30-second answer

You cannot tell, and that is the point. Outcome says what the evidence showed (pass, fail, unknown and three siblings). Severity says how much the subject matters, an authored judgement carried on the rule. Attention says what deserves a human's next hour, and the engine computes it as its own output, in five states (act, review, observe, none, not-evaluated) over six tiers, precisely because two consumers once each hard-coded a different priority order over the same results.

What this proves

  • That urgency has a basis requirement. Only a rule whose basis is vendor-documented can reach act; a convention or an opinion never does, however the rule is worded. The engine's two Anyone-links rules show the line: permitting Anyone links is a convention, the tenant default being Anyone contradicts documented guidance, and only the second kind of claim can demand action.
  • That a broken evaluation cannot hide. not-evaluated ranks third of six, above most good news, so a run that saw almost nothing does not present as a clean tenant.

What it does not prove

  • That severity drives anything. In the engine's attention model, severity does not reach the judgement at all; there is a test with exactly that sentence as its name. Severity remains what it is: how much the subject matters, not how loudly to ring.
  • That attention is an outcome. observe exists because the engine reaching no answer happens for two different reasons, and an early version let it fall through a mixed vocabulary to a default rank. States and tiers are separate vocabularies on purpose.

PowerShell

PowerShell
# The same failing outcome, two different attentions, decided by basis
m365-governance evaluate .\evidence\ --profile sharing

Example output

Text
SPO-SHARE-003  fail  severity=medium  attention=act     (documented-guidance)
SPO-SHARE-001  fail  severity=medium  attention=review  (convention)

Explanation

Keeping the three questions apart is what lets each one be honest. An outcome can be recomputed by anyone with the evidence. A severity can be argued with the author, which is why it carries a rationale and is marked configurable. An attention can be regenerated when the model improves, without rewriting history, because it never contaminated the outcome. The practical consequence for a reader: sort your morning by attention, audit your quarter by outcome, and negotiate severities in the rule review, not in the report.

Production considerations

  • If your dashboard maps severity straight to a red-amber-green, you have rebuilt the defect this model removed: an opinion shouting with a vendor requirement's voice.
  • When two tools disagree on priority order, the fix is not a meeting; it is making priority an output of the engine both consume.
  • SPO-SHARE-001: fails as a convention, and can never reach act
  • SPO-SHARE-003: fails against documented guidance, and can

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.