finding-to-verified-remediation

Finding to Verified Remediation

Outcome

Produce a validated security finding and an owned remediation ledger. A proposed fix, merged change, deployed build, passing retest, accepted risk, and closed finding are different states.

When to use

Use for one finding within written asset and method scope when assessment and remediation need accountable owners. A read-only export can support first triage. An Access Review Analyst may supply separately validated permission evidence, but is not an automatic slot in this route.

Discovery and user direction

Inspect existing Security Crews, scope authorization, current finding and asset state, severity policy, issue, change, deployment, retest sources, and closure authority. Propose reuse or reviewed creation. Show the exact route before Builder applies it; selection leaves setup pending.

Required inputs

Bind tenant, finding ID, asset, affected environment and build, scope authorization, allowed methods, source report, severity rule, owner, fix criterion, independent retest rule, and closure policy.

Plan and AgentWorks tools

Reuse Security Findings Analyst and Security Remediation Coordinator. Findings writes security-finding/v1 with applicability and source evidence. Run the bundled validator before Remediation consumes it. Remediation re-reads current source state and writes security-remediation-ledger/v1 with issue, reviewed change, deployment, retest, and disposition. Add explicit validator steps in the Workflow. Require separate authorization for any ticket, code, deployment, scan, or closure write.

Knowledge and persistence

Save scope, tenant, finding, asset, environment, observed and deployed build, policy, issue, change, approval, deployment, retest, disposition, run, and action IDs. Re-read current finding and deployment before repeats; retain failed retests and earlier risk decisions.

Validation and reporting

The validator checks exact joins, scope, applicability, evidence, deployment, retest identity, and closure gates. Fictional finding and remediation ledger pass in their open state; the merged-only closure fails. A separate verified ledger shows the evidence required for closure. The reporting dashboard distinguishes unconfirmed, owned, change pending, deployed, retest blocked, verified, accepted risk, and closed states with restricted source references and cost.