Risk Tiering

Classifying work or changes by risk level and applying proportionate rigor, controls, and human oversight—framed at the retreat as the new core engineering discipline for AI-assisted development.

Also known as: risk tiering as the new core engineering discipline

Part of: Agentic Engineering

How authors use it

Oldest first (extraction date when no publication date is known).

Documents (16)

• Stop Automating Old Processes. Design New Ones Instead. Masha Shunko and Serguei Netessine · 2026-09-14 source ↗ Reader 🖥️
  Enterprise AI investment fails to produce enterprise-wide returns not because companies under-automate but because they redesign individual tasks instead of the surrounding workflow, so managers must treat the workflow — not the task — as the unit of redesign, deciding explicitly what to change, where human authority remains, and how the process degrades when the model is uncertain or wrong.
• Brownfield Agentic Engineering Addy Osmani · 2026-09-14 source ↗ Reader 🖥️
  Agentic engineering in an old (brownfield) codebase succeeds by making hidden, undocumented constraints explicit and the cost of a wrong change cheap and visible — through human-drawn risk zones, durable research artifacts, characterization tests, migrations completed as whole units, and review that scales with blast radius rather than code volume — not by maximizing agent autonomy or parallelism first.
• Article: When Spec-Driven Development Pays Off Nitin Garg · 2026-09-10 source ↗ Reader 🖥️
  Treating a specification as a versioned, approved governance baseline does not make code reviewers find more AI-generated bugs, but it does convert each finding from a hunch into an attributable claim tied to a named requirement and an accountable human decision-maker — a benefit real enough to justify its measurable time cost only on hard, multi-constraint work built by capable-but-imperfect models, not as a universal practice.
• Human Oversight Is Not a Human in the Loop Gustavo Bataller · 2026-08-27 Reader 🖥️
  Meaningful human oversight of AI systems is not achieved by keeping a person nominally 'in the loop'; it is an institutional capability jointly produced by context, competence, sufficient time and attention, independence, and real, exercisable authority to intervene — and when any one of these conditions is missing, a human's formal presence preserves only the appearance of control, not control itself.
• Human judgment doesn't leave the software factory. It relocates. Addy Osmani · 2026-08-21 source ↗ Reader 🖥️
  As software development moves from hand-coding to operating repeatable, event-driven 'software factories' of coding agents, human judgment does not leave the loop -- it relocates upstream to intent, system design, and the quality bar, and downstream to verification design, risk, and ownership of what ships -- so the best factories are defined by how intelligently they place human attention, not by how completely they remove it.
• Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers Sergio De Simone · 2026-08-18 source ↗ Reader 🖥️
  A centralized policy, attribution, and auditing layer sitting behind a shared MCP portal can safely upgrade AI agents from read-only to fine-grained, tool-specific write access without requiring per-server code changes or a separate agent-identity system.
• Expanding Daybreak as the Cyber Defense Window Narrows | OpenAI OpenAI · 2026-08-10 source ↗ Reader 🖥️
  OpenAI is expanding vetted, tiered access to reduced-refusal cybersecurity models (culminating in GPT-5.6-Cyber via Daybreak Red) on the bet that arming trusted defenders with near-unrestricted frontier capability now, while access can still be gated by identity and legal controls, produces a net defensive advantage before attackers deploy comparable autonomous offensive AI at scale.
• I've been wearing two AI recorders. Only one belongs near a client. Ernie Svenson · 2026-07-28 Reader 🖥️
  Whether an AI recorder belongs near a client turns not on audio fidelity, price, or even which vendor's security/compliance posture looks stronger on paper, but on one structural property: whether the device only starts capturing after an affirmative, disclosed decision to record (Plaud) or captures everyone in earshot indiscriminately before anyone has consented (Fieldy) — because deleting or never storing the audio afterward cannot retroactively cure a consent failure that already happened at the moment of capture.
• The Economics of Agentic AI: Engineering for Imperfection Artur Huk · 2026-07-24 source ↗ Reader 🖥️
  The runaway cost and catastrophic security failures of agentic AI both stem from treating a missing structural constraint (context, authority, evidence, or temporal validity) as a reasoning problem to be solved with more model intelligence, so enterprises must instead wrap probabilistic models in a deterministic governance 'airlock' — syntactic, semantic, and temporal gates that treat model output as an unprivileged claim — which converts model accuracy from a safety prerequisite into a tunable economic variable.
