curious how it handles the genuinely ambiguous risk classifications in the act itself, does it default to the stricter tier when a call isn't clear cut?