You have to report guardrail coverage for an application protected by a rail stack that combines deterministic rules, similarity-matched routing and a judge-model self-check. The three layers share no denominator. How do you report coverage without inventing one number that misleads?

### There is no single right answer here, but there is a wrong one The wrong one is a blended percentage. Aggregation requires a shared unit, and these three layers do not have one. **Deterministic rules** have a genuine denominator: the flows and rules actually written in the deployment's `config.yml` and Colang files. *Rules exercised over rules configured* is countable and honest. It is also the least interesting figure in the report, because it says nothing whatsoever about payloads for which nobody wrote a rule. **Similarity routing** has no enumerable denominator at all. The set of phrasings that could express an intent is unbounded; the framework decides by embedding the turn, taking the nearest canonical form from the `define user` blocks, and applying `embeddings_only_similarity_threshold`. What you can report is a fall-through rate over deliberately constructed paraphrase families, plus the existence and behaviour of the unmatched path. **The judge-backed self-check** is a rate: k of n replays approved, for one payload family, against one named judge model and one prompt template. A count over a finite authored set, a sample from an unbounded space, and a repeat-rate. Averaging them picks a unit silently, and the unit it picks is whichever one has the most items. ### The failure mode that proves the point A blended coverage figure can be moved by an edit that changes nothing about the application's exposure. Add ten flows to `config.yml` that no test touches: the exercised count is unchanged, the denominator grows, and "coverage" falls. Delete an unused rule and coverage rises. **Any metric a no-op edit can move will eventually be moved by one**, usually in the week before a review, and usually by someone acting in good faith. That is the argument to make out loud, because it does not depend on anyone agreeing with your taste in reporting. ### What it costs to produce each number Worth saying in the report, because the three are not comparable work. The rules-exercised figure is nearly free — it falls out of a run you were doing anyway, from the trace's activated-rails list. The judge rate costs 2n model calls per payload family across its life (n to measure, n to re-verify after a fix), which at n=30 with judge and downstream generation is hundreds of calls and an hour of wall clock per family. The routing rate is the most expensive of all and most of the cost is human: authoring paraphrase families that are genuinely meaning-preserving, then re-running them every time the example set, threshold or embedding model moves. A report that quotes all three as if they cost the same invites a request to "just refresh the numbers weekly" that nobody has budgeted. ### The structure that survives contact with an audience - **Per layer**: the number, its denominator stated in words, and how it was measured. - **A named uncovered set**: harms with no rule and no canonical example, and the unmatched routing path. This row deliberately has no number — that is what stops a reader summing the others and calling the remainder small. - **A validity window**: rule-set version, example set and similarity threshold, embedding model, judge model and prompt template. Change any and the numbers expire. - **One qualitative verdict in a sentence**, so the audience that wants a headline gets one you wrote rather than one they derived. ### Where the number misleads, and the organisational pressure Someone will ask for the single figure anyway, usually for a slide, and "82% guardrail coverage" will be read as "we are 82% safe" by people who will never see the rows. The productive counter is to offer a different headline: the ranked list of what is ungoverned. It is decision-relevant and it does not degrade into a safety score. If you must give a number, give the one with a real denominator — rules exercised — and label it plainly an *exercise* metric. Two further points separate a strong answer. First, **the layers run in series, so coverage is not additive in the direction people assume**: a payload class's exposure is set by whichever layer it can walk past, not by the mean of the three, and averaging lets a well-tested input rail mask the routing hole that is actually being used. Second, the routing layer's coverage argument is **structurally unbounded** — you cannot enumerate a continuous space, so no number of added examples ever closes it. That is the real argument for making the unmatched path deny by default: it is the only change that converts an unbounded coverage claim into a bounded one. ### What you would check Before publishing any of the three figures, confirm the denominators are what you think: read the flows actually loaded from the run log rather than from the file you edited, confirm which threshold and embedding model were live, and confirm the judge identity from the run rather than the config. Then re-read your own summary sentence and ask whether a reader who sees only that sentence would be misled. If they would, the sentence is the deliverable to fix, not the table.