Work

Findings, incidents, approvals, and flow templates.

Investigate & close

Work queue at /dashboard/work — Exact page: /dashboard/work — findings inbox with audited status changes.

Work is your findings inbox. Create an incident when related findings need one owner — not for every event. Guardian recommendations become findings here only after someone on your team creates them.

Approvals is the same privileged-tool inbox the CLI and permission hooks use. Timeout is fail-closed. Approve is not execute. Mattermost, HTTPS webhooks, CLI, quorum, and ask_user all land on one table. Flows runs CI / evidence-pack templates.

1
Triage findings
Filter by severity/asset; review evidence.
2
Optional incident
Group related findings; assign owners.
3
Decide approvals
Allow or deny pending tools, or run a Flow. Details: Control plane.
4
Tighten policy
Rules in Policies. Deep dive: Findings & incidents.