Why AI Writes Need Risk Tiers: The R0-R5 Tool Risk Model

The article explains why enterprises need to categorize AI operations into risk tiers, using a model ranging from R0 to R5. The goal is to decide the execution policy for each AI operation, rather than applying a blanket approach of either automatic execution or human review for all tasks.

The tiered model assigns specific risks and policies to each risk level:

- R0 is for informational reads and explanations where the operations are automatic and policy-enforced.

- R1 allows read operations, such as querying customer lists, to be handled automatically.

- R2 covers low-risk writes, like updating a note, which are still automatic but subject to governance configuration.

- R3 is for business-sensitive writes that require human confirmation before proceeding.

- R4 handles high-impact actions like creating follow-up tasks or changing orders, which need dual approval.

- R5 designates irreversible or external actions, such as deleting data or sending emails, which are blocked outright due to their irreversible nature.

The authors highlight three key design decisions:

1. Automatic execution for reads and confirmation for writes, with high-risk operations requiring human intervention or blocking.

2. Low-risk work remaining automatic, while high-risk work gets human confirmation, and irreversible work is stopped.

3. Explicit risk level declaration for each tool, with defaults set to ensure conservatively safe execution when the risk level isn't declared.

Runtime enforcement involves declaring the risk tier, checking permissions, passing through policy gates that determine whether the operation is automatic, requires confirmation, is blocked, or halted. Audit logs record both successful and denied executions, creating a tamper-evident and traceable chain.

This tiering approach turns the question of whether AI should act from a subjective decision into a concrete, rule-based policy that can be enforced consistently across all operations. The authors emphasize that the enforcement mechanism is critical, as the boundary between AI operations and real system actions must be firmly established on the execution path.