Testland
Browse all skills & agents

guardrail-metrics-reference

Pure-reference catalog of guardrail-metric methodology for online controlled experiments. Defines guardrail metrics (metrics that must NOT degrade for an experiment to ship, even if the primary metric improves), the standard guardrail set (latency / errors / engagement / opt-out), the relationship to OEC (Overall Evaluation Criterion) per Kohavi et al., and pre-commitment of the metric set. The quantitative evaluation mechanics (per-metric alert/block thresholds, Bonferroni / Benjamini-Hochberg multiple-comparison correction) live in references/. Use when designing the metric set for a new experiment, auditing existing experiment configs, or reviewing experiment results before ship-decisions.

Install with skills.sh (any agent)

npx skills add testland/qa --skill guardrail-metrics-reference
View source

guardrail-metrics-reference

Overview

A guardrail metric is a measure that must not significantly degrade for an experiment to ship, even if the primary metric (the OEC - Overall Evaluation Criterion) improves. The guardrail prevents "we shipped 5% revenue improvement, but latency 30% worse and we discovered too late." Per Kohavi et al. Trustworthy Online Controlled Experiments (Cambridge Univ. Press, ISBN 978-1108724265), this is "the most important class of metrics after the OEC."

This skill is a pure reference consumed by the AB-test validity checklist and the SDK-test skills.

How to use this reference

  1. Pick the guardrail set for the experiment's surface (web / API / mobile / revenue / trust) from the canonical-set table.
  2. Declare each guardrail - metric, direction, block threshold - in the experiment config before launch (see the pre-commitment worked example below).
  3. Set two-tier levels per metric (alert + block), using max(%, absolute) on fast endpoints - see references/thresholds-and-corrections.md.
  4. Correct for multiple comparisons across the OEC + N guardrails (Bonferroni / FDR) - see references/thresholds-and-corrections.md.
  5. Gate the ship: block if any guardrail crosses its pre-declared block threshold, even when the OEC wins.

When to use

  • Designing the metric set for a new experiment.
  • PR review of experiment config changes.
  • Pre-ship review: did we have guardrails on the right things?
  • Investigating "we shipped X but Y broke" incidents.

The guardrail taxonomy

Four classes:

ClassExamplesWhy
Quality / engineeringAPI p95 latency, error rate, crash rate, time-to-first-byteA degraded experience is bad even with metric wins
EngagementDAU, MAU, sessions per user, time on siteEngagement loss is a strategic loss
RevenueGross revenue, conversion rate, ARPUDirect business impact
TrustOpt-out rate, unsubscribe rate, complaint rateLong-term churn signal

Microsoft's Experimentation Platform team writes that "we're always warning our customers to be vigilant when running A/B tests" and that "we warn them about the pitfalls of even tiny SRMs (sample ratio mismatches)" (A/B Interactions: A Call to Relax (opens in new window)). Tiny SRMs (per peeking-problem-reference sibling concept) and degraded guardrails are the canonical ship-and-regret sources.

The OEC vs guardrail relationship

  • OEC - the metric you want to improve (e.g., revenue, signups, retention).
  • Guardrail - the metric you don't want to break (e.g., latency, error rate).
  • Driver - intermediate metric that explains why OEC changes (e.g., click-through rate explains conversion).

Per Kohavi et al.: the OEC is one metric (or a weighted combination), declared in advance, with a power calculation. The guardrails are the rest of the dashboard - short-term loss is acceptable if within bounds, but a significant degradation blocks ship.

Standard guardrails - the canonical set

DomainGuardrailDirection
Web appTTFB, LCP, INP (Core Web Vitals)Should not increase
APIp95 / p99 latency, error rate, 5xx rateShould not increase
MobileCrash rate, ANR rate, app start timeShould not increase
EngagementDAU, sessions / user, retention day 7Should not decrease
RevenueGross revenue, average order value, conversionShould not decrease
TrustOpt-out rate, complaint rate, refund rateShould not increase

Per Kohavi et al.: always include a quality guardrail (latency / error) - the most-missed category in real experiments.

Pre-commitment vs post-hoc

Guardrails must be declared before the experiment starts. Per Kohavi et al.: post-hoc guardrails are p-hacking - if you look at 50 metrics, some will spuriously fail.

Worked example - declare every guardrail in the experiment config before the experiment starts:

experiment: feed-ranking-v3
oec: ctr_per_session
power:
  primary_metric: ctr_per_session
  expected_effect: +1.5%
  alpha: 0.05
  beta: 0.20
guardrails:
  - metric: api_p95_latency
    direction: not-increase
    block_threshold: +10% or +50ms
  - metric: dau
    direction: not-decrease
    block_threshold: -1%
  - metric: error_rate
    direction: not-increase
    block_threshold: +0.1pp absolute

The block_threshold on api_p95_latency uses the max(%, absolute) rule so a fast endpoint can't ship a small absolute regression that a percentage alone would miss.

Anti-patterns

Anti-patternWhy it failsFix
OEC + zero guardrailsCargo-cult "ship the metric improvement"Always include latency + error
Guardrails added after seeing resultsp-hacking variant; non-causalPre-commit guardrails
Same alpha across OEC + 50 guardrailsInflated false-positive rateBonferroni / FDR correction
Guardrail thresholds invented post-hocMove the goalpostsPre-commit thresholds
Single block-threshold (no alert level)Pass / fail; no surface for "investigate"Two-tier: alert + block
Guardrail in % only on fast endpoint10% of 10ms = nothing; ship a 9ms regressionUse max(% , absolute)
No mobile-specific guardrails on a mobile experimentWeb-shaped metrics miss crash / ANRPer-surface guardrails
Re-using last experiment's guardrails verbatimNew experiment, new failure modesPer-experiment review

Limitations

  • Guardrails are negative-defined. They prevent ship-and-regret; they don't measure success.
  • Latency-as-guardrail interacts with caching. A cache hit rate shift changes apparent latency without product impact.
  • Engagement guardrails are noisy. DAU varies with day-of- week, seasonality. Require longer experiments to surface signal.
  • Pre-commitment is hard to enforce. Code review of experiment configs is the only practical gate.
  • Guardrail-only dashboards miss the bigger picture. Pair with a counterfactual analysis dashboard.

