Tiers

The tier meter turns a 1–5 score into a band. Settings → Risk model, needing risk_configuration.manage.

The scale

Fixed at 1 to 5, and not editable. Every factor is scored 1–5 and a weighted average of those stays on the same scale, so the ends are not a matter of opinion.

Two boundaries move:

Handle	Meaning
low_max	A score at exactly this value is still low
medium_max	A score at exactly this value is still medium; everything above is high

Bounds are inclusive at the top, which is why the displayed ranges read 1.00 – 2.20 then 2.21 – 3.50 — no printed range implies a gap the resolver does not have.

High has no upper handle by design: whatever is above medium_max is high.

Both boundaries must leave their band reachable

Two settings are rejected, for the same reason in mirror image:

Rejected	Why
medium_max ≥ scale_max	Nothing can score above the top of the scale, so high would be unreachable — a maximally risky merchant would come out medium
low_max < 1	Nothing can score below 1, so low would be unreachable

Both used to be accepted silently, and the meter happily drew a band that no score could ever land in. If you want to disable a band, that should be an explicit decision, not a side effect of a boundary value.

Snapshots

Every assessment stores the thresholds it used. Moving a boundary changes future assessments and leaves past ones explaining themselves by the numbers they were actually scored against.

This is why the entity page can say "computed medium, raised to high because …" months later and still be accurate.

nil in, nil out

Tier.resolve(nil) returns nil — never low. An absent score is an absence, and every caller presents it as one. This is the single rule that the risk_level default bug came down to.