Human Risk Graph · functions.yaml

FHigh risk

Main driver: solo control — 2 of 3 critical functions can be completed by one person: Merge to main, Publish a release. 1 more can by policy.

Significant human dependency risks that should be addressed.

4 people3 dependencies 2 errors · 3 warningsmodel hrg-32026-11-13 09:26

Function loss Moderate

Margin 1

Without Bob, Restore the production database cannot be performed (27% of function weight).

Authority concentration Moderate

2.9 effective people

across 4 functions; Bob holds 47% of the function weight.

Solo control High

2 of 3 critical functions

can be completed by one person: Merge to main, Publish a release. 1 more can by policy.

Top fixes

Remediations simulated on your data, ranked by how much they raise the score.

Doing all 3 raises the score from 47 to 75 (grade F → C).

1
Two-person rule
Close the way around the two-person rule for Merge to main

critical function one person can complete alone

+12 47 → 59
2
Backup
Train a second person for Restore the production database

stops if one person is unavailable

+6 59 → 65
3
Backup
Train a second person for Rotate signing keys

stops if one person is unavailable

+10 65 → 75

Simulated on the model: a backup is one more trained and authorized performer; a two-person rule means nobody can complete the function alone. Whether it is feasible is for you to judge.

Dependency map

Who approves, escalates to and can bypass whom. Select a person for details.

Critical single point of failure Single point of failure Critical (≥ threshold) Other Approval Escalation Bypass Moving dots run from who approves, escalates or bypasses to whom · Select a key person: the people cut off without them pulse red · Node size: criticality and impact · Drag to pan when zoomed

People

Weight lost is the share of function weight that stops if the person is unavailable.

Person	Criticality	Weight lost	Functions lost	Function share	Flags
Bob SRE	0.70	27%	1	47%	SPOFcritical
Alice Head of Platform	0.90	21%	1	30%	SPOFcritical
Carol Security Engineer	0.70	21%	1	17%	SPOFcritical
Dan Developer	0.40	—	—	6%

Critical functions

Margin: how many performers can be unavailable before the function stops. Alone: who can complete it without a second person; (by policy): allowed, not counted as solo control.

Function	Criticality	Requires	Performers	Margin	Alone
Merge to main	0.80	2	Alice, Bob, Carol, Dan	3	Alice
Publish a release	0.90	1	Alice, Bob	2	Alice, Bob
Restore the production database	0.90	1	Bob	1	Bob (by policy)
Rotate signing keys	0.70	2	Alice, Carol	1	—

Findings

2 errors · 3 warnings, with related ISO/IEC 27001, SOC 2 and DORA controls.

Related controls are informative pointers for audits, not an assessment of compliance.

HRG002 Concentrated approval authority 1

warningAuthority over functions is concentrated (2.9 effective people of 4); Bob (bob) holds 47% of the function weight.

Remediation. Add secondary approvers for sensitive workflows and spread ownership of high-impact decisions.

ISO/IEC 27001:2022A.5.2A.5.3

SOC 2 (2017 Trust Services Criteria)CC1.3CC5.1

DORA (Regulation (EU) 2022/2554)Art. 5(2)(c)Art. 6(4)

HRG005 Function depends on too few people 2

errorRestore the production database stops if Bob (bob) is unavailable: nobody else can perform it.
errorRotate signing keys stops if Alice (alice) or Carol (carol) is unavailable: it needs 2 of the 2 people who can perform it.

Remediation. Train and authorize another person for the function, document the procedure, and rehearse it.

ISO/IEC 27001:2022A.5.29A.5.30

SOC 2 (2017 Trust Services Criteria)CC1.4CC9.1

DORA (Regulation (EU) 2022/2554)Art. 10(1)Art. 11(2)(a)

HRG006 Critical function one person can complete alone 2

warningMerge to main is critical (criticality 0.80) and it requires 2 people but Alice (alice) can complete it alone.
warningPublish a release is critical (criticality 0.90) and it requires one person, so Alice (alice) or Bob (bob) can complete it alone.

Remediation. Require a second, independent person to complete the function, and remove or log and review every way to complete it alone.

ISO/IEC 27001:2022A.5.3A.8.2A.8.32

SOC 2 (2017 Trust Services Criteria)CC5.1CC6.3CC8.1

DORA (Regulation (EU) 2022/2554)Art. 9(4)(c)Art. 9(4)(e)

How the score is calculated

Model hrg-3.

Function loss L: the largest share of function weight that stops when one person is unavailable (a function stops when fewer performers are left than it requires).
Authority concentration D: Herfindahl-Hirschman index of function weight, each function's criticality split among its performers.
Solo control S: weighted share of critical functions one person can complete alone, the SLSA Source Level 4 two-party question. Model hrg-3 is experimental.

Composite risk = (1 − (1 − 0.4·L)(1 − 0.3·D)(1 − 0.3·S)) / (1 − (1 − 0.4)(1 − 0.3)(1 − 0.3)) = 0.525; score = 100·(1 − risk) = 47

Metric	Value	Weight
Function loss	0.273	40%
Authority concentration	0.344	30%
Solo control	0.708	30%
Composite risk	0.525

Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 50, F below 50. Full definitions and properties: docs/model.md.

Audit trail

Enough to reproduce this result.

Input file	`functions.yaml`
Input SHA-256	`db90145878f90cefcb38cdb4826c1977855df89025f9ffd1d830a42cabb7138c`
Generated	`2026-11-13T09:26:38`
Tool	`human-risk-graph 0.14.0`
Model	`hrg-3`
Weights	`α 0.4 · β 0.3 · γ 0.3`
Critical threshold	`0.7`
Config	`none`
Unconfirmed dependencies	`0`
Data gaps	`0`
People / dependencies	`4 / 3`