guardrail-metrics-reference
Pure-reference catalog of guardrail-metric methodology for online controlled experiments. Defines guardrail metrics (metrics that must NOT degrade for an experiment to ship, even if the primary metric improves), the standard guardrail set (latency / errors / engagement / opt-out), the relationship to OEC (Overall Evaluation Criterion) per Kohavi et al., and pre-commitment of the metric set. The quantitative evaluation mechanics (per-metric alert/block thresholds, Bonferroni / Benjamini-Hochberg multiple-comparison correction) live in references/. Use when designing the metric set for a new experiment, auditing existing experiment configs, or reviewing experiment results before ship-decisions.
Install with skills.sh (any agent)
npx skills add testland/qa --skill guardrail-metrics-referenceguardrail-metrics-reference
Overview
A guardrail metric is a measure that must not significantly degrade for an experiment to ship, even if the primary metric (the OEC - Overall Evaluation Criterion) improves. The guardrail prevents "we shipped 5% revenue improvement, but latency 30% worse and we discovered too late." Per Kohavi et al. Trustworthy Online Controlled Experiments (Cambridge Univ. Press, ISBN 978-1108724265), this is "the most important class of metrics after the OEC."
This skill is a pure reference consumed by the AB-test validity checklist and the SDK-test skills.
How to use this reference
When to use
The guardrail taxonomy
Four classes:
| Class | Examples | Why |
|---|---|---|
| Quality / engineering | API p95 latency, error rate, crash rate, time-to-first-byte | A degraded experience is bad even with metric wins |
| Engagement | DAU, MAU, sessions per user, time on site | Engagement loss is a strategic loss |
| Revenue | Gross revenue, conversion rate, ARPU | Direct business impact |
| Trust | Opt-out rate, unsubscribe rate, complaint rate | Long-term churn signal |
Microsoft's Experimentation Platform team writes that "we're always warning our customers to be vigilant when running A/B tests" and that "we warn them about the pitfalls of even tiny SRMs (sample ratio mismatches)" (A/B Interactions: A Call to Relax (opens in new window)). Tiny SRMs (per peeking-problem-reference sibling concept) and degraded guardrails are the canonical ship-and-regret sources.
The OEC vs guardrail relationship
Per Kohavi et al.: the OEC is one metric (or a weighted combination), declared in advance, with a power calculation. The guardrails are the rest of the dashboard - short-term loss is acceptable if within bounds, but a significant degradation blocks ship.
Standard guardrails - the canonical set
| Domain | Guardrail | Direction |
|---|---|---|
| Web app | TTFB, LCP, INP (Core Web Vitals) | Should not increase |
| API | p95 / p99 latency, error rate, 5xx rate | Should not increase |
| Mobile | Crash rate, ANR rate, app start time | Should not increase |
| Engagement | DAU, sessions / user, retention day 7 | Should not decrease |
| Revenue | Gross revenue, average order value, conversion | Should not decrease |
| Trust | Opt-out rate, complaint rate, refund rate | Should not increase |
Per Kohavi et al.: always include a quality guardrail (latency / error) - the most-missed category in real experiments.
Pre-commitment vs post-hoc
Guardrails must be declared before the experiment starts. Per Kohavi et al.: post-hoc guardrails are p-hacking - if you look at 50 metrics, some will spuriously fail.
Worked example - declare every guardrail in the experiment config before the experiment starts:
experiment: feed-ranking-v3
oec: ctr_per_session
power:
primary_metric: ctr_per_session
expected_effect: +1.5%
alpha: 0.05
beta: 0.20
guardrails:
- metric: api_p95_latency
direction: not-increase
block_threshold: +10% or +50ms
- metric: dau
direction: not-decrease
block_threshold: -1%
- metric: error_rate
direction: not-increase
block_threshold: +0.1pp absoluteThe block_threshold on api_p95_latency uses the max(%, absolute) rule so a fast endpoint can't ship a small absolute regression that a percentage alone would miss.
Anti-patterns
| Anti-pattern | Why it fails | Fix |
|---|---|---|
| OEC + zero guardrails | Cargo-cult "ship the metric improvement" | Always include latency + error |
| Guardrails added after seeing results | p-hacking variant; non-causal | Pre-commit guardrails |
| Same alpha across OEC + 50 guardrails | Inflated false-positive rate | Bonferroni / FDR correction |
| Guardrail thresholds invented post-hoc | Move the goalposts | Pre-commit thresholds |
| Single block-threshold (no alert level) | Pass / fail; no surface for "investigate" | Two-tier: alert + block |
| Guardrail in % only on fast endpoint | 10% of 10ms = nothing; ship a 9ms regression | Use max(% , absolute) |
| No mobile-specific guardrails on a mobile experiment | Web-shaped metrics miss crash / ANR | Per-surface guardrails |
| Re-using last experiment's guardrails verbatim | New experiment, new failure modes | Per-experiment review |
Limitations
Setting thresholds and correcting alpha - deep reference
Once the guardrail set is declared, the quantitative evaluation rules live in one companion reference:
References
Guardrail thresholds and multiple-comparison correction
View source (opens in new window)Guardrail thresholds and multiple-comparison correction
Deep reference for guardrail-metrics-reference SKILL.md. Consult when setting per-metric alert/block levels and correcting alpha across the OEC + N guardrails.
