A Facial-Recognition Alert Scored 0.83. I Built the Gate That Blocked It

A raw FaceFirst score of 0.83 could not create consent for a synthetic Chicago facial-recognition alert, so the deterministic policy gate blocked it. I built that scenario to test whether a biometric system treats governance as part of the decision or as paperwork added after the decision is already moving.

The alert is LP-0834, a deliberately seeded scenario in Chicago. It is not a customer event, a live feed, or a real person’s case. The probe is an 80-pixel, low-light capture compared with a 15-year-old booking photo. FaceTrust calibrates the raw score to 0.50, with an interval of [0.217, 0.783] and a 93% conformal prediction set containing both {mate, no_mate}. But the decisive fact is simpler: no consent is on file, so the deterministic policy gate blocks the scan under the demo’s seeded BIPA rule.

I keep returning to that ordering. A model may offer evidence. It should not get to decide that a missing legal precondition can be ignored because its score looks persuasive.

The full breakdown shows the interface, video, and how the mechanism works. What follows is the harder lesson I took from building it: if a control can only explain a bad action after the fact, it arrived too late.

What I thought 0.83 meant

I began with the number because that is where the eye goes. On the seeded queue, LP-0834 sits beside other alerts with raw scores from 0.81 to 0.91. A glance makes them look like variations of the same thing: strong matches waiting for an operational response. The queue encouraged my own reflex to rank first and question later.

That reflex is precisely what I wanted to examine. A raw vendor score is an input from one recognition system. It does not tell me whether collection was permitted, whether the capture was good enough for the decision at hand, or whether the uncertainty around a calibrated result still includes a non-match. Yet a score rendered with two decimals can feel finished. Its visual precision outruns its decision authority.

I found the neighboring rows useful because they denied me an easy rule. TX-1190 carries a raw score of 0.81 and routes to ESCALATE because its calibrated evidence remains unresolved. CA-0006 carries 0.88 and routes to CONFIRM, which means a trained reviewer may action it, not that the system may confront anyone automatically. SF-0002 carries the highest raw score of the four, 0.91, and still routes to BLOCK because the seeded jurisdiction table marks facial recognition as prohibited in San Francisco.

The rows are synthetic by design, but the design question is concrete: what information is allowed to overrule the score? If the answer is “nothing,” the surrounding compliance process is ornamental. If lawfulness and uncertainty can change the route before an alert reaches an operating team, governance has become executable.

A high score can strengthen evidence. It cannot create consent or repeal a prohibition.

The moment the score lost control

I opened LP-0834’s dossier expecting the calibration panel to carry the scene. The 0.83 raw score falls to a calibrated match probability of 0.50. The interval stretches across 0.217 to 0.783, and the prediction set contains both possible labels. The evidence does not support certainty.

Then my attention moved down the panel to the consent finding. That is where the route is settled. The capture is 80 pixels, so it is above the demo’s sub-72-pixel capture floor. The gallery photo is 15 years old, which the dossier records as a reviewer and audit flag but does not use as an independent routing gate. The lack of consent is different. It triggers BLOCK.

I struggled with this hierarchy more than I expected. Calibration is mathematically interesting, and an interval feels like the sophisticated answer. But if I let the uncertainty story dominate, I risk suggesting that a more favorable probability could rescue the scan. It cannot rescue a missing precondition. The deterministic policy gate has to evaluate lawfulness independently of the model’s confidence.

This changed the way I explained the product to myself. FaceTrust demonstrates the Biometric Decision Firewall. It is not another facial-recognition engine. A stubbed vendor adapter normalizes the alert, a local calibrator expresses uncertainty, and deterministic controls choose among BLOCK, SUPPRESS, ESCALATE, and CONFIRM. The Compliance Reviewer can draft a readable memo after those structured facts exist, but it does not control the route. In this demo, that memo is prepared and cached or comes from a deterministic template fallback.

I wanted the boundary to be visible because language models are good at producing explanations that sound coherent. A coherent memo is not a lawful basis. Advice belongs after the route is fixed by inspectable rules, not before it as a persuasive substitute.

I had to stop treating calibration as a verdict

I kept wanting one calibrated probability to do more work than it could. That was my failed mental model during the build: replace a raw score with a better score, then use the better score as the decision. LP-0834 broke that shortcut because the 0.50 result still needed an interval, a prediction set, a consent check, a jurisdiction check, and a human process around any permitted action.

The 93% conformal prediction set matters because it changes the system’s vocabulary. When the set contains both {mate, no_mate}, FaceTrust does not compress ambiguity into a confident label. It can route a lawful but unresolved alert to ESCALATE. When evidence rules out a match, it can SUPPRESS. When the set contains {mate}, a CONFIRM route still means trained-reviewer action, never automatic confrontation, detention, or accusation.

