Documentation / Platform glossary / False positive
A false positive is a legitimate case that a control incorrectly flags or restricts — a valid user blocked, a compliant document marked as a problem. It is a statistical certainty in any automated system, not a defect, which is why handling matters more than elimination.
Four outcomes are possible whenever a control classifies something. A true positive correctly identifies a real problem. A true negative correctly passes something legitimate. A false positive wrongly flags something legitimate. A false negative misses a real problem.
The tension is that false positives and false negatives trade against each other. Tightening a control to catch more real problems inevitably catches more legitimate cases; loosening it to reduce disruption lets more real problems through. There is no setting that eliminates both, so the question is which error is more costly in a given context.
That answer varies. For a security control protecting sensitive data, a false negative may be unacceptable and some friction is worth it. For a control gating routine work, false positives that block a whole team have their own severe cost — including the predictable outcome that people route around the control entirely.
Rate is what makes the discussion concrete. A control with a one-percent false-positive rate is excellent at low volume and produces thousands of incorrect outcomes at high volume. Precision matters more than accuracy when the flagged population is small relative to the total.
The organizational failure is not the false positive itself but the absence of a path to correct it. Without one, users develop workarounds, support cannot explain the outcome, and trust in the control erodes until it is bypassed or disabled.
A mature posture therefore assumes false positives will occur and provides a scoped, recorded correction path — which also produces the data needed to tune the control.
QueryTek treats incorrect restrictive outcomes as an expected operational case with a defined correction path, keeps corrections inside the affected tenant, and records them as audit evidence. Scoring models and thresholds are not published.
