The risk mitigation hierarchy — is this a formal requirement, or is it aframework the Air Boss applies at their discretion?

It’s the standard framework for hazard mitigation, and it applies in order.Elimination first — remove the hazard entirely. If a hazard can be removed,you don’t accept it. Substitution second — if you can’t eliminate it, replacethe higher-risk element with a lower-risk alternative. Engineering controlsthird: physical barriers, crowd line markers, blast fences, designatedstaging areas. Administrative controls fourth: briefings, procedures,schedule sequencing, personnel limits. Personal protective equipment islast — it’s a supplement, not a substitute for the steps above it.

The crowd-distance scenario is the most common application I’ve seen. ACat II act with insufficient crowd separation.

Eliminate: don’t authorize the act. Or substitute: replace it with a CategoryIII act that fits within the available crowd distance. Those are the first twooptions. You don’t get to “we’ll just brief the crowd to stay back” as yourprimary control.

Parachute landing zone near the crowd line — that’s an engineeringcontrol scenario.

Physical barrier between the LZ and spectators. You’re not relying on thejump master to keep people back during a landing sequence. For aperformer with a history of deviating from their briefed profile, you useadministrative controls: explicit re-briefing with modified releaseconditions. You state those conditions directly to the performer anddocument them.

What about residual risk that can’t be fully controlled?

Document it. Accept it with IIC concurrence — that acceptance is notunilateral. And monitor it actively during the show. Residual risk that’sbeen acknowledged and mitigated to the extent possible is different froma hazard that was overlooked. The distinction matters if somethinghappens.