The decision pipeline
Every recommendation flows through the same chain — and each stage is labeled by maturity, so you know what ships today:
What every tenant has today, GA: the deterministic CSC Score, the SHIP / HOLD / BLOCK pre-flight verdict, and incident investigation with cited evidence. The Early Access stages add judgment on top — they never replace the evidence discipline underneath.
Why the Advisor sometimes says nothing
Silence is a designed outcome, not a gap. If the evidence adds nothing beyond the score and the verdict, no note appears. The bar for speaking is would this change the decision — which means every note you do see was considered worth interrupting you for. A system that always has advice is padding; one that mostly doesn’t is exercising judgment.What it knows — and what it doesn’t
It knows what the collector and scanners can observe: workloads and their state, every deployment, config, and GitOps change (including the diff that shipped), cluster events, RBAC posture, scan findings, and your incident history in ChangeGuard. It does not know your business context, your roadmap, dependencies outside the cluster, metrics you haven’t exposed, who is on call, or what was said in a meeting. Recommendations are explicit about this boundary — an honest “the score can’t see X” is part of the product’s contract, and any recommendation that needs unknowable context should say so rather than guess.How to challenge a recommendation
You are supposed to push back. The product is built to make that cheap:- Open the citations. Every investigation claim links to the evidence behind it — events, rollout state, the change diff. If a citation doesn’t support the claim, the claim loses.
- Read the activity timeline. The append-only record shows what was observed and decided, in order. No retroactive edits.
- Re-run the pre-flight. Verdicts are deterministic on the same inputs — if reality changed, the verdict updates and says why.
- Override it. A held change you approve ships — and the outcome is recorded. If it ships clean, that’s logged as a false positive against the verdict; if it causes an incident, that’s logged too. Your overrides are evidence, and the system’s track record is computed from them — you can hold it to its record.
That last point is the accountability loop: ChangeGuard keeps score on itself. Prevented incidents, false positives, and missed failures are tracked per tenant from real outcomes — not self-reported.