A red, amber, green status hides the thresholds, the trend and the cases near the line. Two projects can both show amber for opposite reasons. Colours stay useful if each has a written definition, a number beside it and a trend arrow, and if a change in thresholds is itself recorded.
What the colours compress
A status colour turns a number into a category. That loses three things.
- Distance from the line. One finding over a limit and a hundred over a limit are both red.
- Direction. Amber and improving is a different situation from amber and worsening.
- Definition. Red might mean any critical open, or any critical past a window, or a manager's feeling.
Readers fill in the missing detail with their own assumptions, which is how the same dashboard produces three different conversations.
How thresholds get gamed
When a colour is a target, effort goes to the colour. Typical moves:
- Move the threshold so a service turns green.
- Split a service in two so each half is under the limit.
- Reclassify severity just below the trigger.
- Count only fixed items and exclude exceptions.
- Review the status on the day after a cleanup.
Goodhart's law, as usually quoted, says a measure that becomes a target ceases to be a good measure. RAG status is a target by design.
Make the colours honest
| Practice | What it prevents |
|---|---|
| Write the rule under each colour | Disagreement about meaning |
| Show the underlying number | Hiding the distance from the line |
| Add a trend arrow or sparkline | Hiding direction |
| Log every threshold change with date and reason | Silent moving of goalposts |
| Report the near miss count | Cliff effects at the border |
| Use an extra state for "not measured" | Grey being mistaken for green |
The last row matters most. A service that was not scanned should not appear green. Use a distinct state, such as grey, and count how many services sit in it.
Steps to improve an existing dashboard
- List each colour tile and write what red, amber and green mean in one sentence.
- Check that red has a named owner and an expected action.
- Add the number and trend to each tile.
- Add a not measured state and show its count.
- Freeze thresholds for a period, and review them on a schedule rather than ad hoc.
- Keep a change log visible on the dashboard.
When colours are fine
For operational alerting, such as a failing scan job or an expired certificate, colours with strict definitions work well. For posture summaries, treat the colour as a pointer to the numbers, and never as the report.
Reading someone else's RAG
Ask three questions: what is the rule, when did the rule last change, and how many items are not measured? If nobody can answer, the colour is opinion.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Should unscanned services show green?
No. Use a separate not measured state so missing data is visible.
How often should thresholds change?
On a planned schedule, with each change logged with a date and reason.
Sources
Last reviewed: 19 October 2026.