• Responsible AI Is Becoming a Growth Strategy Michael Wade, Jochen Wirtz · 2026-07-21 source ↗ Reader 🖥️
  Because three converging waves of AI (generative, agentic, physical) are making trust a scarce and decisive competitive resource, Corporate Digital Responsibility must be deliberately engineered rather than left as a compliance afterthought — using the CDR Calculus to make the business-performance/customer-well-being trade-off explicit for any AI deployment, and a three-stage maturity playbook (inventory what you have, build oversight into the system, turn governance into a public, incentivized, standard-shaping signal) to convert that discipline into demonstrable growth advantage.
• Your AI agent just blamed the network team. Now what? Nik Kale · 2026-06-15 source ↗ Reader 🖥️
  Deploying autonomous, cross-domain AI diagnostic agents in production incident response introduces a new organizational-political risk -- a confidently-asserted, team-implicating finding that may be contested -- and that risk is best managed not by better AI reasoning but by a deliberately staged trust-building process (investigation-scoped credentials, a read-only start, an auditable reasoning trail, and treating rollout as organizational change with pre-secured cross-team buy-in) that earns autonomy incrementally rather than being engineered away as a purely technical problem.
• Everyone wants to be AI-pilled. Most Companies Are Still Level 1 Ann Miura-Ko · 2026-05-01 source ↗ Reader 🖥️
  ‘AI-pilled’ is not a binary state but comes in six observable levels, defined by what AI can see, what it can do, who can extend it, and how the organization's structure has actually changed — and most companies, despite confident AI rhetoric, remain stuck at the lowest levels because they skip the hard, unglamorous work of making their own operations legible and structurally rewiring who does what before real autonomy becomes possible.
• The Acceleration Whiplash Faros · 2026-04-09 Reader 🖥️
  AI coding tools have crossed, without any deliberate organizational decision, from assistant to primary author of code, and two years of telemetry from 22,000 developers show that this shift is producing a widening gap between throughput (up) and production quality (down) that holds regardless of engineering maturity -- so organizations must raise code quality at the point of AI authoring rather than add more downstream review.
• Fragments: February 18 Martin Fowler · 2026-02-18 source ↗ Reader 🖥️
  AI-assisted software development is best understood as an amplifier of a team's existing practices rather than a disruptive break, so the field's real work is rebuilding the human-era practices that are predictably breaking—through emerging disciplines like the supervisory middle loop, risk tiering, TDD-as-prompt-engineering, and platform 'bullet trains'—amid far more shared uncertainty than settled answers.
• How Claude Code Is Built Gergely Orosz · 2025-09-23 source ↗ Reader 🖥️
  Claude Code is built by a small team that treats the Claude model itself — not its own surrounding code — as the real product, deliberately minimizing scaffolding, choosing an "on-distribution" tech stack the model already masters, deleting code whenever a new model release subsumes it, and restructuring code review, testing, incident response, and prototyping around AI doing the first pass; Orosz presents this as a plausible preview of how "AI-first" engineering teams will operate, while flagging that Anthropic's unlimited, cost-free access to its own frontier model and its identity as a research lab (not a product company) limit how directly the specifics transfer elsewhere.
• How Anthropic Teams Use Claude Code Anthropic · 2025-06-03 Reader 🖥️
  Across nine internal teams spanning both engineering (Security, Inference, RL Engineering, the Claude Code team itself) and non-engineering functions (Legal, Growth Marketing, Product Design, Finance via Data Infrastructure), Claude Code's value comes less from writing application code per se than from acting as a general-purpose interface to unfamiliar systems, documentation, and workflows -- letting people without coding backgrounds independently build and run working software, and letting engineers extend their reach into unfamiliar domains -- provided teams invest in persistent context files, checkpoint-heavy supervision, and an explicit sense of which tasks warrant autonomous versus closely-supervised execution.

Propositions touching this concept (1)

By publication month, oldest first (extraction month when no publication date is known).

