How do you decide which trust level a system needs?

From a risk assessment of the application: identify what could go wrong if an identity is false, rate the impact (harm to people, money, reputation, legal consequences) and likelihood, and choose the lowest level whose controls bring that risk down to an acceptable level, separately for registration, authentication and federation if needed.

A practical way to think it through:

1. List the harms. What happens if an impostor gets in? Leaked health data, a fraudulent payment, a forged vote, a wrong official decision, damage to the organisation's reputation.
2. Rate the impact of each harm, typically as low, moderate or high, and consider who suffers it (the user, the organisation, third parties).
3. Map impact to a level. Higher impact needs a higher level. NIST SP 800-63-4 does exactly this: the "effective impact level" is the primary input for selecting the initial IAL, AAL and FAL.
4. Tailor. Adjust for the user group and context; a level can be raised for privileged staff or lowered with compensating controls.
5. Balance usability and cost. Every step up costs money and convenience (counter visits, hardware tokens). Too high a level drives users away; too low exposes them.

Different functions of one application may need different levels: reading a public tax brochure needs nothing, viewing your own tax file might need level 3, signing the return electronically level 4.

Go deeper:

• NIST SP 800-63-4: Select initial assurance levels and baseline controls — the risk-based selection process step by step.
• EU eID: eIDAS Levels of Assurance — examples of services choosing a level by the sensitivity of their data.