Why a false pass is worse than an honest unknown

Every verification tool faces the same temptation: when it cannot check something, show green anyway. Green is calming. Gray is a question nobody wants to answer on a Friday afternoon. Most tools choose calm.

The problem is arithmetic. A tool that shows green when it does not know has, by definition, a pass rate that includes things it never checked. The first time a client discovers one of those, every other green on the screen becomes suspect. Trust in a verification system is binary: it is either the source of truth or it is decoration.

Four states, not two

A trustworthy engine returns Passed only when evidence proves the requirement, Failed only when evidence proves it is not met, Warning when a human should look, and Unknown when the evidence is not there. Unknown counts against the score. It is not hidden. It is not rounded up.

What that costs

Dashboards that are less green than they could be, and conversations that start with "we could not verify this one." That is a good conversation. It is exactly the one that leads to a manual check, an attestation, or a new integration. The alternative is a conversation three weeks later that starts with "but the report said it was fine."