Human Signoff Matrix
Which decisions Eli automates and which always require a person. This is enforced in code (lib/reconciliation/decision.ts, lib/auto-approve.ts), not by policy alone.
Last reviewed: 2026-06-26. Status: current.
The two automated outcomes
Only when an institution opts in to straight-through processing, and only for its cleanest cases:
| Decision | Condition | Human required? |
|---|---|---|
auto_clear | High confidence (≥ threshold, default 0.85), all verified items within tolerance, all required docs in, no conflicts | No, unless the institution requires a second reviewer |
auto_correct | High confidence, corrections needed, all required docs in, no conflicts, and the corrections pass the self-check guardrail | No, unless the institution requires a second reviewer before the federal write |
The qualifier (lib/auto-approve.ts) is deliberately conservative: an institution must turn auto-approval on, the case must already be a clean clear/correct, the confidence must meet the institution's threshold, no conflicting information may be outstanding, every required document must be in, and the case must not already be resolved. Any one failing pulls the case to a human.
Always routed to a human (hard overrides)
These route to a person regardless of AI confidence (hardOverrides() in lib/reconciliation/decision.ts):
| Category | Why | Citation |
|---|---|---|
| Identity verification (V4 / V5) | A human must confirm the government photo ID (in person, live video, NIST IAL2, in-person notary, or correctional official) | 34 CFR 668.57 |
| Professional judgment (PJ) appeals | Aid-administrator discretion; Eli prepares, a human decides | HEA §479A |
| SAP appeals | Eli scores GPA / pace / max-timeframe; the administrator decides reinstatement | 34 CFR 668.34 |
| Return of Title IV (R2T4) | Eli computes the earned/unearned split; a human verifies the withdrawal and commits the return | 34 CFR 668.22 |
| Non-filer income the IRS could not confirm | Not considered verified; needs human review | — |
| Conflicting information | A document contradicts the application; a reviewer must resolve it | 34 CFR 668.16(f) |
| Household-size mismatch | A signed written explanation is required before any correction | — |
| Any case below the confidence threshold | Composite confidence < 0.85 (configurable) routes to human | — |
The guardrail before any federal write
Before an auto_correct writes to the federal system, a self-check (lib/analysis/selfcheck.ts) looks for a sign flip, an order-of-magnitude error, or a value that contradicts the documents. A concern only ever routes the case to a human; it can never clear a case. If the self-check service is unavailable it fails conservatively (does not block) and surfaces the degradation to monitoring.
Optional second reviewer
An institution can require that a different reviewer sign off before any correction is transmitted (segregation of duties; lib/server-actions.ts, supervisorSignOffFps()). The preparer cannot also release.