Correct score formula

Unverified dimensions capped at 2

Confidence deductions applied

Maturity level sequential

No maturity credit without verification

ALLOW_ANY egress finding

Default SA shared identity finding

VERIFIED/INFERRED/UNKNOWN labels

N/A score reported if appropriate

Residual risk and retest section

Verdict derived from score

REGISTRY_ONLY is not a firewall

Bypass paths identified

Wildcard ServiceEntry finding

S3 not egress-gateway-routed

No network-level controls finding

Layered control recommendation

Scoped ServiceEntry recommendation

VERIFIED/INFERRED/UNKNOWN labels

Attack scenario present

Validation steps present

Remediation time horizons

No L7 from ambient alone

Tracking namespace gap

deny-external-to-tracking ineffective at L7

Logistics waypoint scope

Platform namespace unenrolled

VERIFIED/INFERRED/UNKNOWN labels

DISABLE PeerAuthentication note

Attack scenario present

Waypoint deployment recommendation

Remediation validation steps

Control vs data-plane separation

Data-plane over config-plane

Revision skew identified

Finding kept open until reconciled

Missing evidence does not lower impact

Confidence reduced for conflicting evidence

VERIFIED/INFERRED/UNKNOWN labels

Causes of discrepancy enumerated

Reconciliation evidence named

Attack scenario present

Remediation and validation steps

Business impact addressed