Your save-flow AI proposes a 98%-confidence “lifetime price lock” to all 2,400 exit-attempt customers today. Single- confidence routing auto-approves it. Route on 4 axes.

The enterprise decision-engine layer is mature. FICO Blaze + Pega Decisioning + IBM ODM + Camunda DMN + Drools + OpenL Tablets + Provenir + DataRobot each ship strong primitives at the rule-execution layer — versioning, audit, observability, explainability hooks, A/B test infrastructure. The fraud + AML surface (Feedzai + NICE Actimize + ComplyAdvantage + FICO Falcon) ships strong primitives at the high-stakes-decision layer. Each is excellent at its core. None ships with a per-vertical 4-axis threshold matrix that the operator can tune per dimension against precision-recall, a per-segment override workflow that respects per-cohort risk asymmetries, an explainability chain that surfaces which dimension drove each auto-approve, or a 30-second rollback to last-known-good config.

The matrix is four axes. Confidence — model certainty about the output (the existing single-threshold axis). Risk — loss magnitude times probability times consequence severity if the decision is wrong (a refund approval is low-risk if refund cost is bounded by the subscription price; a margin-permanent offer is high-risk regardless of confidence). Scope — single- customer vs cohort vs broadcast vs systemic impact (a 60%- confidence single-customer decision is safer than a 98%- confidence broadcast decision in many cells of the matrix). Claim type— routine adjustment vs permanent pricing change vs compliance-affecting vs irreversible commitment (the claim-type axis is what distinguishes “10% off month 3” from “lifetime price lock”).

The four dimensions combine into a per-decision routing weight that drives auto-approve / escalate / block. The matrix is per-vertical (subscription operator looser than financial- services operator on routine discounts; cannabis operator tighter than generic ecommerce on compliance review). The explainability chain surfaces which dimension drove each auto-approve and each escalate. The 30-second rollback to last-known-good config is the safety net that lets the team tune thresholds aggressively because the cost of a bad tune is bounded by time-to-rollback, not by time-until-someone- notices.

The CFO-finds-out-Friday pattern stops being a recurring Monday morning. Broadcast-scope + irreversible-claim-type decisions route to escalation regardless of confidence; the Tuesday lifetime-price-lock-at-2,400-customers offer hits the queue Wednesday morning instead of the customer base Wednesday afternoon.

Analyst-time-burned-on-safe-cases stops being the recurring ops complaint. Single-customer + routine-claim-type + bounded-risk decisions at 60% confidence auto-approve when the matrix says they should; the review queue stops carrying the safe single-customer cases the old single-confidence threshold over-escalated.

The bad-tune fear stops being a barrier to threshold experimentation. Tuning the matrix aggressively to chase precision-recall is safe because the cost of a bad tune is bounded by the 30-second rollback to last-known-good config; the cost is not bounded by the time-until-someone-notices a metric drift on a dashboard nobody is watching at midnight.

The CFO conversation about AI-decision risk stops being a defensive explanation. The explainability chain answers in a query — which axis drove the auto-approve for decision #847,392 at 14:03 Tuesday; which threshold version was in effect; which override (if any) fired.