Calculation Reference

This page documents how Velnoro calculates the metrics you see across dashboards, reports, and governance views. All metrics update automatically each time a scan completes.

Health Score

Every asset receives a health score from 0 to 100. The score is the sum of four independent factors:

Health Tiers:

• Healthy (green): score of 71 or above
• Needs Attention (amber): score between 41 and 70
• At Risk (red): score of 40 or below

Program Health (shown on the dashboard) is the average health score across all scored assets, rounded to the nearest integer.

Governance Coverage

Governance coverage measures the percentage of assets that meet all three criteria simultaneously:

1. Has an active owner (owner_id is not null)
2. No policy violations (the asset does not use any restricted or blocked connectors)
3. In a managed environment (the environment is marked as managed in your environment settings)

Formula: (governed assets / total assets) * 100, rounded to the nearest integer.

An asset missing any one of these criteria is considered ungoverned. For example, an asset with an owner and no violations but in an unmanaged environment does not count as governed.

Risk Tier Classification

Risk tiers classify assets by governance priority. Lower tier number = higher criticality (following Microsoft convention):

How tiers are assigned:

The system evaluates multiple signals and assigns the most critical (lowest number) tier:

• T1 signals: Production environment with policy violations, orphaned assets with violations, production and orphaned combination, production with health score below 40.
• T2 signals: Any production environment asset (floor for all production assets), non-production with violations, orphaned non-production, stale active assets (not modified in 90+ days but still active/published), non-production with health score below 40.
• T3 (default): All other assets that do not trigger T1 or T2 signals.

Risk tiers can be manually overridden. When an override is active, the auto-calculated tier is still shown for reference.

Review Cadence Metrics

These metrics track progress through the governance review pipeline:

• Review Completion Rate: Percentage of tracked assets that have received at least one review decision (approved, rejected, needs work, or in review). Formula: ((total tracked - unreviewed) / total tracked) * 100, rounded.
• Unreviewed Assets: Count of assets still in the unreviewed state (no review decision has been made).
• Changed Since Review: Count of previously reviewed assets whose metadata has changed since the last review. These are flagged for re-review because the underlying asset may no longer match what was originally approved or rejected.

Re-review triggers are based on metadata hash comparison (see Change Detection below).

Change Detection

Velnoro detects changes between scans by comparing a deterministic hash of each asset's metadata:

Hashed fields:

• Display name
• State (active, draft, etc.)
• Owner ID
• Asset type
• Environment ID
• AI connectors (sorted for order-independence)
• Last modification date

The hash is computed using SHA-256 over a normalized JSON representation. Null values are converted to empty strings for consistency.

Two uses:

1. Scan-to-scan diff: Assets present in both the current and previous scan whose hash differs are counted as "modified."
2. Review staleness: When a reviewer approves or rejects an asset, the current hash is stored. If a later scan produces a different hash, the asset is flagged as "changed since review."

KPI Snapshot Fields

Each completed scan produces a KPI snapshot that captures the state of your tenant at that point in time. These snapshots power trend sparklines and delta comparisons.

Hover over any metric on the dashboard for a quick explanation via the info icon tooltip.