D3 Risk-tiered governance

Which changes need which level of human involvement.

Red flag: Either every change gets the same heavy review, or green CI alone means merge.

The three statements

Each is rated from 0 (not true) to 4 (fully true). The dimension score is their average.

1. Changes are sorted into risk tiers with different review requirements.
2. A written policy says which changes may merge with no human or with one human.
3. Exceptions and overrides are logged and reviewed.

Evidence to gather

Merge policy, exception logs, audit trail.

Score from evidence, not impressions. Where two people score the same team, the statements they disagree on are where to look first. The assessment's compare view lists them.

First moves

If D3 is your weakest dimension, start here:

• Draft four tiers with examples from your own repositories. Start by letting only the lowest tier merge with automated checks.
• Log every override of the policy and review the log monthly.

Score this in the assessment

Source: SPEC.md at v0.2.0.