Outcome
By the end of this lesson, you will be able to decompose a risk score into its three components, explain why an all-safe result scores zero, and judge when a low score is genuinely reassuring and when it is not.
| Tier | Engineer |
| JTBD | ”Turn a canvas full of colours into one number I can put in a change request.” |
| Personas | Platform Engineer · SRE · Engineering Leader |
| Prerequisites | M2.15.L2 |
| Time | 9 minutes |
| Bloom verb | Decompose (Analyze), Explain (Understand), Judge (Evaluate) |
1. Concept
The risk score is a 0 to 100 number computed from three components. It is deliberately simple and deliberately transparent: you should be able to reconstruct it by hand from the side panel.
COMPONENT MAX POINTS──────────────────────────────────────────────────────1. IMPACT SEVERITY RATIO 60 affected counts FULL warning counts HALF as a ratio of the neighbour set
2. ENVIRONMENT 15 prod 15 staging 8 dev 3 ZEROED when nothing is impacted
3. OWNERSHIP SPREAD 20 teams + schedules touching the affected set────────────────────────────────────────────────────── up to ~95Component 1: severity ratio
The dominant term, and it is a ratio rather than a count.
2 affected out of 2 neighbours -> the full 602 affected out of 40 neighbours -> a small fraction
A warning counts half an affected. So four warningscontribute what two affected nodes would.The ratio choice is what stops a large well-connected resource from always scoring high. A load balancer with 40 healthy targets, one of which is briefly disrupted, is genuinely low risk, and a count-based score would call it high.
Component 2: environment, and the zeroing rule
prod 15staging 8dev 3
BUT: zeroed when nothing is impacted.That rule is the one worth understanding. Without it, every action on every production resource would carry a floor of 15 points, including provably safe ones, and the score would stop distinguishing them.
Deleting an unattached volume in prod severity ratio 0 (nothing impacted) environment 0 (zeroed, because nothing impacted) ownership 0 ───────────────────── RISK 0Zero means something. It means safe was proven, not merely assumed, and the score is willing to say so even in production.
Component 3: ownership spread
Teams and schedules touching the affected set, up to 20.This is the component that encodes a truth the other two miss: a technically minor change that reaches six teams is operationally expensive, because it needs six conversations. One that reaches one team is not.
It is also the component most likely to surprise you, because ownership is a fact about your organisation rather than your architecture, and the two drift apart.
Reading a score
0 Safe was proven. Nothing impacted.1-20 Contained. Usually a single warning, one owner.21-50 Real but bounded. Read the affected list individually.51+ Either a high severity ratio or a wide ownership spread. Find out which before deciding.The 51+ band matters because the two causes need opposite responses. A high severity ratio is a technical problem: the action genuinely breaks things. A wide ownership spread is a coordination problem: the action is fine and involves a lot of people. Treating one as the other wastes time or causes an incident.
When a low score is not reassuring
Three cases, and they are all limits of the model rather than bugs:
1. NO REDUNDANCY AWARENESS The score does not know how many other targets an ALB has. Disrupting the only target and one of forty look identical to it.
2. ONE HOP ONLY A low score means the direct neighbours are fine. It says nothing about two hops out.
3. INFERRED, NOT OBSERVED Edges come from resource metadata, not from network flow logs. A dependency that exists in the application and not in the metadata is invisible.So the correct reading of a low score is: “nothing directly connected will break, as far as the metadata shows”. That is genuinely useful and it is not the same as “this is safe”.
Where the score is computed
The score is computed client-side from the classification the server returns. That is why it is reconstructable by hand: the inputs are all in the side panel, and no hidden weighting is applied on the way.
2. Demo
Three results, decomposed:
RESULT A: delete an unattached EBS volume, prod neighbours 1, all green severity 0/60 nothing impacted environment 0/15 ZEROED (nothing impacted) ownership 0/20 ──────────────────── RISK 0
READ: safe was proven. Apply.
