4. Scoring and Tiers

4.1 Scoring walkthrough

Both layers use the same aggregation method. Each risk factor contributes a raw score based on the characteristics of the app or scope. Raw scores are grouped by risk dimension, and then:

1. Normalize — Within each dimension, the sum of raw scores is divided by the dimension’s maximum possible value, yielding a percentage.
2. Weight — Each normalized dimension score is multiplied by the dimension’s policy-defined weight.
3. Aggregate — Weighted contributions are summed to produce a composite score on a 0–100 scale.

Example calculation

Suppose an application accumulates the following raw scores:

Dimension	Raw	Maximum	Normalized
Governance	5	17	~29.4%
Privilege	15	30	50%
Scope	8	20	40%

With weights of Governance = 30%, Privilege = 50%, and Scope = 20%, the composite score is:

(0.294 × 30) + (0.50 × 50) + (0.40 × 20)
   = 8.82    +    25.0     +     8.0
   = 41.8 out of 100

This method ensures the composite score reflects both the severity of raw risk signals and the organizational importance of each risk dimension. It prevents dimensions with more factors from disproportionately influencing the outcome, while allowing a single high-severity trait to elevate the score when it lands in a heavily weighted dimension.

4.2 Tier mapping

The composite score for each layer maps to one of four risk tiers:

Composite Score	Risk Tier
0–29	Low
30–59	Medium
60–79	High
80–100	Critical

Under this mapping, the example calculation above (41.8) lands in the Medium tier.

These tiers are reference points based on weighted scoring. Dominant traits — for example full access control modification, or a public client with wildcard redirects and no owner — can independently elevate a borderline case, and contextual factors or high-sensitivity environments may justify escalation of borderline scores.

---

OARS §4 is derived from the Graph Consent Risk Framework by Khurram Chaudhary. Licensed CC BY 4.0.