- Finance sets the floor from a signed operating cost file. No model, API, or salesperson chooses it.
- The check runs in the quote API before any rate is returned, and again before the rate confirmation is sent.
- Pass, review, and reject bands live in the cost file. Only a named, expiring executive override gets under the floor.
- An idempotency key stops a retry from slipping a lower body past a stored reject.
- A missing or stale cost file fails closed. There is no fallback to last week's rate.
Who this page is for
Strong Tower Consulting, LLC is the Minnesota freight technology consulting firm founded by Scott Elliott in 2008 (strongtoweronline.com). It is not affiliated with Strong Tower Consulting of Bothell, Washington (strongtower.consulting or strongtower.ai).
This page is the implementation architecture for the hard stop. The companion guide, freight rate predictive modeling and margin guardrails, covers how a transparent model is trained and how the fuel peg stays outside that model. A suggestion can be elegant and still be illegal to send. The check described here does not care which engine produced the number. It cares whether the number clears a floor finance has already signed.
Variable versus fixed cost per mile
A floor that mixes hope with cost will either block good freight or bless a loss. Split the build the way a controller already explains a truck. Variable cost moves with the mile or with the route: driver pay, fuel when it is not already on the quote as a peg, maintenance that scales with miles, and the toll estimate for this path. Fixed cost is real, but it is allocated: insurance, equipment capital recovery, and any overhead finance has chosen to recover in the mile. The floor is the sum finance will not sell below. It is not a target margin and it is not last month's average accepted rate.
What belongs in the floor is whatever the signed cost file lists for that equipment and that team flag, plus the toll adder, with fuel included or excluded according to the peg flag. What does not belong is detention, lumper, layover, a sales bonus, or a "strategic" discount stored as if it were cost. Those items either bill as accessorials or they are a commercial decision. If they are buried in the floor, every quote inherits a number nobody can audit. Practical miles are the distance basis. Billed miles that include a minimum or a negotiated circuity factor will inflate the floor on short hauls and hide it on long ones. The check uses the same mile figure the quote used, and it stores that figure on the decision row.
An illustrative solo dry van file, for teaching only, might list driver pay at $0.60 per mile, fuel at $0.60 per mile when the peg is not yet applied, maintenance at $0.12, insurance at $0.08, and equipment capital at $0.16. That is $1.56 per mile before tolls. When the quote already carries the fuel peg as a separate surcharge, the floor drops the $0.60 fuel line and becomes $0.96 per mile before tolls, so fuel is not collected twice. A team flag swaps the driver line for the team rate in the file. None of these cents are a market print. They are the shape of a file an auditor can recompute.
0.60 driver + 0.60 fuel + 0.12 maint + 0.08 ins + 0.16 capital = $1.56 per mile
Peg already on the quote: $1.56 - $0.60 fuel = $0.96 per mile
Case 1: 1.56 x 500 + $40 tolls = $820 floor
A proposed $900 linehaul clears that floor by 16 cents per mile, so it passes.
In the floor
- Cost file lines for this equipment and team flag
- The toll adder for this route
- Fuel only when the peg flag says it is not already applied
Keep out of the floor
- Detention, lumper, and layover
- A sales bonus or a "strategic" discount
- Billed miles with a minimum or circuity factor
Where the check sits
The check sits in the quote API, on the server, after a model, a tariff cell, or a person has proposed a linehaul and before that proposal is returned to any caller. The caller may be a customer portal, a load board adapter, an email bot, or a clerk screen. The screen is not the control. A hidden button can be bypassed with the same API the button calls. The response body for a reject or a review contains a reason code and no transmittable rate. A pass response may contain the rate, the floor version, and the decision id.
The same function runs a second time immediately before the rate confirmation is generated and sent. A quote that passed at 09:00 is not a coupon at 11:00. Finance may have published a new cost file. The toll estimate may have failed on the second call. The confirmation job loads the original inputs, rereads the current cost file, and recomputes. If the second result is review or reject, the confirmation is not sent and the quote is pulled back to a person. Logging the morning pass and skipping the second check is how a stale floor leaves the building.
