A risk score can justify urgency but not a change. Notes from ROCon on remediation evidence, ownership and what to test before automating fixes.