Level 5 · In depth — Option B, Aitor, and Article 10

§4 — Option B: a defect you fix, a limit you declare

This is the heart of Level 5: three controls measure the same thing — one treatment, one set of tags — but only one of them can become a blocking verdict honestly. The governance decision (the course calls it Option B) is to tell apart the certifiable defect from the structurally non-certifiable limit, rather than either blocking on a threshold the sample cannot sustain, or manufacturing a green where there is none.

Recall the three controls in the signed manifest:

risk.feature-leakage — impact {individual HIGH, organization HIGH}, likelihood LIKELY; treatment = REDUCE (remove the leaked salary feature), residual_likelihood: UNLIKELY → residual MEDIUM (within appetite); control model-feature-leakage, enforcement: gate (the program’s ONLY blocking control). A safety defect (Art.15) that a code change fixes and a technical control confirms — fully resolvable, and in fact resolved at V2.
risk.inadequate-data — impact {individual HIGH, society HIGH}, likelihood LIKELY → inherent HIGH; treatment = REDUCE, but the real action is “acquire ≥500 representative records” (Art.10(3), a future line) — a DATA gap, not a code change; no residual_likelihood declared (you cannot estimate a residual over a sample that does not let you measure it); control data-sample-adequacy, enforcement: audit — measured, non-blocking.
risk.selection-fairness — impact {individual HIGH, society HIGH}, likelihood LIKELY; treatment = REDUCE with residual_likelihood: UNLIKELY → residual MEDIUM (within appetite, as a target); measured non-discrimination control selection-rate-disparity-gender, enforcement: audit (selection-rate parity by sex, citing Ley 15/2022 Art. 23). Genuinely measured, but at n=215 it is underpowered — the declared residual_likelihood: UNLIKELY was the treatment’s target; the honest runtime reading is that the sample cannot certify it, so the control stays advisory instead of gate.
Appetite: {individual: MEDIUM, society: MEDIUM, organization: HIGH}. overall_residual: level HIGH, criterion HIGH, evaluation = “within” — the aggregate residual does not exceed the global criterion, and no risk is above_appetite_untreated (all three carry a declared treat: block).

The decisive fact is that only model-feature-leakage is enforcement: gate. The other two are measured, not declarative controls (they are not “manual audit findings” — the engine measures them with real data; demographic_parity_diff and sample_adequacy_ratio are computed numbers, not checkboxes) but their enforcement is audit: they get computed, signed, and reported — and they do not enter the blocks_gate() computation. That is the precise technical difference between “we did not measure this” (which would be a real gap) and “we measured it, and measuring it honestly means not manufacturing a blocking threshold the sample cannot sustain.”

Why this is NOT the same as the override-with-motive red door

Other levels teach the override-with-motive “red door”: a measured, blocking residual that sits above appetite (residual-exceeds-appetite), or an untreated risk above appetite (untreated-above-appetite). In both cases there is a blocking verdict in the way that the approval consciously overrides. Here it is different: data-sample-adequacy and selection-rate-disparity-gender were never gate — the governance decision declared them audit before there was anything to override in the red-door sense. What James accepts at approval is not an exception to a technical block; it is the conscious acceptance of a documented advisory finding — the same governance act (ISO 23894 §6.5.2 / 42001 6.1.3), just without the red/amber verdict in the way. Honesty does not hinge on whether something blocks; it hinges on whether it gets measured, documented, and monitored.

The bundle is cryptographically valid at every beat — and now the verdict is a clean GREEN too

Do not confuse the verdict with the integrity of the evidence — as in the other levels, the signed bundle verifies at V1, V2, the request, and the approval: the signature is authentic and the digests are anchored at every beat, including V1 in red. What is new here is that, unlike other arcs in this course, the V2 verdict is a clean GREEN: froga run exits 0, with no amber or red flag — because the one blocking control passes and no blocking control is left inconclusive (selection-rate-disparity-gender and data-sample-adequacy do not count toward the verdict because they are not enforcement: gate). GREEN is not a façade here: it is what the engine certifies once the one defect it declared blocking is genuinely fixed.

What is a risk?The RED / AMBER / GREEN vocabulary, inherent vs. residual, appetite, and the difference between a gate control (blocking) and an audit control (measured, advisory) — the axis behind this level's Option B.

§5 — Aitor verifies (and does not certify)

This level introduces a new person: Aitor, an external auditor / buyer. While Nerea (product), James (Quality) and Martha (engineer) work inside Example Talent Corp, Aitor is outside — a counterparty who needs to know whether a supplier’s signed evidence is authentic and what state it is in.

Aitor runs one command:

# Aitor holds ONLY the supplier's public key — no private key, no source data, no model.
froga verify --pubkey <supplier-public-key>
# → confirms: the signature is AUTHENTIC (the bundle is what the signer claims it is)
# → and reads the honest state: gate GREEN, cycle APPROVED, with the data/fairness advisory residual on record

Two things happen, and both matter. First, the signature verifies: with only the public key — no private key, no data leaving the supplier — Aitor confirms the bundle is authentic, exactly what the signer claimed (Martha the evidence, James the approval). Second, Aitor reads the full honest state: he can see the gate is GREEN, the cycle is approved, and that James’s approval act carries the anchored motive for consciously accepting the advisory residual (data adequacy + selection fairness, both at n=215). The engine does not hide the residual from an external verifier behind a clean “GREEN”: the evidence tells the whole truth to anyone holding the public key — including the part that was not certified.