- Load the original inputs. The confirmation job reads what the quote decision stored.
- Reread the current cost file. Finance may have published a new one since the quote.
- Recompute the band. A morning pass is not a coupon.
- Send only on pass. Review or reject pulls the quote back to a person and nothing is sent.
Inputs the check reads
The check reads a short, closed list. Practical miles must be present and greater than zero. Equipment must match a row in the cost file, such as solo dry van, team dry van, reefer, or flatbed. The fuel peg flag states whether the proposed linehaul already has fuel in it or whether fuel will be added by the contract table after the decision. The toll estimate is a dollar amount for this route, with its own timestamp. The team flag selects the driver line. The proposed linehaul is the dollar amount someone wants to transmit, not a confidence score. The cost file version is an identifier, a checksum, and an effective timestamp.
The check does not read a market index, a win probability, a shipper "tier," or the model's feature importance. Those fields may sit on the suggestion for a person to see. They cannot move the floor and they cannot open the transmit path. If miles, equipment, the fuel flag, the toll estimate, or the team flag is null, the call fails closed, which is covered below. A default of solo, a default of zero tolls, or a default that fuel is "probably already in" is a hole. Defaults that lower the floor are defects, not conveniences.
Pass, review, and reject bands
Finance publishes three bands in the same file as the costs. The numbers below are an illustrative policy, not a recommendation for any fleet. Pass means the proposed linehaul per mile, after the toll adder and after the fuel treatment, is more than 8 cents above the floor. The API may return the rate. Review means the proposal is at the floor or above it, through 8 cents above the floor. The API does not transmit. A named reviewer may release a review-band quote, and that release is logged. It is not an under-floor override. Reject means the proposal is under the floor by any amount the policy treats as real money. Half a cent is a reasonable float tolerance. Under that tolerance, transmit is closed.
Compare in total dollars and store both the dollar gap and the per-mile gap. A half-cent error on a 500 mile trip is $2.50, which the tolerance can absorb. A 2 cent miss is $10 and is a decision, not rounding. The band edges belong in the cost file so a code change is not required to tighten them. The decision row stores the band, the floor dollars, the proposed dollars, the file version, and the input hash.
| Band | Rule | Quote API | Rate confirmation |
|---|---|---|---|
| Pass | More than 8 cents per mile above the computed floor | May return the rate, the decision id, and the file version | Recompute before send. A later file can move the quote out of pass. |
| Review | At the floor, through 8 cents per mile above the floor | Does not transmit. A named reviewer may release, and the release is logged. | Does not send until that release exists and is unexpired. |
| Reject | Under the floor, beyond a half-cent float tolerance | Does not transmit. Returns a reason code and no rate. | Does not send. A named executive override is the only path through. |
| Fail closed | Cost file missing, stale, or no row for this equipment and team flag. Toll estimate missing. | Reject. Reason code says the floor was unavailable. | Does not send. Do not substitute zero tolls or last week's rate. |
No API, including a model, may transmit under the floor without a named override that is audited.
Override workflow
An override is a named exception for one quote id, not a new floor. The person must be on a finance-maintained list of executives allowed to sell below cost. A shared login, a pricing clerk, and the model service account are not on that list. The record stores the person's stable user id, the quote id, the reason code, the proposed dollars, the floor dollars, the cost file version, the time written, and an expiry timestamp. Illustrative expiry is the end of the same business day, or four hours, whichever the policy file says. When the expiry passes, the override cannot be reused, even on a retry of the same quote.
Reason codes come from a closed list finance edits: reposition to protect a driver domicile, a primary award the company already contracted, a documented data error under investigation, or a one-load commercial exception. Free text is allowed as a note and is not a reason code. The note does not satisfy the check. The confirmation job refuses to send unless the override row matches this quote id, the reason code is on the list, the user is still on the list, and the expiry is in the future. Editing the proposed rate after the override invalidates it, because the dollars on the override no longer match the dollars about to be sent.
