Introduction

Severity is what makes an incident list triageable. Without it, four thousand open incidents are four thousand equally urgent things, which is the same as four thousand equally ignorable things.

The part that surprises people: severity is not calculated by Incidents. It is stamped by the control that raised the incident. Which is also why so many incidents have none.

Where to find it

AI Governance > Incidents — the SEVERITY column, and the summary on each agent's Overview tab.

Access to AI Governance is granted through platform roles. Ask your workspace administrator, or see Settings > Governance > Roles for how permissions are assigned.

The levels

The column renders each with a coloured dot on a hot-to-neutral ramp, so a list can be scanned without reading the labels.

How severity is assigned

The control that detects a violation grades it, and a control grades in one of two ways. Which one it uses changes how you should read its incidents.

1. Fixed level — The control stamps the same level on everything it catches — "every finding is tagged with this level". Severity here is a property of the rule, so two very different-looking hits on the same control are graded identically.

2. Graded by the model — The control scores each finding individually against the risk area it governs. Severity here is a property of the event, so two hits on the same control can legitimately differ.

Both grading modes can raise Critical. A fixed level stamps it on every finding; model grading returns Critical, High, Medium or Low for each finding individually.

Two consequences either way:

1. Grading is a control-design decision — If your severities are wrong, the fix is in the controls, not in Incidents. There is nothing to re-score after the fact.

2. An ungraded control produces ungraded incidents — Which is the single most common reason the column is empty.

When severity is absent

A dash in the SEVERITY column is normal, and it is not a bug. It means the incident carries no severity value — because the control that raised it has no severity configured.

This is very common on the shipped framework packs and on early custom controls, where the point of the control is detection and grading has not yet been thought about.

"An empty severity column is not missing data. It is a control that was never asked how much it matters."

What to do about it. Treat ungraded incidents as an unsorted queue and grade the controls that produce the most of them. Grading the ten noisiest controls converts the majority of an incident list from unsorted to triageable, and it is the highest-leverage hour available in this section.

Refer: Grading controls is one half of getting an incident list under control. The other half is reducing what they raise at all — see Tuning Policy Noise.

Severity is not confidence

An incident also carries a confidence of Low, Medium or High, taken from the control's confidence threshold setting. Controls without a threshold record High. The two answer different questions and are easy to conflate.

Because confidence is set on the control, it describes the control rather than the individual finding. A control with a Low threshold is set to catch borderline matches, so expect more false positives from it — whatever severity it stamps.

Severity on an agent

Each agent's Overview tab summarises its incidents: Total, Critical, High, Medium and Low, a table of the five most recent incidents, and View incidents ↗ (shown only when there are incidents).

Ungraded incidents count toward the total and appear in none of the four buckets. A total that exceeds the sum of the buckets is that gap, and it is a useful measure of how much of an agent's incident stream is still ungraded.

Best Practices

1. Grade every control you promote past Flag — If a control is worth blocking on, it is worth saying how much it matters.

2. Reserve Critical — Use it for controls that should page somebody. A list where everything is critical sorts no better than one where nothing is.

3. Grade the noisiest controls first — Sort by volume, not by name. The biggest producers move the most of the queue.

4. Know each control's confidence threshold — A Low threshold catches more borderline matches; expect more false positives from that control.

5. Revisit grading after tuning — A control whose false positives you have just removed may deserve a higher grade than the one you gave it while it was noisy.