Is there a simple rule for deciding whether a Tracker belongs in necessary instead of analytics, marketing, or preferences?
Classify by purpose, not merely by vendor name or technical convenience. Necessary should be reserved for resources required to provide a service the visitor explicitly requested or to operate essential security and site functions. Analytics, advertising, personalization, and optional convenience features normally belong in their corresponding optional categories.
OptinStack always forces necessary to true, so an overly broad necessary classification removes the visitor's ability to decline that processing. Document the reason for each override and ask privacy counsel to review ambiguous cases for the jurisdictions you serve.
Documentation: Consent categories and Tracker inventory configuration.