Idempotency so a retry cannot slip under the floor
Quote calls are retried. A timeout, a load-board client, and a clerk who double-clicks will send the same request twice, and sometimes the second body is not identical. The API requires an idempotency key, either a header or a quote request id the caller generated. The first completed decision is stored with the key, an input hash, the band, and the file version. The hash covers miles, equipment, the fuel flag, the toll estimate, the team flag, the proposed linehaul, and the cost file version. A retry with the same key and the same hash returns the stored decision and does not recompute.
A retry with the same key and a different hash is a conflict. The API returns the stored decision, records the conflict, and does not run the check against the new body. That is the hole this rule closes. A caller that was rejected cannot immediately resubmit a lower cost, a solo flag on a team load, a zero toll, or a claim that fuel is already in the rate, and receive a pass on the same key. A genuine new price is a new quote id opened by a person, and it is checked from scratch against the current file. Keys are kept at least until the confirmation window for that quote has closed. Deleting the key to "clear a glitch" is an audit defect.
Failure mode when the cost file is missing
If the cost file is missing, unreadable, failing its checksum, not yet effective, or older than the freshness ceiling finance set, the check fails closed. Illustrative freshness is 24 hours for the cost file and 15 minutes for a toll estimate. The API returns reject with a reason such as FLOOR_FILE_MISSING or TOLL_ESTIMATE_MISSING. It does not fall back to last week's file, a lane average, a model suggestion, or a hardcoded $1.50. A stale-but-present file is also a failure once it passes the ceiling. "We used yesterday because the share was down" is how an under-floor rate ships during an outage.
The same closed behavior applies when the file is present but has no row for this equipment and team flag, when miles are missing or not positive, or when the fuel flag is null. Operators see "floor unavailable," not a price. The event is logged with the quote id, the missing input, and the time. Alerting finance is an operations task. It is not a reason to open the transmit path while they answer. When the file returns, new quotes compute normally. Quotes that failed closed are not silently replayed. A person opens them again so the idempotency rule stays intact.
Test cases an auditor can rerun
An auditor should be able to rerun the check from the decision row without calling a model. The row has the inputs, the file version, and the band. Recomputing the floor from that file version must match the stored floor dollars. The cases below use the illustrative solo floor of $1.56 per mile when fuel is not yet applied, $0.96 per mile when the peg is already on the quote, a team driver line $0.30 higher than solo, and tolls added in dollars. They are fixtures, not history from a carrier.
Each case states the inputs, the arithmetic, and the required band. A build that passes the happy path and fails case 4, case 5, or case 9 is not ready. Case 4 is the retry attack. Case 5 is the missing file. Case 9 is the confirmation job ignoring a newer file. Store the fixtures next to the service so a regression run does not depend on a person remembering them.
