Four ways a green check lies
The empty result, the adjacent claim, the vacuous pass and the dashboard: four collector failure modes that read as passing, each presented as a verdict for you to call before the reveal.
Four collectors follow. Each one is green: the job succeeded, the output is tidy, the dashboard is calm. Your task is the verdict an assessor would reach — and each of these failure modes has shipped in the wild, which is why they have names. Call each one before reading on.
Trap 1 of 4 — The empty result
Your collector queries a compliance rule for NON_COMPLIANT resources and returns an empty list. The job exits zero and the dashboard tile goes green.
Is the empty list evidence that everything complies?
Exit check — name three reasons a green check can be wrong.
Any three of the four: the empty result (nothing found is indistinguishable from nothing ran), the adjacent claim (related subject matter filed as a join), the vacuous pass (a check over an empty population), and the dashboard (a rendering standing in for its source, logic, coverage and failure path). If you can also say what each collector must additionally prove — that it ran, what it evaluated, and what it claims for exactly — the step held.