Why can a HIGH finding be WARN while the release is INCOMPLETE?
Three different questions
- Severity
- How large is the potential impact?Intrinsic severity stays attached to the finding.
- Disposition
- What does the evidence support now?Confidence and corroboration can hold a finding at
WARN. - Release
- May this candidate proceed?Release policy combines all dispositions with required coverage.
Read the full sentence
Read HIGH → WARN as: a high-impact condition was observed, but the current evidence does not justify blocking under the enforced finding policy. Read INCOMPLETE separately: required evidence, such as SCA, is missing. WARN is not PASS, and INCOMPLETE is not a scanner crash.
Release precedence
The managed release policy evaluates BLOCK before INCOMPLETE, then WARN, then PASS. A confirmed blocker still blocks even when coverage is also incomplete; the record preserves both facts.
What do I do with this?
Review policy and confidence, then configure release policy. For missing evidence, go to coverage.