Risk

The Risk tab ranks every workload in the cluster riskiest-first, on a 0–100 score where higher is worse.

What you see

• A severity summary band across the top — counts by level.
• A ranked table, one row per workload, with a vertical score badge, a level pill, and severity-tinted chips naming the top reasons that workload scored what it did.
• An expandable drill-down per row showing every contributing factor, a root-cause evidence block, and an on-demand AI root-cause analysis panel.

Levels

Level	Meaning
Critical	Acting now is the correct response.
High	Scheduled work, this sprint.
Medium	Backlog with a date.
Low	Known and accepted.

The same four levels and the same colours are used on every other cluster tab, so a Critical on Risk means the same thing as a Critical on Security.

Root-cause analysis

Each row can be expanded into evidence — restarts, events, log tail, dependencies — and then into a narrative explanation. The explanation panel states where the answer came from: a model, a cache replay, or a deterministic gate. The prose alone would not tell you, and the difference matters when you are deciding how much to trust it.

RCA declines rather than guesses. If there is no trace data for a workload it says so, instead of reporting a 0% error rate that would read as healthy.

From the CLI

rtz risk                            # the same ranking, worst first
rtz risk workload payments/checkout # why this one scored what it did
rtz rca payments/checkout           # the evidence block
rtz rca explain payments/checkout   # the narrative

See CI gates for --fail-on.