidenced identification of the real binding constraint, the demonstration that the proposed intervention cannot move it, the typed statement of what was and was not observed inside the boundary, and the conditions under which the finding should be reopened. The supplier is paid the agreed fee for the bounded engagement, because the promise was never “we will build you an intervention”. It was “we will establish, on evidence, whether this intervention can move this constraint”.

“Sometimes the right outcome of a certainty purchase is that the transformation should not proceed now. That is not a failed sale. It is the option resolving to zero exercise.”⁹

This is also where the entry falsifier stops being an ethical posture and becomes a commercial instrument, because it changes what a supplier is able to sell. A firm that can be paid for a correct stop can afford to look for one.

Popper, once

The logical shape underneath all of this is old. Popper's demarcation rests on an asymmetry: “it is logically impossible to verify a universal proposition by reference to experience… but a single genuine counter-instance falsifies the corresponding universal law”²⁶. Corroboration counts “only if it is the positive result of a genuinely ‘risky’ prediction, which might conceivably have been false”²⁶.

Take one thing from that and leave the rest to the philosophers: a test that could not have come out badly is not evidence, it is a ritual. And take the caveat too, because it matters commercially — even Popper allowed that in practice a single counter-instance is rarely sufficient for falsification on its own²⁶. A falsifier firing produces a disposition — kill, fix, or double-down, with the reopen conditions recorded — not an automatic termination²⁷.

Why this matters now

Outcome pricing is arriving in professional services before the adjudication problem has been solved. Roughly a quarter of McKinsey's global fees are now reported to come through outcome-based arrangements, with clients arriving with a result they want rather than a defined scope²⁸. The same reporting names the missing piece exactly: what the coverage does not tell you is “what baselines are set, who adjudicates whether a target was hit, and whether partner compensation changes as risk shifts from client to firm”²⁸.

Who adjudicates whether a target was hit. That is the exit falsifier and its named acceptance owner, and right now the answer in most engagements is whoever is more senior in the room at the closing meeting.

Monday

Take one live engagement and do four things.

1. Write the failing sentence. For your current acceptance criteria, write the result that would mean the promise was not kept, as a sentence, in the buyer's language. If you cannot, you do not have an exit falsifier — you have a deliverables list.
2. Add the consequence. Beside that observation, write what happens commercially when it is true. A threshold without a consequence identifies a breach; it does not close a promise¹¹.
3. Map the evidence. Three columns — deterministic check, bounded AI judgment, accountable human disposition — and put every claim in exactly one. Any row where the evidence is “the model checked its own work” is not evidence.
4. Write the entry falsifier you should have written. Retrospectively, for the engagement you are inside. Would it have fired? That is the cheapest possible test of whether your next proposal needs one.

What would falsify this argument

Honesty requires the same instrument pointed inward. There is no evidence that two-falsifier governance improves engagement outcomes; no such study exists, and the argument here is structural rather than empirical. What would test it: whether buyers who are offered an explicit entry falsifier treat it as confidence or as hedging; whether teams can in fact write an exit falsifier before the method is chosen, or only after; whether accepted-stop findings settle commercially outside strong existing relationships; and whether engagements carrying two falsifiers show fewer disputes at acceptance than matched engagements carrying one. If the first of those goes badly, this doctrine has a commercial defect, not a communication problem — and I would rather be falsified precisely than believed vaguely.

Everything else here is downstream of one sentence, so it may as well be the last one: tests tell you whether the machine worked; falsifiers tell you whether the commitment survived.