─────────────────────────────────────────────────────────RESULT B: resize an EC2 instance behind an ALB, prod neighbours 4 vol-web-01 green rds-orders green alb-prod AMBER asg-web AMBER severity 2 warnings = 1 affected-equivalent out of 4 -> 15/60 environment 15/15 prod, and something IS impacted ownership 1 team, 1 schedule -> 5/20 ──────────────────── RISK 35
READ: real but bounded. The two ambers are a brief LB target removal and an ASG that may replace the instance. One team. Schedule a window, tell that team, proceed.
─────────────────────────────────────────────────────────RESULT C: edit a shared schedule's stop cron neighbours 186, all amber (modify on mixed types) severity 186 warnings, ratio 0.5 -> 30/60 environment 15/15 prod resources in the set ownership 6 teams, 4 schedules -> 20/20 (capped) ──────────────────── RISK 65
READ: 51+, so ask which cause. Here the severity term is 30 of a possible 60, and ownership is MAXED at 20. This is a COORDINATION problem, not a technical one. No single resource is badly affected; 186 of them are mildly affected across six teams.
The response is therefore not "find a maintenance window". It is "do not edit a shared schedule; give your service its own".
─────────────────────────────────────────────────────────THE COMPARISON THAT TEACHES THE MOST B scored 35 and needed a maintenance window. C scored 65 and needed a different plan entirely. Reading only the number would have sent C to a maintenance window, where it would have gone fine and halved six teams' savings.3. Hands-on (6 min)
1. Run any blast radius and reconstruct the score by hand from the side panel: affected ____ warning ____ total neighbours ____ severity term: ____/60 environment: ____/15 ownership spread: ____/20 your total: ______ reported: ______
2. Find a result scoring 0 in a PRODUCTION environment. Why is the environment term not 15? ______________________________________________
3. Find a result above 50. Which term dominates? [ ] severity ratio [ ] ownership spread What does that imply about the right response? ______________________________________________
4. Take a low-scoring result on a load-balanced service. Does the score know how many OTHER healthy targets that LB has? Y / N What would you check manually? ______________________________________________
5. Write the sentence you would put in a change request, using the score and its decomposition: ______________________________________________4. Knowledge check
Q1
Deleting an unattached volume in a production environment scores 0 risk. Why does the production environment not contribute its 15 points?
A. The environment term applies only to compute resources
B. Unattached volumes are not classified as production
C. Environment points are only added above a severity threshold
D. The environment term is zeroed when nothing is impacted
Show answer
Correct: D. Without that rule every action on every production resource would carry a floor of 15, including provably safe ones, and the score would stop distinguishing them. Zero is meaningful precisely because it is achievable in production: it means safe was proven through the behaviour map or edge matrix rather than merely assumed.
Q2
Two results both score 65. In one the severity term dominates; in the other the ownership spread is maxed at 20. The responses should be:
A. Opposite
B. The same, since the risk is equal
C. Both require executive approval
D. Both should be deferred until the score drops
Show answer
Correct: A. A high severity ratio is a technical problem, so the action genuinely breaks things and needs a maintenance window or a different approach. A wide ownership spread is a coordination problem: the action is fine and involves a lot of people, so it needs conversations or a redesign that narrows the reach. This is why the 51+ band prompts “find out which” rather than a fixed action. Sending a coordination problem to a maintenance window means it proceeds smoothly and still damages six teams’ savings.
Q3
A low risk score should be read as:
A. The action is safe
B. The action has been approved
C. All of the neighbours happen to sit in non-production environments
D. Nothing directly connected will break, as far as the metadata shows
Show answer
Correct: D. The score has no redundancy awareness (it cannot tell the only ALB target from one of forty), traverses one hop only, and works from inferred metadata edges rather than observed network traffic. All three limits are properties of the model rather than defects. Stating the reading precisely is what keeps the tool useful: it is genuinely informative and it is not a safety guarantee.
5. Apply
Put the decomposition, not just the number, into your change requests. “Risk 35: two warnings out of four neighbours, production, one team affected” is a sentence a reviewer can act on; “risk 35” is not.
When a score exceeds 50, always identify which term dominates before deciding what to do about it.
Related lessons
- L2: Impact classification
- L4: Edge detection and limits (next)
- L1: What blast radius answers
- T5.M5.5.L1: The line: what reliability is worth
Glossary terms touched
Risk score · Severity ratio · Ownership spread · Redundancy awareness