> Be really careful with the yellows: if there is low impact, you might be confusing work for progress. If there is low urgency, you might be overestimaging the value of your work.

On the flipside, if only high-urgency projects get done, you end up becoming a 500+ employee IT service provider without a proper Identity and Access Management System (IAM), without a Privileged Access Management system (PAM), a haphazard, ad-hoc secrets store and so on.

That's all fine and good for a 10-person company, you can get by like that when you're 100, above 200 maybe it starts to get icky...

Yes, I understand that if really nothing progresses, you have to prioritize ruthlessly, but you cannot keep doing only high urgency projects forever.