Govern each system in proportion to its stakes
These three tiers are this framework's own, applied through the NIST AI RMF: Map categorizes each system, Measure assesses its risk, and Manage treats it. Domain 9 owns the standard; every domain applies it. The tier rates how much a system decides, not how much an office matters — a critical department can run entirely on Assistive tools, and that's the goal.
+ impact assessment
Tools that support a person who stays fully in control, with no decision authority. Where most systems should stay — keeping a human in charge is the win, not a limitation.
Systems that inform work or decisions with meaningful human review in the loop.
Systems that make or inform decisions materially affecting people's lives and rights.
Before any consequential system deploys, Domain 6 requires an algorithmic impact assessment aligned to the RMF's Map and Measure functions — drawing on the Playbook's suggested actions and transparency & documentation questions to establish context, test for bias, and record the evidence that sets the system's tier.