Frameworks · AI Don't Fix Stupidity

The Tool Risk Ladder

The Tool Risk Ladder classifies the *tools* an agent may call, what it can physically do in your systems.

Levels

  1. Low (read-only, no approval)
  2. Medium (creates, does not send; optional)
  3. High (publishes or commits externally; required)
  4. Critical (irreversible or high-impact; always explicit)

Every tool is classified before deployment by what it can do, with approval rising by level. What a tool can read is a second axis: a read-only tool over restricted data at whole-repository scope is not "Low" in any meaningful sense. Credentials are granted just in time and expire with the task. A tool is reclassified whenever it gains a data source, write access, new markets or a new model. The book's worked example is Norvik's pricing crisis: one retrieval tool misfiled as read-only, 410 customers quoted wrong prices, EUR 38,000 direct loss, and "None of it required a bad model."

Use it on Monday

"Tool risk is the argument to have in the design room"