Deciding each finding

Findings are reviewed one at a time. What the page asks of you depends on what kind of check it is.

The ledger at the bottom of a package: the findings that need your decision, with the checks that already passed folded away underneath.

Three kinds of finding

Kind	What the page says	What you do
Passed	This check passed.	Confirm that you have reviewed it, so the record shows you did.
Hard gate failed	This blocks authorization.	Nothing to accept. A hard gate cannot be risk accepted, so the build goes back to engineering.
Soft finding	Your decision.	Accept the risk with a written reason, or reject the submission.

Accepting a risk

Type your reason in the basis field. The field is required, and the controls do nothing while it is empty. Then click Accept risk or press A.

The basis is the first thing an auditor will read, so it should explain why this risk is acceptable for this container at this deployment level. Usually that means one of three things: the developer's justification holds up, the reachability argument is sound, or a compensating control is in place. The basis is stored with your name, the time, and the evidence hash.

The decision bar on a soft finding. The basis is required before either control works.

Once recorded, the finding shows Risk accepted with your basis and the time. You can change it until you record the authorization.

Rejecting a submission

Type your reason in the basis field and click Reject submission or press R. Rejecting is a decision about the whole package, not one finding.

Rejecting closes the merge request

Your reason is posted to the review merge request as a note and the merge request is closed in GitLab under your account. Engineering has to address the finding and submit a new review. The console asks you to confirm before it does this.

Write the reason as an instruction: what needs to change, and what would satisfy you. The developer sees it word for word.

The same bar on a hard gate. There is nothing to accept, so the only option is to send it back.

Judging a High justification

You will not see a mitigated Critical in your queue; the pipeline does not allow it. A High can be justified only when there is no fixed release, and that justification is yours to judge. The three things to look for are the ones on Writing a justification: why the image is not affected, what the upgrade path is, and what limits the risk meanwhile. If any of the three is missing, reject and say which one.

What Explainable AI does here

It explains the finding from the evidence and says what would make the check pass. It does not suggest a basis for accepting the risk, and nothing it writes is recorded as a decision. The basis is always yours.

Moving through the package

Next takes you to the next undecided finding. The stepper at the top shows which ones remain. When every soft finding has a decision and none of them is a rejection, the container moves to Cleared, ready to record and the authorization control unlocks.