RC Rick Collettesecurity · AI · music · people
Concept

Risk Tier

concept-risk-tier · canon/concepts/risk-tier.md

Risk Tier. A governed classification of an action's consequence, used to decide how much evidence, approval, authority, rollback planning, and audit are required before execution.

A risk tier is not a label for UI sorting. It is an input to enforcement. Low tiers may allow policy-only execution or dry-run behavior. Higher tiers require stronger evidence, explicit approval, senior review, dual control, rollback plans, or denial. A tier ceiling in an action-rights envelope prevents an actor from attempting work above the risk the system has authorized for that actor, mode, and scope. The tier ceiling belongs to authority; the risk tier belongs to the action.

Risk also changes confidence behavior: a confidence gate may allow a low-risk suggestion while forcing the same confidence level to escalate or suppress a high-risk action.

Incoming References

Case Study 1
Pattern 3
Reference Architecture 1