Aitor verifies authenticity — he does NOT certify conformity

Aitor is not a notified body and does not certify. Verifying a signature confirms the evidence is what the signer says it is — it does not confirm the product complies with the law. Aitor reading “the signatures verify, the gate is GREEN, and the advisory residual is on record” is a procurement / acceptance judgment (a buyer deciding whether to trust a supplier’s evidence and its honest state, including what the supplier chose NOT to certify), not a conformity judgment (an accredited, independent body issuing a recognized certificate). He has no accreditation, no NANDO designation, no certificate to issue. His value is exactly his honesty: he can establish authenticity and read the whole state — the certified green and the documented advisory alike — and he tells his principal the truth.

Notified body or self-declarationWhere Aitor fits: an external auditor / buyer who runs froga verify with only a public key to confirm authenticity and read the state — but who is NOT a notified body and does NOT certify. The page draws the sharp line between verifying a signature and certifying conformity.

§6 — Article 10 in depth, and Articles 9 / 13 / 14 revisited

Every level goes deep on one article of the Articles 9–15 spine. Level 4’s was Art. 12 (record-keeping). Level 5’s deep-dive article is Art. 10 (data and data governance) — because it is exactly where the certifiable/declarable distinction lives.

Art. 10 (data governance) — the deep-dive article. The data/fairness limit sits at the junction of two clauses:

Art. 10(3) requires training/validation/testing datasets that are relevant, sufficiently representative and, to the best extent possible, free of errors and complete in view of the intended purpose. A sample of n=215 for a selection-fairness claim is exactly what Art. 10(3) is about: not sufficiently representative or complete to certify that the selection is fair. data-sample-adequacy (sample_adequacy_ratio 0.43) is the engine’s measured expression of an Art. 10(3) shortfall — and precisely because of that, the control is audit, not gate: certifying against a threshold the sample cannot sustain would be the opposite error.
Art. 10(5) allows processing special-category data strictly for bias detection and correction in high-risk systems. The catch: you cannot do Art. 10(5)‘s bias detection without an adequate sample under Art. 10(3). With too few records, even the special-category processing Art. 10(5) permits cannot produce a fairness measurement defensible enough for a blocking gate. So the two clauses are linked: the Art. 10(3) gap limits Art. 10(5) certification — which is precisely why selection-rate-disparity-gender gets measured, documented, and consciously accepted, rather than blocking or being certified.

The data gap — when the residual cannot be measuredThe companion Foundations page grounding Art. 10(3)/(5): a sample inadequate under 10(3) limits bias certification under 10(5). This demo resolves the case with Option B (advisory + conscious acceptance); the page also covers the sibling case where the engine blocks with a hard integrity block.

The remaining spine articles get a brief pass, all declared / audit-only here (tracked, not runtime-gated):

Art. 9 (risk management). The same risk program drives the system: appetite {individual MEDIUM, society MEDIUM, organization HIGH}, the 5×5 matrix, the global residual criterion (HIGH, evaluation within), and the three controls (one blocker + two advisory). Note the honesty: overall_residual.evaluation is “within” and no risk is above_appetite_untreated (all three carry a declared treat:) — the engine does not need to force the aggregate residual to reflect that the system goes to market with a consciously accepted limit, not a hidden non-compliance.
Art. 13 (transparency to the candidate). Declared (audit-only): the candidate must be informed a screening system is in play, tied to RGPD transparency duties. Not a measured gate.
Art. 14 (human oversight / HITL). Declared (audit-only), anchored to RGPD Art. 22’s right to human intervention in a significant automated decision. The human in the loop is named and tracked, but — honestly — it is a declared commitment, not a measured control, and RGPD Art. 22 is declared, not litigated (no clause-by-clause DPIA; SCC/DPA pending).

The modality map — where this level sits

The course names the treatment class and control class at every level. Here:

The blocker (closes) — treatment modality: a code change — mitigate: true drops the leaked salary feature. Control: model-feature-leakage (leaky_feature_flag, objective, blocking, enforcement: gate), RED→GREEN. Bounded residual (UNLIKELY → MEDIUM, within appetite). Contrast Level 1 (a parameter change), Level 3 (a code change closing clean), Level 4 (a learner swap with fairlearn closing with a residual on record).
Data adequacy (advisory) — treatment modality: a data action — acquire ≥500 representative records, which is not a commit. Control: data-sample-adequacy (sample_adequacy_ratio, objective, measured, enforcement: audit), unchanged between V1 and V2. No bounded residual (residual_likelihood absent) → documented and consciously accepted at approval, without blocking.
Selection fairness (advisory, underpowered) — treatment modality: selection-rate-disparity-gender (demographic_parity_diff by sex, measured, enforcement: audit, citing Ley 15/2022 Art. 23). Genuinely measured, but n=215 leaves it underpowered. It declares residual_likelihood as a target (UNLIKELY), but the honest runtime reading is advisory; its resolution points back to acquiring data.
Deep-dive article: Art. 10 (data governance) — the 10(3)/(5) junction where the certifiable/declarable distinction lives.
Final state: GREEN, approved, with the data/fairness advisory residual consciously accepted and monitored post-market (Art.72).