Global Success and Futility Boundaries for Platform Trials

Why Platform-Level Boundaries Need Their Own Rules

In a platform trial, an experimental arm can stop while the rest of the platform continues. That is an arm-level decision. A platform-level decision instead determines whether enrollment across the platform should stop because the trial objective has been met, because no remaining arm is promising enough to justify continuing, or because no experimental arms remain available. These outcomes should be specified separately: the same observed data may support stopping one arm but continuing the platform.

The boundaries below combine evidence across experimental arms at a defined interim analysis. They do not replace the arm-level efficacy and safety criteria used to decide whether an individual arm should continue. In particular, a global futility rule must not label a platform futile merely because one arm is unpromising.

The meaning of \(B_j\) must be fixed before the trial begins. For example, it might require that the treatment effect exceed a prespecified clinically meaningful threshold and that the risk of unacceptable harm remain below a prespecified limit. The posterior evidence \(q_j(t)\) is therefore not merely a measure of efficacy: it refers to the defined joint benefit-and-safety event. The earlier material on Joint Efficacy-Safety Decisions for Platform Arms concerns how such arm-level criteria can be constructed; here the focus is how to aggregate the resulting evidence across arms.

The rules also need to specify what “success” means for the platform. One common objective is to stop the platform and declare success if at least one experimental arm meets its success criterion. Another design might require a different prespecified combination of findings. The examples here use the at-least-one-arm objective; it is not a universal definition of platform success.

Global Success, Global Futility, and Arm Removal

Suppose the protocol specifies two posterior thresholds, \(c_S\) for success and \(c_F\) for futility, with \(0\le c_F<c_S\le1\). At a scheduled interim analysis, an active arm meets the success boundary if \(q_j(t)\ge c_S\), and meets the futility boundary if \(q_j(t)\le c_F\). Values between the thresholds do not cross either boundary. The protocol should state whether a boundary crossing is evaluated only at scheduled looks and what actions follow it.

The nonempty-set condition in the futility definition matters. For a nonempty active set, the condition that every arm is below or at the futility threshold can also be written using the largest arm-level evidence. There is no corresponding maximum over an empty set, so this alternative form is not used when no arms remain.

The equivalence follows directly from the definition of the maximum on a nonempty finite set. If every value is at most \(c_F\), their maximum is at most \(c_F\). Conversely, if their maximum is at most \(c_F\), each value is at most that maximum and therefore at most \(c_F\). The condition \(A_t\ne\varnothing\) is required for the maximum to be defined and to distinguish futility from arm exhaustion.

A global futility decision is different from removing an individual arm. If one arm crosses its futility boundary but another remains active and has evidence above \(c_F\), the platform has not met the all-arms global futility rule. The protocol may remove the unpromising arm and continue enrollment on the others. After any such removal, the active set changes, and platform-level rules are evaluated using the updated set at the specified decision time.

How the Platform Decision Is Applied

A platform protocol should set out a decision order, including when the active set is updated. One transparent sequence is to apply prespecified arm-level decisions, update \(A_t\), then apply the platform-level success and futility rules to the resulting set. If success is intended to terminate the entire platform, the protocol must say that explicitly; in some platforms, success for one arm may instead lead to a single-arm conclusion while other comparisons continue.

When the objective is platform-wide success upon evidence for at least one arm, a practical decision sequence is:

The ordering is a design choice that must be made clear, especially if arm-level and platform-level actions could be triggered at the same look. With a common \(q_j(t)\) and \(c_F<c_S\), a single arm cannot simultaneously meet both thresholds. Different arms can, however, be on different sides of the two thresholds. If a success crossing is defined to stop the whole platform, success takes precedence over the fact that other arms may be futile. If the design instead permits continuing other arms after one arm succeeds, it is using a different platform-level action and should state that policy explicitly.

Arm Exhaustion Is Not Global Futility

The active set can become empty because every experimental arm has already been removed or closed, whether for futility, safety, administrative reasons, or another prespecified reason. At that point, the platform cannot enroll to an experimental arm. This warrants an operational termination of experimental enrollment, but it does not itself establish that all arms were futile at the current look. The reasons for each arm’s closure should be retained and reported separately.

Calibration, Diagnostics, and Limitations

The thresholds \(c_S\) and \(c_F\) are design choices, not universal constants. Their practical consequences depend on the number of arms, the timing and frequency of interim analyses, the outcome model and prior distributions, the shared-control structure, the allocation process, and the rule for incorporating safety. For a Bayesian design, crossing a posterior boundary is not by itself a guarantee of a particular frequentist type I error rate or power. Operating characteristics such as the probability of a false platform success, the chance of stopping for futility under specified scenarios, and expected enrollment should be assessed under clinically relevant scenarios, usually by simulation.

Diagnostics should include checking that the active set at each look matches the arm-level history; confirming that every \(q_j(t)\) uses the prespecified data, model, and safety criteria; and verifying that the software handles \(A_t=\varnothing\) as exhaustion rather than taking a maximum over an empty set. Simulation or test cases should include at least one successful arm among futile arms, all active arms below the futility threshold, intermediate evidence that crosses neither boundary, and an empty active set.

The most direct alternative is to make decisions only at the arm level: stop arms that meet individual futility or safety criteria and continue the platform while any arm remains. That approach may be appropriate when the platform’s purpose is to pursue several comparisons independently, but it does not provide the same global declaration. A global rule, by contrast, explicitly links an overall platform objective to evidence across arms. Neither approach is automatically superior; the choice depends on whether the trial’s goal is an overall platform conclusion, independent arm conclusions, or both.

Another alternative is to keep enrollment open until a fixed sample size or a prespecified calendar endpoint, without interim global boundaries. This avoids interim platform stopping decisions but may continue enrollment after useful evidence has accumulated. Conversely, early stopping rules can make results more sensitive to model assumptions and interim timing. A sound design therefore states the objective, boundary thresholds, analysis schedule, active-set update, and operational actions in advance, then evaluates the resulting behavior under plausible data-generating scenarios.