Which user-visible failure modes should trigger escalation from automated eval to human review?

Automated eval is fast and cheap, so use it for everything a rule or a classifier can reliably catch. **Human review** is expensive, so reserve it for failures where automation has a high false-negative rate AND the cost of missing the failure is severe. Three options fit that bar. A personalized factual error (wrong account balance, wrong dosage) is high-stakes and depends on this user's ground truth, which a generic metric does not know. PII leakage hides in subtle patterns that detectors miss. Harmful advice that already passed your safety classifier escaped automation by definition, so a human is the only remaining net. The other three are decoys because they are easy to measure. A 500-word length cap is a one-line check. Informal tone in a professional context is detectable by a style classifier or fixed with prompt tuning. Mildly off-topic but harmless content is low-stakes and catchable with relevance scoring. The trap is escalating on what is most visible rather than what is most dangerous to miss. Visibility and risk are different axes. Build automation for the visible and cheap failures, and route human reviewers to the rare, severe, hard to detect ones.

The escalation rule has two conditions. Escalate to a human when automated detection has a high false-negative rate AND the missed failure carries severe user harm. Three options pass that test. Personalized factual errors depend on this user's ground truth. A generic metric cannot verify a specific account balance or dosage. PII leakage hides in paraphrases and indirect references that pattern detectors miss. Harmful advice that slips past your safety classifier has, by definition, already defeated automation. The other three are decoys. They are visible but cheap to catch. A 500-word cap is a token count. Informal tone is a style classifier or a prompt fix. Mildly off-topic harmless text is low-stakes relevance scoring. None needs a scarce human reviewer as a primary trigger. This maps onto the online versus offline gap. Offline eval reliably catches length, format breakage, and gross policy violations on a fixed set. It misses the user-facing failures that emerge live: personalized wrong facts, subtle leakage, and confidently-wrong harmful advice that reads fluent. The design principle is simple. Route on risk times false-negative rate, not on visibility. Easy and visible goes to rules and classifiers. Rare, severe, and evasive goes to humans.