I switched from the queue to the assurance view because a single dossier could not answer the coverage question. On the deterministic synthetic held-out test set of 3,000 alerts, the nominal 93% conformal sets achieved at least 91.5% empirical coverage across six evaluated Fitzpatrick groups. The raw baseline’s minimum was 40.6%. The interface shows held-out coverage across the six evaluated Fitzpatrick groups.

Those figures are not production claims. The test set is synthetic, seeded to model documented failure modes, and production calibration would need a client’s adjudicated history. I include the result because it shows what I should inspect instead of admiring an overall score: the weakest evaluated group, under a stated test design, with scope attached.

The chart also restrained my instinct to celebrate the nominal target. A 93% target does not mean every group lands at exactly 93%, and it certainly does not mean the system is 93% accurate in the open world. The display gives me a coverage diagnostic. It does not give me permission to generalize beyond the synthetic held-out test set.

Uncertainty becomes useful only when the workflow is allowed to act differently because of it.

The replay made the operational cost visible

I ran the fixed synthetic replay to see what the hierarchy would do at workflow scale. Across its 364 alerts, the raw threshold would produce 303 confrontations. The firewall instead produces 121 human-review routes and blocks 179 alerts, a 60.1% reduction under that replay’s counting method. The reduction belongs to this seeded replay, not to a customer deployment or a production promise.

I did not read the result as “automation handled more.” In fact, the design is valuable because it refuses to automate the final human consequence. It filters out prohibited or no-consent scans, suppresses evidence that rules out a match, and places unresolved or credible cases into defined trained-review paths. The operational shift is from score-driven momentum to route-specific responsibility.

The held-out benchmark tells a similarly bounded story. Among 1,566 synthetic impostor alerts, the raw baseline would confront at a 69.3% rate, while the firewall’s confirm rate is 3.8%, a 94.5% reduction by that definition. On 1,434 synthetic true-match alerts, the match remains in the firewall’s prediction set 93.1% of the time, compared with 99.3% for the raw-threshold baseline. The comparison exposes a trade: preserving more true matches is easy if the system is also willing to act on far more impostors.

That trade changed how I read “fewer alerts,” which would be a poor goal by itself. A system could reduce workload by discarding difficult cases indiscriminately. Here, the reason for each route stays attached: consent, jurisdiction, capture floor, calibrated prediction set, or evidential exclusion. The route is explainable because the inputs to the route are explicit.

This is also why enrollment age remains a flag rather than an independent gate in the demo. LP-0834’s 15-year-old booking photo is relevant context for a reviewer and an audit. Pretending that the demo has a universal age rule would add certainty the brief and implementation do not support.

I wanted the refusal to survive inspection

I opened the evidence view after the replay and looked at the route beside its record. LP-0834 does not end as a colored badge. Each decision creates a SHA-256 hash-chained record, and the interface can export a printable HTML audit exhibit. The refusal has provenance.

I have become wary of systems that are explainable only through a generated paragraph. A paragraph can summarize the facts, but it cannot prove that the route was fixed before the prose was written or that the underlying record has not been silently replaced. The hash chain does not make the decision correct by itself. It makes later alteration detectable within the chain and gives an investigator a stable artifact to inspect.

That distinction keeps the audit claim honest. This demo is not a compliance certification, a legal opinion, or a substitute for counsel and operating controls. It uses a seeded synthetic footprint, stubbed vendor adapters, and simulated statute and consent tables. It has no live camera, VMS, vendor engine, NIST, liveness, or customer-data connection. It proves a mechanism and an ordering, not a production outcome.

I can imagine the future challenge clearly: not “show me the memo,” but “show me what the system knew, which deterministic rule fired, who remained responsible for action, and whether the record changed afterward.” The audit exhibit is designed for that sequence of questions.

The rule I carried out of the build

I no longer see facial-recognition governance as a layer that begins once a match has been declared. By then, the alert has already inherited momentum. Someone sees a high score, the operating process starts, and every later safeguard has to argue against an apparent conclusion.

The LP-0834 scenario gives me a stricter rule: lawfulness must be evaluated before evidential confidence can authorize a route, and evidential confidence must be expressed with uncertainty before a person is asked to act. The trained reviewer remains responsible for what follows a CONFIRM or ESCALATE route. BLOCK and SUPPRESS have to be legitimate outcomes, not error states waiting to be overridden.

That is the judgment behind the Biometric Decision Firewall. Agents may prepare readable advice, but deterministic controls set the route. The walkthrough and full breakdown show how FaceTrust makes that separation visible.

And if you would rather see it than read me describe it, here is the whole thing running end to end.

I started with a score that looked strong enough to pull the eye forward. I ended with a refusal grounded in a missing precondition, bounded evidence, and a record that can be inspected. The most responsible decision in the system is sometimes the one that prevents the score from becoming an action.