One of the quieter failures of a naive harness is inconsistent depth: it answers a narrow question when the situation demands a wide one, or spends heavy scrutiny on something trivial while waving through something consequential. The fix is not to review everything at maximum rigor, which is slow and trains people to ignore alerts. It is to let risk trigger depth, so the amount of scrutiny rises with the blast radius of the action under review.

Same question, wrong depth

Is this vulnerable to one specific bug is often too narrow a question. If the code changes state, accepts identifiers, writes records, and uses cookies, the honest scope includes authorization, cross-site request forgery, input validation, and audit, not just the one thing you asked about.

A harness with a fixed depth cannot adapt. It applies the same shallow or heavy pass everywhere, which means it is simultaneously too slow for the trivial and too shallow for the dangerous.

The gap a shallow look misses

Picture the full risk surface of an action as one set, and what a shallow review actually inspects as another. Where they overlap, you catch problems. The crescent of risk that falls outside the shallow review is precisely where undetected flaws live.

The goal is to widen the review until it covers the risk surface for this action, no less. Matching depth to risk is how you shrink that missed crescent to nothing.

Whatever risk falls outside a shallow review is exactly where flaws go undetected. Reviewed vs Risk Shallow review what you check Risk surface what could fail Caught overlap missed gap
Whatever risk falls outside a shallow review is exactly where flaws go undetected.

Let risk trigger depth

Tie the depth of review to what the action can do. A read-only lookup warrants a light pass. A state change pulls in authorization and forgery checks. A write or delete adds approval and rollback review. An action that crosses a trust boundary adds identity and egress review on top.

Depth is a dial the trigger turns, not a constant. The heaviest scrutiny lands where the blast radius is largest, and the trivial stays fast.

Review depth should scale with what the action can actually do. Depth by Trigger Read-only 20% State change 55% Write / delete 80% Cross-boundary 100%
Review depth should scale with what the action can actually do.

Escalating checks

One clean way to implement this is to layer checks that switch on as risk rises. Every action gets a base pass. A state-changing one adds authorization. A sensitive write adds forgery protection and audit. The highest-impact actions add a human approval on top of all of it.

Because the layers are additive and triggered, you never pay for scrutiny you do not need, and you never skip scrutiny you do.

Checks switch on as risk rises, so scrutiny is always proportional to impact. Additive Checks low risk Base passevery action + Authorizationstate change + CSRF & auditsensitive write + Human approvalhighest impact high
Checks switch on as risk rises, so scrutiny is always proportional to impact.

Triggers to watch

Risk-triggered depth only works if the triggers are explicit. Name the conditions that widen a review, and wire them to the extra checks they demand.

These are the signals that should reliably deepen scrutiny, encoded in the harness rather than left to judgment in the moment.

  1. If the action modifies state, add authorization and forgery review.
  2. If it writes or deletes data, add approval and rollback review.
  3. If retrieved content can influence the action, add injection and information-flow review.
  4. If output is rendered, add output-handling and injection review.
  5. If the action crosses a trust boundary, add identity and egress review.

Depth without grinding to a halt

The reason not to review everything deeply is human as much as technical: uniform heavy review is slow and desensitizes reviewers, so real risks get rubber-stamped alongside trivia. Proportional depth keeps attention where it matters.

Done well, risk-triggered depth makes the system both faster and safer, because effort follows impact instead of being spread evenly and thinly.

✅
Proportional, not uniform. Scale scrutiny to blast radius; uniform heavy review just teaches everyone to ignore it.

What a practitioner decides

Adopting risk-triggered depth means deciding the triggers up front: which properties of an action widen its review, and which additional checks each trigger switches on. Encode those rules so the harness deepens automatically.

The question is no longer did we review it. It is: did we review it as deeply as this action's blast radius demands, and no less?

Key takeaways

  • Fixed-depth review is both too slow for the trivial and too shallow for the dangerous.
  • The risk that falls outside a shallow review is exactly where undetected flaws live.
  • Tie review depth to what an action can do; let the trigger turn the dial.
  • Layer checks additively so scrutiny switches on as risk rises.
  • Make triggers explicit: state change, write/delete, untrusted influence, rendering, boundary crossing.
  • Proportional depth is faster and safer, and avoids desensitizing reviewers with uniform heavy review.

Glossary

Risk-triggered depth
Scaling the rigor of a review to the blast radius of the action being reviewed.
Blast radius
The extent of damage an action could cause before something contains it.
Risk surface
The full set of ways an action could fail or be abused.
Trigger
A property of an action, such as changing state, that switches on additional review.
Additive checks
Extra controls layered on as risk rises, rather than a single fixed review.
Trust boundary
The line separating trusted from untrusted zones, whose crossing warrants deeper review.
Alert fatigue
Desensitization from uniform or excessive review, causing real risks to be ignored.