Chapter 6. Risk Classification: The Five Dimensions

S2 in detail. This is the longest treatment in the handbook because nearly every tier-scaled decision in IRGF depends on getting it right, and because scoring is where implementations most often go quietly wrong.

6.1 Why five dimensions

Twelve candidate risk factors were considered during design: autonomy, decision impact, reversibility, data sensitivity, financial impact, safety, legal exposure, stakeholder impact, model uncertainty, external exposure, scale, and systemic impact. Scoring all twelve independently would force assessors to make distinctions that are rarely independent in practice. A decision severe enough to cause major financial harm is very often the same decision carrying major legal exposure.

They were consolidated into five composite dimensions, each scored 1 to 4.

Table 16. Why five dimensions

The consolidation is a considered trade of precision for usability. It has not been empirically tested for whether it loses discriminating power in edge cases, and that remains an open question in the research. Where you find a case the five dimensions cannot separate, record it; those cases are exactly what a future recalibration needs.

6.2 D1 — Decision Consequence Severity

The question: if this system produces a wrong output and that output is acted on, how severe is the consequence?

Two clarifications prevent most scoring errors. D1 asks about the consequence of being wrong, not the value of being right. A system that saves considerable money when correct but causes trivial harm when wrong scores low on D1. And D1 assumes the output is acted on; the probability that a human catches the error belongs to D2, not here.

Table 17. D1 — Decision Consequence Severity

The D1 = 4 threshold is consequential. A score of 4 triggers the safety-override floor and forces at least Tier 3 regardless of every other dimension. Assessors under delivery pressure feel that weight and reach for 3. The countersignature control (§7.6) exists largely for this boundary.

A useful test for the 3/4 boundary: would a reasonable person affected by a wrong output describe the result as a serious harm, or as an inconvenience they could get fixed? If someone loses access to a service, a benefit, or money they cannot readily recover, it is 4.

6.3 D2 — Autonomy

The question: how much human judgment sits between the system’s output and its effect on the world?

Table 18. D2 — Autonomy

The formal-versus-effective autonomy problem

This is the most important caveat in the entire scoring model, and it is an unresolved weakness instead of a solved one.

A system scored D2 = 1 because “a human makes every decision” may carry far higher effective autonomy if the human approves essentially everything the system proposes. Automation bias is well established: when a system is usually right, review degrades into assent. The framework’s stress-testing surfaced this specifically for advisory clinical and advisory financial systems, where the formal score understated real autonomy substantially.

IRGF does not solve this. What it asks you to do is detect it.

[Practice recommendation] For any system scored D2 = 1 or 2 where D1 is 3 or 4, instrument the override rate — the proportion of recommendations the human changes or rejects. Review it at the first post-deployment assurance cycle. An override rate approaching zero over a meaningful volume is evidence that effective autonomy exceeds the recorded score, and it should trigger a re-score rather than a note. Set the threshold in advance so that the conversation is about a pre-agreed number rather than an argument after the fact.

Two architectural options reduce the problem more reliably than policy does. Design the oversight point so the human must supply something the system did not (a reason code, a selection among genuinely different options), not merely clicking approve. And cap autonomy in architecture rather than in policy: a system that has no technical path to act cannot drift into acting.

6.4 D3 — Reversibility Deficit

The question: if a wrong outcome occurs, how hard is it to undo?

D3 is scored against consequence reversibility, not mechanism reversibility. This anchoring was tightened during the framework’s revision because the original wording invited a serious error.

The error looks like this. An agent sends an incorrect email to a customer. The mechanism is trivially reversible: delete the record, send a correction. The consequence is not reversible at all, because the customer has read it. Scoring D3 = 1 on the basis that the database row can be rolled back is wrong. Ask whether the effect on the world can be undone, not whether the system’s state can be.

Table 19. D3 — Reversibility Deficit

Communication to a third party, disclosure of information, and execution of a financial transfer are the three most commonly mis-scored cases. All three are usually 3 or 4 regardless of how easy the system-side rollback is.

6.5 D4 — Exposure and Scale

The question: how many parties are affected, how far outside the enterprise does the effect reach, and can effects cascade?

Table 20. D4 — Exposure and Scale

The cascade clause carries more weight than most assessors give it. A system with a small direct user population that writes into a system of record consumed by many others scores on the reach of the consequence, not the size of its own user base.

D4 is also the dimension most likely to change without anyone noticing. A pilot released to twelve internal users and later opened to customers has moved from 1 to 3 or 4. That change is classified Major and re-enters classification, which is why user-population change appears in the change model in Chapter 14.

6.6 D5 — Data Sensitivity and Model Uncertainty

The question: how sensitive are the inputs, and how well understood is the behavior?

D5 fuses two things that the source standards generally keep separate. The framework’s own review found the fusion loses information, and the revision requires both sub-scores to be recorded alongside the composite even though the tiering formula uses only the composite.

Record all three. Score the composite as the higher of the two sub-scores, not their average, so that highly sensitive data in a well-understood model is not diluted into moderation.

Table 21. D5 — Data Sensitivity and Model Uncertainty

Most generative systems will not score below 3 on model uncertainty. That is appropriate rather than a scoring inflation problem: confident plausible error is a real property of these systems, and the framework should reflect it.

6.7 Scoring in practice: who, when, how long

Scoring is a short, structured conversation, not a workshop. A well-run S2 for a typical system takes under an hour with the right people in the room.

Table 22. Scoring in practice: who, when, how long

Every score carries a one-line justification. This is not bureaucracy: the justification is what a re-score six months later compares against, and it is what makes the countersignature meaningful. A score without a justification cannot be challenged, only overruled.