Setting thresholds and correcting alpha - deep reference

Once the guardrail set is declared, the quantitative evaluation rules live in one companion reference:

  • Thresholds + multiple-comparison correction - per-metric alert/block levels (with the max(%, absolute) rule) and Bonferroni / Benjamini-Hochberg correction across the OEC + N guardrails: references/thresholds-and-corrections.md.

References

Guardrail thresholds and multiple-comparison correction

View source (opens in new window)

Guardrail thresholds and multiple-comparison correction

Deep reference for guardrail-metrics-reference SKILL.md. Consult when setting per-metric alert/block levels and correcting alpha across the OEC + N guardrails.

Setting guardrail thresholds

A guardrail typically has two levels:

ThresholdWhat
AlertA statistically significant degradation; investigate before ship
BlockA degradation past a pre-declared limit; ship-decision flips to "no"

Example for API latency p95:

LevelThreshold
AlertAny statistically significant increase
Block> 10% increase OR > 50ms absolute increase, whichever is greater

The "whichever is greater" handles fast endpoints where 10% is trivially small in absolute terms.

Multiple-comparison correction

With one OEC + N guardrails (typically 10-20), a fixed-alpha significance test means you'll see NĂ—0.05 false positives on average. Per Kohavi et al., apply Bonferroni or Benjamini- Hochberg correction:

MethodWhen
BonferroniStrict; alpha / N. Use when missing a true regression is catastrophic
Benjamini-Hochberg (FDR)Less strict false-discovery-rate control; use for general guardrail dashboards

Reference

  • Kohavi, Tang, Xu. Trustworthy Online Controlled Experiments (Cambridge University Press, 2020). ISBN 978-1108724265.

Related skills

ab-test-validity-checklist

Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics use guardrail-metrics-reference or peeking-problem-reference; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use optimizely-test or statsig-test - this gates DESIGN, not SDK code.

amplitude-experiment-test

Wraps Amplitude Experiment SDK testing patterns: client initialization with API key (or a bootstrapped local flag config for offline tests), the fetch / variant API, exposure-event suppression in tests, and assignment-integrity tests. Use when writing tests for code that uses Amplitude Experiment for A/B testing or flag management.

experiment-results-interpreter

Interprets the results of a valid online controlled experiment, one whose harness, SRM, and telemetry have already been confirmed. Covers the distinction between practical and statistical significance, reading confidence intervals instead of binary p-values, novelty and primacy week-over-week decay that causes post-ship reversion, interaction effects from concurrent experiments, Simpson's paradox in segmented results, and the ordered guardrail-check sequence required before a ship decision. Use when a data scientist or PM is ready to draw conclusions from an experiment whose telemetry and randomisation have already passed the ab-test-validity-checklist. Distinct from ab-test-validity-checklist (harness setup and SRM detection) and from interaction-effect overlap auditing during experiment design.

optimizely-test

Wraps Optimizely Feature Experimentation SDK testing patterns - client init from a fixture datafile (offline-friendly), the decide / decideAll v5 API, forced-decisions for per-test arm pinning (fixing which variation a user gets), OptimizelyUserContext + activate/track events, assignment-integrity (deterministic bucketing) tests. Use when writing A/B tests or feature-flag tests for Optimizely-instrumented application code. For another experimentation SDK use the matching harness - statsig-test, vwo-test, amplitude-experiment-test, or split-io-test; for experiment DESIGN gates not SDK code use ab-test-validity-checklist.

peeking-problem-reference

Pure-reference catalog of the peeking problem in online A/B testing. Defines the problem (repeatedly looking at experiment results inflates the false-positive rate above the declared alpha because each look is a separate test), the canonical mitigations (fixed-horizon test with pre-declared sample size; sequential testing with alpha-spending functions e.g., O'Brien-Fleming, Pocock; always-valid inference / mSPRT per Johari et al.), and the policy choices (data-peek schedule, stop-early thresholds, decision-time guard rails). Use when designing an experimentation platform's stop-early policy or auditing why a result was declared significant.

split-io-test

Wraps Split.io (Harness FME) SDK testing patterns: hermetic localhost/offline mode with an in-memory features map (JavaScript/browser) or a YAML fixture file (Node.js server-side), getTreatment and getTreatmentWithConfig evaluation, the SDK_READY event and whenReady() promise, impression listener verification, sync.impressionsMode configuration, and CI setup. Use when writing tests for application code instrumented with the Split.io or Harness Feature Management & Experimentation SDK.

statsig-test

Wraps Statsig SDK testing patterns - server-side statsig.initialize with an API key, gate / experiment / dynamic-config evaluation (checkGate, getExperiment, getConfig), local-evaluation offline mode, overrideGate / overrideConfig to force a user into an arm, assignment-integrity tests. Use when writing tests for Statsig-instrumented application code. For another experimentation SDK use the matching harness - optimizely-test, vwo-test, amplitude-experiment-test, or split-io-test; for experiment DESIGN gates not SDK code use ab-test-validity-checklist.

vwo-test

Wraps VWO (Visual Website Optimizer) SDK testing patterns: SDK initialization with the settings file (offline-capable), `getFeatureVariableValue` and `activate` API, force-bucketing for per-test assignment, and assignment-integrity tests against the bucketing algorithm. Use when writing tests for VWO-instrumented application code.