Composability
For Both Executive and Technical ReadersA large model composed of smaller models is only as sound as the seams between them. This page states what the seams require, and what goes wrong when they are skipped.
01 The Gap
No single model covers an enterprise. They have to compose, and most can’t.
No single .bayes file covers an enterprise. A fraud model covers account-level signals. A portfolio risk model covers book-level exposure. A regulatory capital model covers the whole balance sheet. Each was elicited from different experts, calibrated to different populations, and scoped to a different set of questions. When an enterprise question spans more than one of them, as most enterprise questions do, the answer requires composing their outputs into a single inference chain.
Composition is not concatenation. Passing the output of one model as input to the next is a claim about the world: that the boundary node between them satisfies specific graphical and semantic conditions. If those conditions are not met, the composed model produces numbers that look valid and are not.
The failure is silent. A composition that violates conditional independence at the seam does not throw an error. It propagates. The downstream model receives a distribution, runs valid inference on it, and returns a confident posterior. The confidence is not earned, it was computed against the wrong input. Nothing in the pipeline flags this unless the seam was checked before it ran.
02 Requirements
Five conditions. All necessary. None sufficient alone.
Five conditions must hold for two models to compose correctly. All five are necessary. None is sufficient alone.
1. An accurate, precise ontology
The boundary between models must reference a shared, unambiguous vocabulary, a named node set with fixed state spaces and documented semantics, meaning the same thing in both models. “High Risk” in Model A must mean the same thing as “High Risk” in Model B, same population, same threshold, same referent. This is enforced through Scope Cards in the Model Registry, which declare the interface explicitly.
2. Conditional independence at the boundary
The boundary node must d-separate the downstream model from the upstream internals. The downstream model must be able to treat the upstream posterior as a sufficient statistic, it must not need to reach inside the upstream model to reason correctly. If it does, the decomposition is wrong: either the boundary is in the wrong place, or the models share a latent variable that has not been made explicit.
3. Full distribution at the seam
The upstream model must pass a full posterior distribution over the boundary node's state space, not a point estimate, not a mode, not a threshold crossing. A point estimate discards the uncertainty that the downstream model needs to propagate correctly. A composition that passes 0.73 instead of {Low: 0.11, Medium: 0.16, High: 0.73} loses the variance. Any robustness analysis downstream is then blind to the upstream uncertainty.
4. Scope assumption compatibility
Each model's CPTs were elicited under a scope assumption: a population, a regime, a set of conditions under which the parameters are valid. When models compose, their scope assumptions must be compatible at the seam. A fraud model calibrated to consumer retail cannot feed a commercial lending portfolio model without an explicit compatibility check. The CPTs on both sides of the boundary may be correctly specified for their respective domains and still be incompatible as a composed system.
5. Correct graphical role at the seam
The boundary node plays one of three graphical roles relative to the path between upstream causes and downstream effects: Mediator, Collider, or Hidden common cause. Each role has different conditioning rules. Conditioning on a Mediator blocks a causal path that should remain open. Conditioning on a Collider opens a path that should remain blocked. The graphical role must be classified before the composition runs, not assumed.
Requirements 1 and 3 are structural and can be enforced by the pipeline. Requirements 2 and 5 are graphical and require d-separation analysis at the seam. Requirements 4 is a knowledge problem, it requires documented scope assumptions per model and an explicit compatibility check. The CompositionCertificate is the artifact that records whether all five were met.
03 Failure modes
Each unmet requirement produces a distinct failure. All are silent.
Each unmet requirement produces a distinct failure. All are silent.
| Requirement violated | What happens | Why it is hard to detect |
|---|---|---|
| Ontology mismatch | The downstream model receives a state it has no CPT for, or maps the upstream state to a different referent. | Inference runs. The posterior looks calibrated. The error is in what the node means, not in the arithmetic. |
| Conditional independence violated | The downstream model double-counts evidence that already propagated upstream. The posterior is overconfident. | Both models individually pass calibration. The overconfidence only appears in the composed system, under evidence that activates the shared path. |
| Point estimate at the seam | Upstream variance is lost. The downstream model treats a high-uncertainty 0.73 identically to a low-uncertainty 0.73. | The downstream posterior is numerically valid. Robustness analysis shows low sensitivity to upstream uncertainty, because the upstream uncertainty was never passed. |
| Scope incompatibility | The downstream model applies CPTs calibrated to a different population to an upstream posterior from a mismatched regime. | Both models are correctly specified for their own domains. The error is at the seam, invisible to per-model validation. |
| Wrong graphical role | Conditioning on a Collider opens a spurious path. Conditioning on a Mediator blocks a causal path. The estimand is wrong. | The d-separation violation only surfaces under specific evidence combinations. Routine queries may return plausible answers. |
The common thread: none of these failures produce an error code. The composed system runs, returns a number, and nothing in the output signals that a seam condition was violated. Detection requires checking the requirements before composition runs, not inspecting the output after.
Both models share the boundary node. The seam is where the five requirements must hold before any inference runs.
04 How EARA handles it
Stage 5 of the Pipeline enforces composition before inference runs.
Stage 5 of the Pipeline, Compose, is the enforcement point. It runs before any inference executes. The full mechanics are documented on the stage page: how Scope Cards enforce interface and scope requirements, how d-separation analysis classifies the bridge, and how the full posterior distribution is passed across the seam rather than a point estimate.
The output of a successful Stage 5 is a CompositionCertificate: the boundary node set, graphical role classification, d-separation result, scope compatibility check, and the full distribution passed across the seam. The certificate travels with the AuditRecord. A composed answer that cannot show its CompositionCertificate does not ship.
Stage 5 runs three checks in sequence. Any failure returns a structured refusal. All three must pass before Execute runs.
05 Query in plain English
What composition looks like from the outside.
What composition looks like from the outside, and what the pipeline is checking that the user never sees.
The CompositionCertificate is the artifact that makes a composed answer auditable. Without it, the answer has no seam record and no challengeable basis.
06 Where it sits
Enforced by the Model Registry and Pipeline.
Composability is not a separate component, it is Stage 5 of the Pipeline and a property enforced by the Model Registry. It becomes relevant whenever Stage 3 (Route) determines that the query requires more than one model. The Scope Cards that make routing possible also make composition checkable.
The upstream inputs are the Scope Cards from 01 Pipeline and the .bayes files built through 02 Discovery and 03 Evidence. The output is the CompositionCertificate, which travels with the AuditRecord to 12 BPMN Integration. A composed answer is indistinguishable from a single-model answer in the governance handoff, both arrive as a typed, versioned AuditRecord with full provenance.
Composability compounds. The first composition between two models requires establishing a shared interface from scratch. Every composition after that can reuse an interface the Registry has already validated, a third model built against the same “Account Risk” boundary node doesn’t re-derive the scope compatibility or graphical role classification; it inherits them. The cost of composing falls as the Model Registry grows, not because the requirements get easier to satisfy, but because fewer of them are being satisfied for the first time.