Work

Work is your findings inbox. Create an incident when related findings need one owner, not for every event. Guardian recommendations become findings here only after someone on your team creates them.

Approvals is the one inbox the gateway, SDKs, the CLI and permission hooks use, on every plan. Timeout is fail-closed. Approve is not execute: the agent calls again with the same arguments, and the approval only covers that call (same agent, session, server and arguments). Notifications go to Slack, Microsoft Teams, email, Mattermost and webhooks; the Teams card links to the inbox, where you decide. Rules can require two approvers or a reason from the agent, and the requester can't approve their own call while someone else can. An agent can submit a plan for approval up front, which then covers its steps in that session. When you approve, you can remember it for similar calls. CI flows runs CI / evidence-pack templates. Proposed actions are changes HIRO suggested; nothing runs until someone approves it.

1. 1

   Triage findings

   Filter by severity/asset; review evidence.

2. 2

   Optional incident

   Group related findings; assign owners.

3. 3

   Decide approvals

   Allow or deny pending tools, or run a Flow. Details: Control plane.

4. 4

   Tighten policy

   Rules in Policies. Deep dive: Findings & incidents.