| Case | Inputs | Floor arithmetic | Required result |
|---|---|---|---|
| 1. Clear pass | Solo van, 500 miles, fuel not applied, toll $40, proposed linehaul $900 | 1.56 x 500 + 40 = $820. Gap is 16 cents per mile. | Pass. API may return $900. |
| 2. Thin review | Same inputs, proposed linehaul $850 | Gap is $30, or 6 cents per mile. | Review. No transmit until a named reviewer releases it. |
| 3. Under floor | Same inputs, proposed linehaul $800 | $20 under the $820 floor. | Reject. No rate in the response. |
| 4. Retry conflict | Same idempotency key as case 3, second body proposes $700 or zero tolls | Not recomputed. | Stored reject is returned. Conflict is logged. |
| 5. Missing file | Cost file absent or checksum fails | No floor. | Fail closed. Reason FLOOR_FILE_MISSING. |
| 6. Fuel already applied | 500 miles, peg already on the quote, toll $40, proposed $560 | 0.96 x 500 + 40 = $520. Gap is 8 cents exactly. | Review. Exactly 8 cents is not a pass. Fuel is not subtracted again. |
| 7. Team flag | Case 1 inputs but team is true. Team floor adds 0.30 x 500. | Floor becomes $820 + $150 = $970. Proposed $900 is under. | Reject. The solo floor must not be used. |
| 8. Expired override | Quote was rejected. Override expiry was yesterday. Send is attempted today. | Floor unchanged. | Reject. The expired override does not authorize a send. |
| 9. Confirmation recheck | Case 1 passed at 09:00. A new file at 10:00 raises the solo floor by $0.20 per mile. | New floor is 1.76 x 500 + 40 = $920. Proposed $900 is under. | Confirmation is not sent. The morning pass is not a coupon. |
Boundary with the rate model
The model, if the carrier uses one, writes a suggestion and a reason onto a replica or a side table. It does not write a transmitted rate and it does not open a session to a shipper portal. The quote API is the only component allowed to return a rate, and only after this check. A tariff matrix is under the same rule. A cell in a rate matrix can propose a number. The floor still wins. Training hygiene, holdout bias, and cold-start pools are specified in the companion guide. They are not reopened here, because a perfect holdout does not replace the refusal.
Neural bidding is not an exception to the gate. A neural network, a boosted tree, a regression, and a clerk keying a spot rate all stop at the same function. Confidence is not an override. A high win probability is not an override. The explicit position of this framework is that no quoting product, including any model branded as autonomous bidding, is allowed to transmit under the floor. A carrier evaluates the hard stop on the stack it already runs.
What the audit log keeps
Every call, including fail-closed calls, appends a row the quoting service cannot update. Corrections are new rows. The row holds the quote id, the idempotency key, the input hash, each input, the file version, the computed floor dollars, the proposed dollars, the band, the reason code, the user or service account, and the time. Override rows are a separate append-only stream linked by quote id. An auditor samples a week by recomputing fixtures and by tracing one live decision from proposal to confirmation, or to a refusal.
Retention follows the carrier's rate-confirmation policy, with an illustrative floor of 24 months so a later claim can be tied to the file that was in force. Access to the log is read-only for pricing and for internal audit. The service account that writes quotes cannot delete log rows. If the log store is down, the check fails closed. A rate that cannot be explained after the fact is not a rate the API is allowed to send.
Frequently asked questions
These answers restate the control in the form a controller, a pricing lead, and an auditor ask it. They do not add a second floor, a second owner, or a silent exception for models.
Use them as the acceptance script for the quote API. If a demo disagrees with one of these answers, the demo is not implementing this hard stop.
Who sets the operating cost margin floor?
Finance sets the floor from the carrier's operating cost file. The pricing model, the quote API, and a salesperson do not choose it. No API, including a model, may transmit a rate under the floor unless a named person records an override that is audited.
Where does the hard stop run before a rate goes out?
The check runs inside the quote API before any rate is returned to a portal, a load board, or an email. It runs again before the rate confirmation is generated and sent. Hiding a button on a screen is not the control.
Which inputs does the floor check read?
The check reads practical miles, equipment, whether the fuel peg is already applied, the toll estimate, and the team flag. It reads the proposed linehaul and the version of the cost file. It does not read a market index or a model confidence score as a substitute for the floor.
What happens when the cost file is missing?
The check fails closed. It rejects the quote and writes a reason code that the floor was unavailable. It does not fall back to last week's average, a lane average, or the model suggestion. A missing file is not permission to send.
Can a retry of the same quote slip under the floor?
No. The API stores the decision on an idempotency key. A retry of that key returns the stored decision. It does not recompute against a lower proposed rate or a different cost file. A new price requires a new quote id opened by a person.
Make the floor a refusal, not a suggestion.
Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Contact our advisory team or call 763-244-1373 to discuss your operational data and evaluate practical implementation paths for your fleet.
Published October 23, 2026 by Strong Tower Consulting, LLC. Founded 2008 in Minnesota by Scott Elliott.