Coverage Summary

Overview

Coverage transparency is a core OrgGuard principle: we tell you what we can’t see. The Coverage Summary page shows which asset types OrgGuard discovers automatically, how reliable that discovery is, and where you need to supplement with manually created records to achieve full governance coverage.

Use this page when you’re:

Onboarding and want a quick confidence check before trusting the inventory
Investigating a suspected discovery gap (e.g. “where’s my external certificate?”)
Deciding whether to create manual assets for a category OrgGuard doesn’t cover well

What you’ll see

Summary metrics (4 tiles)

Total Assets Discovered — count across all asset types on the most recent scan
High-Confidence Coverage — percentage of asset types OrgGuard discovers reliably; the tile color-codes green at ≥ 75%, amber at ≥ 50%, and red below 50%
Expiring (90 Days) — count of assets with an expiration within 90 days (amber)
Open Findings — active policy violations needing action (red)

Coverage by Asset Type (matrix)

The matrix has one row per asset type with columns:

Column	Notes
Asset Type	Certificate, Connected App, Auth Provider, Named Credential, External Credential
Discovery Method	How OrgGuard discovers this asset type — reads “Automatic” for every row
Confidence	High / Medium / Low — color-coded badge
Discovered	Count on the most recent scan

Click any row to expand it. The expanded panel shows two fields:

What it discovers — plain-English description of what OrgGuard reads for this type
Known limitations — what cannot be discovered and why (API limit, by-design, permission-dependent)

Last Discovery Scan

A footer line shows the timestamp of the most recent scan — useful for confirming the data is fresh.

Common tasks

Task: Check whether your environment is adequately covered

Who can do this: OrgGuard User.

Open the Coverage Summary tab.
Look at High-Confidence Coverage — the tile turns green at ≥ 75%, amber at ≥ 50%, and red below 50%; an amber or red tile means some asset types are Medium or Low confidence.
Review each row in the matrix. If a type is High confidence and has assets discovered, you’re good for that type.
For Medium / Low confidence types, click the row to read Known limitations and decide whether a manual-supplementation workflow is needed.

Task: Identify discovery gaps

On the matrix, sort mentally or visually by Confidence: Low at the top of your priority list.
For each Low/Medium row, expand it.
Read Known limitations carefully — sometimes the limitation is by design (e.g. secrets never exposed) and not actionable; sometimes it’s a permissions gap you can fix.
If it’s a gap that matters, note it for manual follow-up (see the note below).

Supplementing coverage for undiscoverable assets

Some governance-relevant assets can’t be auto-discovered — external certificates, vendor credentials, or assets that live in other systems.

Task: Re-check coverage after fixing a permissions gap

After granting additional permissions (e.g. ensuring the integration user has System Administrator or OrgGuard Admin access), trigger a scan from Scan Management.
Wait for the scan to complete.
Return to Coverage Summary and click Refresh.
Expected result: the Confidence badges and discovered counts reflect the new permissions.

Confidence-level reference

Confidence	Meaning	Implications
High	Full metadata is available via API; all key fields (name, type, status, expiration) are reliably extracted.	Trust the data. Policies can be applied confidently.
Medium	Assets are discovered but some metadata fields may be inferred or unavailable.	Review findings carefully; consider manual-asset supplementation for the missing fields.
Low	Limited API access; coverage has significant gaps.	Expect to supplement heavily with manual assets.

Asset-type specifics (as of OrgGuard Pro 1.0)

Asset Type	Typical Confidence	Primary Limitation
Certificates	High	External/uploaded certs may lack expiry data depending on source format
Connected Apps	High	Consumer secrets not exposed (by design); integration user must have admin-level access
Auth Providers	Medium	OAuth client secrets redacted by the API; token expiration not available from metadata
Named Credentials	High	Password/token values never exposed; expiration only available for certificate-based auth
External Credentials	Medium	Relatively newer Salesforce feature; metadata completeness varies by type

Expand each row in the UI for the current, verbatim limitation text.

Troubleshooting

Symptom	Likely cause	Fix
Coverage Summary shows 0 discovered for a type you know exists	Permissions gap — integration user can’t read that metadata	Check the system-admin or OrgGuard Admin permission set assignment; the integration user needs full metadata visibility.
High-Confidence Coverage percentage is lower than expected	Some asset types have no discovered records yet, or confidence dropped due to partial scan	Re-trigger a scan from Scan Management; if persists, check the most recent Scan Run record for a Partial status and Error Summary.
”Known limitations” text missing or truncated	Data-load error	Click Refresh; if persists, OrgGuard Admin: check Diagnostic Logging for data-load errors. Others: email support@orgguard.com.
Manual assets don’t affect coverage percentages	Coverage percentages measure auto-discovery; manual assets are tracked separately	Expected behavior — coverage is about what OrgGuard automates, not total inventory size.
Last Discovery Scan timestamp is old	Scheduled scan hasn’t run recently or is failing	Check Scan Management for Running/Failed scans.

FAQ

Why is coverage less than 100% even in a healthy org? Some limitations are permanent and by design — Connected App consumer secrets are never exposed by Salesforce, for instance. A healthy org usually shows 80–95% depending on asset mix. Use manual assets to close governance gaps; don’t chase 100% auto-coverage.

What does “Discovery Confidence” on an individual asset mean? On the asset’s Discovery tab you’ll see High/Medium/Low for that single asset. This reflects the quality of metadata extracted for that specific asset, which may differ from the aggregate Confidence for the asset type (a well-configured Named Credential with an explicit expiry might be High, while another is Medium).

How often does Coverage Summary refresh? On-demand only — click Refresh. The underlying counts come from the most recent scan. To update the data itself, trigger a new scan.

Can OrgGuard discover assets outside Salesforce? Not automatically. Manual assets are the supported way to track external auth objects. Pro+ and Max tiers may introduce discovery of additional surfaces — check the roadmap.

Why do Auth Providers show Medium confidence? Salesforce redacts the OAuth client secret in metadata (correctly — that’s a security property), and token expiration isn’t available from Auth Provider metadata. OrgGuard discovers the Auth Provider record reliably but cannot read the secret or an expiry, so the type is rated Medium. External Credentials are Medium for a related reason — they’re a newer feature whose metadata completeness varies by type.

What do I do about Low-confidence types? Three options: (1) accept the gap if governance risk is low, (2) supplement with manual assets to close it, (3) grant the integration user additional permissions if the gap is permission-caused (recheck by re-scanning).

Asset Inventory — browse the assets and add manual ones
Scan Management — trigger a scan to refresh this view
Permission Sets — grant the permissions required for higher-confidence discovery
Policies — how assets get evaluated for governance violations
Diagnostic Logging — investigate why a discovery phase failed