Action Risk Classification

What it is

Assigning a comparable value to a proposed action before anything decides what to do about it. It produces a band or a number on a declared scale from declared inputs — reversibility, how many records or people are affected, monetary magnitude, whether the effect leaves the organisation, how long recovery would take — and it produces nothing else. What the system does with the value is somebody else's decision.

Scoring is not routing

A classifier that also blocks, or also summons an approver, is two things in one place, and the first symptom is that the scale can no longer be changed because every threshold downstream has been tuned to its current output. Keeping them apart means the scale can be recalibrated against incident evidence while the routing thresholds stay where the business put them, and it means one score can feed several consumers at once — an approval requirement, a stricter argument check, a longer retention on the audit record, a tighter rate limit — each with its own cut-off and its own owner. The score answers how bad this would be; it has no opinion about whether to proceed.

Why it matters

Without a shared scale, every control that needs to know how bad an action would be invents its own, and they disagree: the approval rule thinks a bulk email is serious, the audit rule thinks it is routine, and no one can explain the difference because neither wrote down what their levels mean. A common scale is also the only basis on which supervision can be spent where it does anything. A system that treats every write alike either reviews everything, which no organisation sustains past the pilot, or reviews nothing, which is the state most of them quietly reach.

Key decisions

• Whether the value is a property of the tool or of the call. A per-tool constant is trivial to maintain and wrong by several orders of magnitude for precisely the calls that matter.
• Which dimensions are scored and how they combine. Reversibility and reach are not interchangeable, and adding them together hides the action that is trivially small and permanently irreversible.
• Whether the inputs are observed or asserted: read from the arguments and the target system, or taken from the model's own account of what it intends to do.
• What a level means in concrete terms. A band is useless until it is anchored to something like an afternoon of one engineer's time, or a message a named customer receives.
• How a multi-step plan is valued relative to its steps, and whether value accumulates across a run rather than resetting at each call.
• How the scale is calibrated and revised: what evidence moves an action's level, who owns the scale, and how often it is revisited.
• Whether the value and its inputs are recorded, since the first question in any review is what the system believed the action was worth at the moment it took it.

Failure modes

• The value is attached to the tool, so removing one record and dropping a table are indistinguishable to everything downstream.
• The scale has five bands and almost everything lands in the middle one, because the people assigning them had no anchor and no cost for being vague.
• The classifier reads the model's stated intention rather than the arguments, so an action mislabelled by the model is valued by its description.
• Reach is computed from the arguments without consulting the target, so a filter matching every row in the table is valued as a single call.
• Values are produced and nothing consumes them: the field appears in the trace and no threshold anywhere refers to it.
• An action is valued low because each instance is small, and the run performs eleven hundred of them inside a minute.
• The scale is never revised after incidents, so actions that caused real damage keep the level they were given on the day their tool was registered.
• Irreversibility is judged by whether an undo endpoint exists, ignoring that the notification the action triggered has already been delivered and cannot be recalled.
• Two teams score the same action differently because the dimensions are described in prose with no worked examples, and nobody notices until their thresholds disagree in production.

Related capabilities

• Human Approval Gates — the consumer that turns a high value into an interruption
• Tool Guardrails — the consumer that turns a value into a tighter argument check
• Fail-closed Behavior — uses the value to decide what an unavailable check should cost
• Policy Enforcement — where the thresholds applied to a value are written down
• Autonomy Levels — the policy that says which values may proceed unsupervised

Applies: Production readiness · Design questions