Contents
Assigning a risk score to a SQL script sounds objective. You define rules, give each a weight, add up the points of the rules that fired and produce a number. That number looks good in a report. The problem is that it often misleads the decision.
The Problem with Additive Models
Consider two scripts. The first violates six minor naming rules while doing something harmless. The second violates one rule: it contains a DELETE without a WHERE clause. An additive model can score the first as riskier. Yet the first at worst hurts readability while the second empties a table.
Worse, in models that average, minor findings dilute the critical one. One critical and nine informational findings can average out to medium risk. From a safety standpoint that behaviour is unacceptable: risk cannot be diluted.
The weight tuning trap
Teams using additive models keep tuning weights: raise the critical rule, lower the minor ones. The tuning never ends, because the problem is the model rather than the weights. If you raise a weight high enough the model becomes a band model anyway, so it is more honest to build bands from the start.
The Band Approach
In the band approach every rule carries a tier: info, low, medium, high, critical. When a script is evaluated, the highest tier triggered sets the band. There is no summing, no averaging and no multiplier. The worst case decides.
This has three practical benefits. First, the decision becomes predictable: the same rule always produces the same outcome. Second, it becomes explainable: the question of which rule decided has exactly one answer. Third, the debate moves to the tier of the rule. Asking whether a rule is truly critical is a healthy discussion; asking whether 62 points is high is not.
The numeric score does not have to disappear. It can serve as a readable projection of the band, which is useful for showing trends in management reports. What matters is that the gate decision follows the band, not the number.
Non Skippable Rules
Every approval process has a fast path: skipping steps in an emergency, proceeding with a single approval, automatic execution. These paths are necessary but they should not be unlimited. When certain rules fire, no fast path should apply.
When a rule marked non skippable fires, approval steps cannot be skipped. This is how the balance between speed and safety is set at rule level: ordinary changes move quickly while changes crossing a defined threshold go through the full process. Keep the list short, because a system where every rule is non skippable gets disabled entirely during an emergency.
An Explainable Decision
A risk model must be able to explain its decision to three audiences: the developer who wrote the script, the manager who approves it and the auditor who looks at it six months later. The three ask different questions but want the same information: why this outcome?
A good explanation includes the list of every rule that fired, the tier of each, which rule determined the decision and the fact that the other findings did not affect it. That last item matters, otherwise a developer spends time fixing minor findings hoping to lower the band.
The same explanation should be written into the audit record and the evidence package. When the auditor reads exactly the reasoning you saw on screen, the discussion ends.
Building Your Own Model
- Debate the tier distribution rather than the rule count. You can have a hundred rules and still stay manageable if only five of them are critical.
- For each rule, separately answer what should happen when it fires: warn, deepen approval, block.
- Keep blocking rules few and write down their rationale. The cost of blocking can be the team bypassing the process.
- When you change the rule set over time, keep a record of which rules governed the older decisions.
- Show the model's output to all three audiences and fix whatever they do not understand.
Frequently Asked Questions
Why is adding up risk points wrong?
Because addition lets many small findings outweigh a single critical one. Seven cosmetic warnings can add up to the same score as a critical DROP statement, yet the two are not the same thing. Letting the highest finding set the band preserves the meaning of the decision.
What is the difference between a non skippable rule and a high risk rule?
A high risk rule raises the band and requires more approval; the process still flows. A non skippable rule prevents the related approval step from being skipped no matter what the policy says. One is a measure of risk, the other is a floor for the control.
Why does the score being explainable matter so much?
Because a score that cannot be explained cannot be discussed. If the approver cannot see why something is high risk, they either approve blindly or ignore the system. The auditor asks the same question: what is this decision based on. When it is visible which rule set the band, the score turns into a justification.
See the band model at work
Bring your own script and we will show which rule decided and how the explanation is written into the evidence dossier.
Book a Demo →