Update Set Risk

What it does

Point it at a retrieved update set and it tells you what committing it would do: what touches the global scope, what deletes something, what overwrites work that is newer on your instance than the set is, what changes your schema or your access control, and what arrives already running.

Then you decide. It cannot commit anything — it has no way to.

This is not the platform's preview

Preview answers "has anything here changed since this set was captured?" It finds collisions.

This answers "what is in here that deserves a second look?" It finds risk.

A set can preview perfectly clean and still be the one that takes production down, because preview has no opinion about a business rule landing in the global scope or a scheduled job arriving active.

What it flags

Global-scope changes - A scoped application can only damage its own scope. A global change has no such boundary. Deletions - An overwrite can be recovered from the version history. A deletion of something that only exists here cannot. Overwrites of newer work - The local record was changed after the set was captured. Committing silently discards that. Schema changes - Applied on commit, and not undone by rolling the set back. Access control changes - Alters who can read or change what, and nothing on the surface says so. Code that runs - Business rules, script includes, scheduled jobs — things that execute rather than sit there. Jobs arriving active - They start running on their own schedule the moment the set is committed.

Severity follows scope, not record type. A business rule inside an application's own scope is that application doing its job; the same rule in the global scope runs against your whole instance. Getting that distinction wrong is how a risk report ends up flagging a third of an ordinary application install as high risk, and a report like that is one nobody reads.

No risk score, deliberately

A number invites a threshold. A threshold invites automation. An update set automatically approved because it scored 7 has not been reviewed by anybody.

The verdict is a sentence a change approver can read without opening anything, and the decision stays where it belongs.

What installing it costs you

Nothing to configure and nothing to trust. No credentials, no external service, no outbound network access, no licensed prerequisite. It reads update sets already on your instance and writes its own findings, which cannot be edited afterwards — a risk report somebody can amend before a change approval is not a risk report.

Two roles: one to scan and read, one to also delete old scans.

What it does not do

• It does not commit, preview, or modify an update set. There is no write path. • It does not tell you whether an update set is correct — only what it would touch. • It does not replace reading the thing. It tells you which parts to read.