Making it usable
Severity as you mean it
A plain HTTP link on a brochure site and the same link carrying a session are the same rule and very different risks.
At the rule, or at the finding
A rule or a CWE can be regraded across the estate. One finding can be regraded on its own, which a rule level override cannot do and should not try to. Both keep the engine's original grade beside the new one.
Written out of the words on a finding page
A rule matches on what the rule was, where it is, the repository, the CWE it carries, the kind of thing it is, the state it is in, the masked value of a leaked credential, how it was exposed, or who committed the line. Where is the file, or the package for a dependency, so src/legacy/* or one repository can be graded on their own. Those are the labels the finding page itself uses, because somebody writing a rule is looking at a finding and typing what they can see. A star stands for anything, so one rule covers every address at a build domain.
A grade is usually about a combination
A credential is one thing. A credential that only ever existed in git history and is still open is another, and it is a different decision. Conditions join with all or with any, so that is one rule with one reason on it rather than three rules that each fire on their own and regrade findings nobody meant to touch. Where two rules both match, the narrower one wins: more conditions beat fewer, and a rule name beats a kind.
It says how much it covers before you save it
A rule is a decision about a set nobody can see from the page they write it on, and two findings and two hundred are the same sentence. Every rule shows how many findings it covers today, which is what the next scan will regrade, and saving one says the number back. Where the findings list can hold exactly that set the number is a link; where it cannot, it is deliberately not one, because a number that opens a different number is worse than a number nobody can open.
A value that could never match is refused
A kind or a state that does not exist is named on the way in rather than saved. A rule that silently never fires is worse than one that will not save, because nobody goes back to check whether a grade they wrote ever applied to anything.
A regrade holds until the code changes
Regrading one finding records the code it was about. Every scan of the same code keeps the grade, so nobody makes the same decision twice. When the flagged lines change the regrade is lifted, the engine's grade comes back, and the finding says who decided what and that the code it was about has changed.
Scoped by sensitivity
An override can be told not to apply where the system carries a given label, so "this is a low here" does not quietly become "this is a low everywhere".
What it does not do
A regrade is a judgement. The product records who made it and when, and cannot tell you whether it was right. Conditions are matched, not evaluated: there is no arithmetic, no nesting and no brackets, so "this and that, or the other" has to be written as two rules rather than one.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.