CONCEPT Cited by 1 source

Risk-tier assessment¶

Risk-tier assessment is the discipline of classifying each code change into a small number of risk buckets before deciding how much review firepower to apply to it. The classification drives downstream decisions: how many agents to spawn, which model tier each runs, and what severity of finding blocks a merge.

Why it exists¶

Sending seven concurrent frontier-model agents through every one-line typo fix is prohibitively expensive. Cloudflare's framing: "You don't need seven concurrent AI agents burning Opus-tier tokens to review a one-line typo fix in a README." Without tiering, review cost scales linearly with MR volume regardless of the actual risk distribution of the changes.

Classification inputs¶

Any cheap-to-compute metric over a diff:

Total lines changed (added + removed).
File count in the diff.
Path matching — anything touching security-sensitive directories (auth/, crypto/, anything that sounds security-related) overrides the size-based bucket.
Generated-vs-handwritten markers — lock files, .min.js, @generated headers filtered out before the line/file count is computed. Database migrations explicitly kept even when marked generated.

Cloudflare's AI Code Review instance¶

function assessRiskTier(diffEntries: DiffEntry[]) {
  const totalLines = diffEntries.reduce(
    (sum, e) => sum + e.addedLines + e.removedLines, 0
  );
  const fileCount = diffEntries.length;
  const hasSecurityFiles = diffEntries.some(
    e => isSecuritySensitiveFile(e.newPath)
  );

  if (fileCount > 50 || hasSecurityFiles) return "full";
  if (totalLines <= 10 && fileCount <= 20)  return "trivial";
  if (totalLines <= 100 && fileCount <= 20) return "lite";
  return "full";
}

Tier	Lines	Files	Agents	Notes
Trivial	≤10	≤20	Coordinator + 1 generalised	Coordinator downgraded Opus → Sonnet
Lite	≤100	≤20	Coordinator + code quality + documentation + 1 more
Full	>100 OR >50 files OR security-sensitive	Any	Coordinator + 7+ specialists

Bias is explicitly toward the expensive tier — "we'd rather spend a bit extra on tokens than potentially miss a security vulnerability."

Observed economics¶

In Cloudflare's first 30 days (2026-03-10 → 2026-04-09):

Tier	Reviews	Avg cost	Median	P99
Trivial	24,529	$0.20	$0.17	$0.74
Lite	27,558	$0.67	$0.61	$1.95
Full	78,611	$1.68	$1.47	$5.05

Full tier dominates volume because Cloudflare's MR size distribution skews to the top; trivial is a cost-floor primarily.

Seen in¶

sources/2026-04-20-cloudflare-orchestrating-ai-code-review-at-scale — canonical production instance with disclosed thresholds, tier assignments, and cost distribution.

patterns/ai-review-risk-tiering — the pattern this concept is the primitive behind.
concepts/diff-noise-filtering — preprocessing step before line/file counts are computed.
concepts/blast-radius — the same risk-scaling discipline applied to deployment rollout.
systems/cloudflare-ai-code-review