This all works great, most of the time. The issue is that edge case when the requirements change after a user has achieved TL3. It would be a bit of a burden to lock everyone at TL3, and then unlock them two weeks later. What I’m proposing is that #2 be modified to apply to when TL3 is achieved and when trust level requirements are changed.