Treatments and workflow policy
Choose how each risk is treated, and set the routing, gates, WIP limits and SLAs that govern every card.
Overview
Every finding gets a risk treatment during triage. The treatment, together with your workflow policy, decides where the card goes next and what must happen before it can close.
The policy lives under Manage > Workflow Policy (page title Flow & handoff policy). Everyone with Platform > Workflow Policy: Read can view it; changing it needs Platform > Workflow Policy: Write.
Risk treatments
| Treatment | Meaning | Default route |
|---|---|---|
| Mitigate | Fix the underlying vulnerability. | Remediation Delivery |
| Transfer | Shift risk via insurance or a third party. | Risk Register |
| Avoid | Eliminate through process change. | Risk Register |
| Accept | Log and accept a known risk. A business justification is required. | Risk Register |
A card with no treatment shows Not set and cannot be handed off anywhere.
Change a treatment later
- Open the card and pick a new value in Risk Treatment.
- Outside triage, confirm with Confirm change. For a card in In Progress the dialog asks Abandon in-progress work?; confirm with Abandon & revert.
- The card returns to triage, leaves its queue position, and is routed again from there.
A card in Done keeps its treatment. Reopen it first to change the treatment.
Configure the workflow policy
- Go to Manage > Workflow Policy.
- Change settings in Routing, Gates, Engineering queue, Timing and After delivery.
- Click Save changes, or Discard to undo your edits.
Policy changes take effect straight away, for existing cards as well as new ones. SLA deadlines, aging, routing and which delivered cards appear in the Risk Register are all worked out from the current policy each time a board loads.
| Setting | Section | Default | Range |
|---|---|---|---|
| Routing per treatment | Routing | Only Mitigate goes to delivery | On or off |
| Block items without risk treatment | Gates | On | On or off |
| Block Done until fix validation passes | Gates | On | On or off |
| WIP limit per engineer | Engineering queue | 5 | 1 to 20 |
| Aging threshold | Engineering queue | 7 days | 1 to 90 days |
| Warn on unassigned items in To Do | Engineering queue | On | On or off |
| Auto-assign on pickup | Engineering queue | On | On or off |
| Enforce per-severity SLAs | Timing | On | On or off |
| SLA days per severity | Timing | Critical 7, High 14, Medium 30, Low 90 | 1 to 365 days |
| SLA warning threshold | Timing | 25% of the window left | 5% to 90% |
| Days in Done before auto-push to Risk Register | After delivery | 30 days | 1 to 90 days |
Routing and gates
Routing. Each treatment switched on in Routing goes to Remediation Delivery; each one switched off goes to the Risk Register. This also decides which handoff button a treated card shows.
Block items without risk treatment. A card cannot move into Treated until it has a treatment. Moving a card between Intake and Triage & Decide is always allowed.
Block Done until fix validation passes. A card cannot move from To Do or In Progress to Done until a fix validation has passed. PENOPS refuses the move with This card needs a passing fix validation before it can move to Done.
Warn on unassigned items in To Do. Shows an Unassigned badge. It never blocks a move.
Validate fix only appears on cards whose treatment routes to delivery. If you switch a treatment off while its cards are in To Do or In Progress, those cards can no longer be validated, so with the Done gate on they cannot be closed. Switch the route back on, or change the card's treatment, to unblock them.
WIP limits, aging and SLAs
WIP limit. Counts each engineer's unresolved cards. Once an engineer has as many as the limit, PENOPS refuses further pickups or assignments for them with This would take the assignee over their work-in-progress limit, and the owner menu warns You are over your WIP limit. Force push anyway goes ahead and records the override.
Aging. Open <n> days counts from detection, or from the last reopen. Cards older than the Aging threshold are flagged.
SLA. The deadline is the detection time plus the days set for the finding's severity, so time spent in triage counts. Info findings have no SLA, and neither do cards in the Risk Register.
- A card shows an SLA badge only when it is at risk (less than the warning threshold left) or breached.
- When the card is closed, the clock stops and the panel shows met or <n>d late.
- Reopening a card by hand restarts the clock. An automatic re-detection does not.
- SLAs never block a move. They only flag.
After delivery. A card that has been in Done longer than Days in Done before auto-push to Risk Register also appears in the Risk Register, so its residual risk stays visible. It stays in Done as well.
Good to know
- Without write access the policy page shows You can read this policy but not change it. Editing needs the Workflow Policy permission at write.
- For Accept, saving the treatment without a justification is refused with Accepting a risk needs a written business justification.
- Moving a card into Treated without a treatment, with the gate on, is refused with Set a risk treatment before moving this card to Treated.
- With Auto-assign on pickup on, whoever picks up an unassigned card becomes its owner.