Send for Approval Replaces the Remediate Button
A one-click remediation is fast, but fast is not the same as reviewed. When a recommendation fires and the button says Remediate, the next click changes the resource. Nobody else sees the change until it has already landed.
When an approval policy covers a recommendation, the Remediate button becomes Send for approval. Clicking it creates an approval request and notifies every listed approver. The recommendation stays blocked until the required number of approvals land. A gated action is one where the button itself changes to reflect that a review step now sits between the recommendation and the execution.
Approvers Choose One of Three Actions
Approvers open Activity, then Approvals, and see every pending request assigned to them. Each request shows the recommendation, the requester, and the deadline. The approver picks one of three actions.
| Action | What happens next |
|---|---|
| Approve | Counted toward the minimum; once met, the recommendation proceeds |
| Reject | The requester is notified and the recommendation stays blocked |
| Ask for changes | The requester is notified and can update and resubmit |
Once the required number of approvals land, the recommendation moves to execution. A rejection stops the request and notifies the requester. An ask-for-changes response sends the request back to the requester, who can revise and resubmit without creating a new request. The three-way split means a recommendation is never stuck in a binary approved-or-rejected state when the real answer is “fix the scope first.”
Under an active policy, admins are not exempt by default. An admin who triggers a recommendation also needs approval unless the policy explicitly allows admins to run without it. This closes the gap where admin-level access could bypass the review step.
Manual and Custom Recommendations Gate a Different Button
For manual and custom recommendations, the gate works differently. Instead of blocking Remediate, the policy gates the Mark resolved action. The recommendation still requires human action outside the platform, so the review step controls when the team can close the finding rather than when a resource changes.
This keeps the same review discipline for both types. An auto-remediation rule is gated at execution. A manual rule is gated at resolution. Both require sign-off before the recommendation leaves the queue.
The Gate Stops Working When Approvers Do Not Respond
An approval request that reaches its deadline without a decision expires. The recommendation stays blocked, and the team must open a new request or adjust the policy. A team that sets short deadlines without monitoring the approval queue ends up with findings that are neither approved nor rejected.
The gate also cannot catch a recommendation that was bookmarked and triaged before the policy was enabled. The policy applies only to actions taken after the policy is active. Findings that were already past the approval point continue on their original path.
For teams using severity-scored recommendations, the approval flow ensures that a high-severity finding is reviewed before the fix runs, not after.
