Not quite. Use a small number of tiers, usually three, with a shared baseline for all services and extra controls as criticality rises. Tag each repository with its tier and have the shared pipeline pick the policy from the tag. More than four tiers becomes hard to run.
Why one size fails
A payment service and an internal lunch menu app do not carry the same risk. A single strict policy blocks low value work and teaches teams to resent the gate. A single loose policy leaves the important services under protected. Tiers let you spend friction where it buys the most.
A starting tier model
| Tier | Example | Blocks merge on | Extra controls |
|---|---|---|---|
| 1 | Customer data, payments, auth | New critical and high reachable findings, secrets, license deny list | Protected environment with reviewers, signed releases, tighter exception limits |
| 2 | Other production services | New critical findings, secrets | Standard exception flow |
| 3 | Internal tools, prototypes | Secrets only, warn on the rest | Annual review |
These are examples. Set thresholds from your own risk appetite and write them in the policy.
Baseline for all tiers
- Secret scanning on every change
- Read only workflow token by default
- Code owner review of workflow and policy files
- Dependency inventory recorded
Assigning tiers
- Ask owners to self classify using three questions: does it hold sensitive data, is it internet facing, would an outage hurt customers?
- Platform and security review the Tier 1 list.
- Store the tier as a repository property, not in a spreadsheet.
- Review tiers twice a year and when a service changes role.
An unclassified repo should default to Tier 2, so skipping the step does not mean skipping controls.
Avoid tier sprawl
Resist adding a tier for every special case. Use exceptions for odd cases and keep tiers about risk, not team politics. Report coverage and findings per tier, as in the monthly report.
Try it yourself
The framework mapping demo shows how a control can be mapped to requirements. Consider how tier policies would map to the controls you report on.
Click through it at your own pace, or open it full screen.
Quick check
How many tiers is too many?
More than four is hard to explain and enforce. Three is a good start.
Who decides the tier?
The service owner proposes it, and security and platform confirm for the highest tier.
Safeguard supports policies, gates and guardrails you can scope per project, along with compliance and evidence automation.
Last reviewed: 19 October 2026.
