Accept a risk, with an expiry date¶

A risk acceptance applies to one CVE in a scope. It also covers the new findings of that CVE in the scope.

For AI agents

Only an agent with a write_risk_accept token can accept a risk. It uses the tool risk_accept_decision with the kind make, and the decision must have an expiry. A write token cannot see this tool. Ask the user before each risk acceptance.

Prerequisites¶

A role that allows risk acceptance: security_lead or admin (What your role lets you do).

Steps¶

Open a finding from the Findings table.
Select Risk-accept this CVE.
Select a namespace. The acceptance covers this CVE in that namespace. A line in the dialog shows the scope.
Set an expiry date. The first date that you can select is tomorrow in UTC. When this date passes, the findings become Open again.
Write the reason. Other users read it on the Approval list.
Select Create decision. The risk acceptance is in effect. It shows in Decisions on this CVE.
The Approval list shows all the risk acceptances in effect. Open it from the side menu. Each row shows the CVE, the scope, the reason and the expiry date.

Stop a risk acceptance¶

On the Approval list, select Revoke.
Select Confirm revoke. The risk acceptance stops, and its findings become Open again.

Next: Change many findings at once.