2026-02

• explicitdevelopedRisk tiering is becoming the new core engineering discipline in AI-assisted development.
  Fragments: February 18 · p7

Tensions

Open gaps (12)

• uninformedNo accuracy or false-positive figures are given for the diagnostic agent across the 'dozens or hundreds of investigations' cited as the bar for earning write access -- the threshold for 'earning' autonomy is asserted qualitatively with no measurable bar (what accuracy percentage? what false-implication rate would make a team stop trusting it?).
  Your AI agent just blamed the network team. Now what? — read next: Look for evals/benchmark practice applied to diagnostic-agent accuracy specifically, and risk-tiering frameworks that attach numeric thresholds to autonomy grants.
• uninformedNo data is given on the policy-evaluation process itself: who assigns a tool's risk tier and how, whether tier assignments are reviewed or can drift, what accuracy/false-positive rate the evaluation has, or what happens to a request if the asynchronous auditing service is unreachable.
  Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers — read next: extract-ai-agent-blame-network-team (flags the same missing-accuracy-figures gap for 'earning' write access) and extract-fowler-fragments-february-18 (flags risk tiering as asserted without operational criteria).
• incompleteThe boundary of 'essential human work' is asserted but under-drawn. Moreira says product people can safely leave AI to build software 'when safety and big concerns' are absent, while complex concurrent systems still need technical judgment — but she gives no criteria for classifying which systems warrant formal specification versus which can be left to unspecified AI generation. Without that decision procedure, 'defining correct behaviour is essential human work' cannot be operationalised: a team cannot tell where the line falls for their system.
  Podcast: Formal Methods for Every Engineer in an AI-Powered Future — read next: Read alongside risk-tiering / not-all-software-is-equal material — the autonomy-boundary and classification gap in extract-ai-funhouse-mirror-velocity-debt#g4, and the risk-tiering concept — which frame exactly the 'which changes get which rigor' judgment this talk leaves implicit.
• incompleteThe illustrative failure-mode vignettes (specialist without authority, overloaded manager, reviewer seeing only the final answer, someone discouraged from disagreeing) are presented as plausible scenarios rather than drawn from documented incidents. No specific, named case of an AI-oversight failure grounds the argument, which weakens falsifiability — a reader cannot check whether the five-condition taxonomy actually predicts or explains a known real failure.
  Human Oversight Is Not a Human in the Loop — read next: Compare against concrete incident write-ups elsewhere in the corpus (e.g. production-database-deletion incidents where an agent operated without an approval gate, or major automated-decision failures with public postmortems) to test whether Bataller's framework actually accounts for those specific failures.
• incompleteNo quantitative comparison is given between outcomes under Claude-Code-first-pass review/testing/incident-response and Anthropic's own prior, pre-Claude-Code baseline. Every improvement cited (67% PR throughput increase, faster incident root-causing, two-week migrations) is self-reported by Anthropic insiders or by customer companies with an interest in the tool's success, with no external or controlled measurement.
  How Claude Code Is Built — read next: Read against extract-dx-measuring-ai-impact and extract-five-studies-ai-software-engineering, which raise the same self-selection and construct-measurement concerns for AI-engineering-impact claims generally.
• incompleteThe article notes Anthropic deliberately keeps feature flags minimal because 'feature flags slow the team down,' but never examines whether this is sustainable given the growth-driven monitoring load the same article describes (alerts firing 'pretty much every day' simply from rapid growth) — nor what happens to blast-radius risk as Claude Code's external user base keeps scaling well past where it is today.
  How Claude Code Is Built — read next: Read against async-code-reviews-choking-throughput's discussion of trunk-based development and feature flags as an alternative risk-mitigation mechanism the article doesn't engage with directly.
• incompleteThe author treats unrestricted, cost-free access to the most expensive Claude model as a structural advantage unique to Anthropic, but never asks what Claude Code's own internal practices (TDD renaissance, 60-100 releases/day, 5+ prototypes/day) would look like, or whether they would remain viable, under the token-cost and usage-quota constraints that every other company — including Claude Code's own external users, per a reader comment quoted in the discussion thread — actually operates under.
  How Claude Code Is Built — read next: Compare against practitioner reports from non-Anthropic teams operating under real token budgets, to see which of these practices survive a hard cost constraint.
