Start with the operational decision
ALLOW means required analysis completed without crossing the active review or block policy. REVIEW means sensitive or correlated behavior needs human context. BLOCK means authoritative or policy-rejected evidence applies. INCOMPLETE means analysis coverage cannot support approval.
Then inspect the reason
The bottom line should state what the extension can do, why that access surfaced, and what must be verified before installation. Counts and severity labels are supporting evidence, not the explanation.
Scores order work
Risk and malware indexes prioritize evidence; they are not calibrated probabilities. Security dimensions show where deductions came from, while analysis confidence shows whether required entrypoints and providers completed.
Approval expires with the artifact
An approval belongs to one hash and ruleset. New versions should be compared for capabilities, dependencies, findings, entrypoints, files, and artifact identity before the decision is carried forward.