What the counts on a tile mean

Four numbers, and not one of them is a score.

• It can do — every capability the credential behind that deployment actually permits. Almost never enumerated anywhere, and reliably larger than whoever deployed it expected.
• You wanted — what it is authorised and expected to do. Usually clear, whether or not anybody wrote it down.
• Not wanted — the gap. Permitted, and nobody asked for it.
• Nothing in the way — how many of those sit behind something that is not a control. This is the only number a control moves, and the gap between the last two columns is the business case for putting one in.

There is no rating here and there will not be one. The same policy is dangerous in one deployment and harmless in another, and nothing about the document changed: risk depends on the assets, the consequences and the date. A policy cannot be dangerous; a deployment can.