• incompleteThe 67% PR-throughput increase coincides with, but the article never disentangles from, the fact that new joiners during Anthropic's hiring surge were likely disproportionately experienced senior engineers already fluent with Claude Code's own on-distribution stack (TypeScript/React) — leaving open whether the throughput gain is attributable to Claude Code itself or to who Anthropic was able to hire.
  How Claude Code Is Built — read next: Look for engineering-productivity research that isolates tool effect from hiring-composition effect during headcount-doubling periods.
• illogicalThe CDR Calculus is explicitly marketed as a breakthrough over prior frameworks ('Most frameworks of this kind merely describe. This one forces leadership teams to stop debating AI ethics in the abstract and start making concrete choices about specific systems') but structurally it is a standard two-axis, four-quadrant positioning matrix — the same genre as a BCG growth-share matrix or Eisenhower matrix — with no stated methodology for scoring where a given deployment falls on either axis, no threshold distinguishing 'positive' from 'negative' impact, and every one of its eight worked examples was chosen because it fits its quadrant unambiguously in hindsight. Nothing in the mechanism itself (as opposed to the authors' own analytical skill in choosing examples) demonstrates that it 'forces concrete choices' rather than simply providing post-hoc vocabulary for choices already visible from outcomes. This is close to consulting-firm framework-packaging: a memorable four-box label set standing in for an actual measurement or decision procedure.
  Responsible AI Is Becoming a Growth Strategy — read next: Read against frameworks in the corpus that do carry real measurement machinery — extract-outsourced-ai-still-own-the-risk's mapping of regulatory regimes onto NIST AI RMF/ISO 42001, and extract-governing-ai-in-the-cloud's automated classification-and-enforcement pipeline (event-driven data classification, policy-as-code) — to see the difference between an operationalized governance framework and a rhetorical 2x2. Also worth testing the Calculus against a genuinely hard, real deployment (not one of the article's clean anecdotes) to see whether it actually helps classify ambiguity or only relabels the obvious.
• incompleteThe entire ethical argument is anchored to lawyer-specific authority — a bar association ethics opinion and Rule 8.4 — plus state wiretap/all-party-consent statutes. Svenson never addresses whether the same consent-before-capture principle should bind non-lawyers in equally confidentiality-sensitive settings (an engineering leader in a vendor negotiation, an HR conversation, an M&A due-diligence call, a performance discussion), where no professional body issues an ethics opinion and the only floor is the (often much lower) state wiretap statute. His own framework — 'the risk isn't what gets stored, it's what gets captured' — has nothing legal-profession-specific about it and generalizes cleanly, but he doesn't make that move himself.
  I've been wearing two AI recorders. Only one belongs near a client. — read next: Professional-ethics literature from other regulated fields (medical, financial advisory, HR/employment law) on AI recording and consent; general workplace-recording guidance for roles with no governing ethics body but real confidentiality stakes (vendor/client meetings, performance conversations).
• incompleteEvery recommendation is framed as an individual practitioner's personal device choice ('take the Fieldy off... not muted, off') rather than as an organizational policy question. There's no discussion of how a firm, company, or AI-governance function would mandate, audit, or enforce a consent-gated-vs-always-on distinction across an entire client-facing staff — the exact kind of proportionate, risk-tiered control that would need to be built into onboarding, IT provisioning, or a written AI-use policy rather than left to individual judgment and memory.
  I've been wearing two AI recorders. Only one belongs near a client. — read next: Enterprise AI-usage policy design; how organizations operationalize personal-device recording rules (BYOD security policy analogs) for client-facing roles.
• incompleteThe targeting rule ('reach for governance on regulated, high-stakes, long-lived systems... skip it for throwaway scripts') is generalized from a single task family — one complex banking-service task compared across exactly one weak and one strong model — without testing other high-stakes domains (healthcare, aviation, safety-critical embedded systems) or a range of model capability levels, so the rule's generality across the broad 'hard, multi-constraint' category it is meant to cover is unverified.
  Article: When Spec-Driven Development Pays Off — read next: Look for replications of the weak-model-vs-strong-model spec-discipline gain across other multi-constraint domains and a wider spread of model capability before treating the 21-point/2-point contrast as a stable, generalizable pattern rather than one data point.