Risk Policies

A risk policy turns evaluation metrics into a monitored risk level. It points at a risk scorer, configures that scorer’s parameters, selects which metric values it applies to, and aggregates the resulting scores into one number for the AI app. Where a policy answers pass or fail, a risk policy answers how bad.

# risk_policies.yaml
policies:
  - key: "harmful_content"
    display_name: "Harmful Content Risk Policy"
    domain: "safety"
    risk_scorer_key: "safety_risk_scorer"
    metric: "safety_score"
    scope:
      evaluation_keys: ["harmful_content"]
    config:
      impact: 7.0
    aggregation: "mean"

What a policy decides

Field Effect
risk_scorer_key, config The risk scorer to apply, and the values for the parameters it declares in its config_spec. The same scorer can therefore back several policies with different weights.
metric, scope Which metric values are fed to the scorer. scope: "all_latest" uses the latest run of every evaluation key in the app; a fine-grained scope narrows this by evaluation_keys, task_specification_keys, scorer_keys and metric_keys.
aggregation How the per-value scores combine into the reported score: mean, max (worst case) or min (best case).
domain The risk domain the policy is reported under, e.g. safety or quality.

The aggregated score lies in the 0–10 range and maps to a level: low up to 2, medium up to 4, high up to 9, and critical above that.

Working with risk policies

Register the scorer first with lf add risk-scorer, then apply the policy file with lf set risk-policies - which replaces all risk policies of the current app. Once the evaluations have run, lf overview risk-policies shows each policy’s score and level, and lf export risk-policies writes them back to YAML. See the risk policies guide for a quickstart.

Configuration

Properties

key string required

Unique identifier assigned to the entity in AI Platform.

Pattern: ^[a-zA-Z0-9_\-]+$
Max Length: 250

display_name string required

The risk policy’s name displayed to the user.

description string

Short description of the risk policy.

Default: None

domain string required

The domain this risk policy belongs to.

risk_scorer_key string required

The key of the risk scorer used by this policy.

scope PolicyRuleSimpleScope, PolicyRuleFinegrainedScope required

The scope of metrics this policy operates on.

config object

Configuration values for the risk scorer’s config_spec parameters.

Default: {}

aggregation string required

Aggregation method used to combine risk scores across the scope.

metric string required

The metric key this policy filters on when evaluating the risk score.

Risk Policies
policies:

- key: "quality_internal"
  display_name: "Quality Risk Policy (Internal)"
  description: >
    Monitors model accuracy on the QA evaluation for internally deployed systems.
  domain: "performance_and_reliability"
  risk_scorer_key: "performance_risk_scorer"
  scope:
    evaluation_keys: ["ai-knowledge-mcqa"]
  config:
    impact: 4.0
    deployment_reach: "internal"
  metric: "accuracy"
  aggregation: "mean"

- key: "quality_external"
  display_name: "Quality Risk Policy (External)"
  description: >
    Monitors model accuracy on the QA evaluation for externally deployed systems.
    External deployment amplifies the risk score relative to the internal policy.
  domain: "performance_and_reliability"
  risk_scorer_key: "performance_risk_scorer"
  scope:
    evaluation_keys: ["ai-knowledge-mcqa"]
  config:
    impact: 4.0
    deployment_reach: "external"
  metric: "accuracy"
  aggregation: "mean"