Setting guardrail thresholds
A guardrail typically has two levels:
| Threshold | What |
|---|---|
| Alert | A statistically significant degradation; investigate before ship |
| Block | A degradation past a pre-declared limit; ship-decision flips to "no" |
Example for API latency p95:
| Level | Threshold |
|---|---|
| Alert | Any statistically significant increase |
| Block | > 10% increase OR > 50ms absolute increase, whichever is greater |
The "whichever is greater" handles fast endpoints where 10% is trivially small in absolute terms.
Multiple-comparison correction
With one OEC + N guardrails (typically 10-20), a fixed-alpha significance test means you'll see NĂ—0.05 false positives on average. Per Kohavi et al., apply Bonferroni or Benjamini- Hochberg correction:
| Method | When |
|---|---|
| Bonferroni | Strict; alpha / N. Use when missing a true regression is catastrophic |
| Benjamini-Hochberg (FDR) | Less strict false-discovery-rate control; use for general guardrail dashboards |
Reference
Related skills
ab-test-validity-checklist
Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics use guardrail-metrics-reference or peeking-problem-reference; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use optimizely-test or statsig-test - this gates DESIGN, not SDK code.
amplitude-experiment-test
Wraps Amplitude Experiment SDK testing patterns: client initialization with API key (or a bootstrapped local flag config for offline tests), the fetch / variant API, exposure-event suppression in tests, and assignment-integrity tests. Use when writing tests for code that uses Amplitude Experiment for A/B testing or flag management.
experiment-results-interpreter
Interprets the results of a valid online controlled experiment, one whose harness, SRM, and telemetry have already been confirmed. Covers the distinction between practical and statistical significance, reading confidence intervals instead of binary p-values, novelty and primacy week-over-week decay that causes post-ship reversion, interaction effects from concurrent experiments, Simpson's paradox in segmented results, and the ordered guardrail-check sequence required before a ship decision. Use when a data scientist or PM is ready to draw conclusions from an experiment whose telemetry and randomisation have already passed the ab-test-validity-checklist. Distinct from ab-test-validity-checklist (harness setup and SRM detection) and from interaction-effect overlap auditing during experiment design.
optimizely-test
Wraps Optimizely Feature Experimentation SDK testing patterns - client init from a fixture datafile (offline-friendly), the decide / decideAll v5 API, forced-decisions for per-test arm pinning (fixing which variation a user gets), OptimizelyUserContext + activate/track events, assignment-integrity (deterministic bucketing) tests. Use when writing A/B tests or feature-flag tests for Optimizely-instrumented application code. For another experimentation SDK use the matching harness - statsig-test, vwo-test, amplitude-experiment-test, or split-io-test; for experiment DESIGN gates not SDK code use ab-test-validity-checklist.
peeking-problem-reference
Pure-reference catalog of the peeking problem in online A/B testing. Defines the problem (repeatedly looking at experiment results inflates the false-positive rate above the declared alpha because each look is a separate test), the canonical mitigations (fixed-horizon test with pre-declared sample size; sequential testing with alpha-spending functions e.g., O'Brien-Fleming, Pocock; always-valid inference / mSPRT per Johari et al.), and the policy choices (data-peek schedule, stop-early thresholds, decision-time guard rails). Use when designing an experimentation platform's stop-early policy or auditing why a result was declared significant.
split-io-test
Wraps Split.io (Harness FME) SDK testing patterns: hermetic localhost/offline mode with an in-memory features map (JavaScript/browser) or a YAML fixture file (Node.js server-side), getTreatment and getTreatmentWithConfig evaluation, the SDK_READY event and whenReady() promise, impression listener verification, sync.impressionsMode configuration, and CI setup. Use when writing tests for application code instrumented with the Split.io or Harness Feature Management & Experimentation SDK.
statsig-test
Wraps Statsig SDK testing patterns - server-side statsig.initialize with an API key, gate / experiment / dynamic-config evaluation (checkGate, getExperiment, getConfig), local-evaluation offline mode, overrideGate / overrideConfig to force a user into an arm, assignment-integrity tests. Use when writing tests for Statsig-instrumented application code. For another experimentation SDK use the matching harness - optimizely-test, vwo-test, amplitude-experiment-test, or split-io-test; for experiment DESIGN gates not SDK code use ab-test-validity-checklist.
vwo-test
Wraps VWO (Visual Website Optimizer) SDK testing patterns: SDK initialization with the settings file (offline-capable), `getFeatureVariableValue` and `activate` API, force-bucketing for per-test assignment, and assignment-integrity tests against the bucketing algorithm. Use when writing tests for VWO-instrumented application code.