Skip to main content

Triage and resolve action items

Every action item created for your application lands in your queue to triage. You'll find them in two places in the dashboard: a summary widget on the application home page, and the full list under Manage > Action Items. From there you decide what to do with each one: resolve it, defer it, or reject it as not applicable.

Day to day, that means seeing what's assigned to you, triaging it, and resolving it, with or without help from AI suggestions.

The application dashboard widget​

When you open an application, the home page shows a summary widget with the action items assigned to it.

Action items widget on the application home page showing 8 open items broken down by priority: 3 critical, 2 high, 2 medium, 1 low

Use it as a quick pulse check. If any item is waiting on an admin decision, a pending approval notice appears alongside the counts. Click View all to open the full list.

The list view​

Go to Manage > Action Items from the application sidebar to see every item assigned to your application.

Manage > Action Items list view showing columns for Title, Category, Priority, Status, Score, and Created

Click any title to open the detail view. Items are sorted by score by default, so the highest-value, highest-priority work surfaces first. Closed and rejected items are hidden unless you toggle Show closed & rejected. Use the filters above the table to narrow by category, priority, or status, or the search bar to match on item title.

Triaging an action item​

Click any item to open its detail view. The page has four tabs: Details, AI Suggestions, Comments, and Activity.

Action item details view

From the top of the page you can Resolve, Defer, or Reject the item. Whether the action goes through immediately or needs approval depends on whether an approval action gates that transition for the item. When it does, your action creates an approval request that a reviewer decides on before the item moves.

Resolve​

Mark the item as fixed. If an approval action gates resolving, the item moves to pending_verification and waits for a reviewer to decide on the approval request. Otherwise, it transitions straight to resolved.

When resolving, you can add a short resolution note and an optional evidence URL, for example a link to the pull request that fixed the issue. Send a POST request to /action_item/{id}/resolve to do the same programmatically.

curl -L -X POST 'https://api.nullplatform.com/action_item/xYz789AbCdEf/resolve' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "resolution": "Upgraded base image to node:20-alpine3.19",
    "evidence_url": "https://github.com/org/repo/pull/42"
}'

Defer​

Postpone the item to a future date. You need to provide a reason (at least 10 characters) and a target date. If an approval action gates deferring, the item moves to pending_deferral until the approval request is decided. Otherwise, it moves to deferred and automatically reopens when the target date passes.

Deferral limits

If the category defines max_deferral_count or max_deferral_days, those limits are enforced. An item that has already been deferred too many times, or for too long, is blocked from further deferrals.

The equivalent API call is a POST request to /action_item/{id}/defer.

curl -L -X POST 'https://api.nullplatform.com/action_item/xYz789AbCdEf/defer' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "defer_until": "2026-06-01",
    "reason": "Waiting for the next maintenance window to apply this change safely."
}'

Reject​

Mark the item as not applicable, for example a false positive or an issue that doesn't affect your usage. You need to provide a reason of at least 20 characters. If an approval action gates rejecting, the item moves to pending_rejection until the approval request is decided. Otherwise, it's rejected immediately.

The API equivalent is a POST request to /action_item/{id}/reject.

curl -L -X POST 'https://api.nullplatform.com/action_item/xYz789AbCdEf/reject' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "reason": "This CVE does not affect our usage of this library. The vulnerable function is never called."
}'

Categorizing the outcome​

🚀 Early release

This is rolling out and the available labels may change.

When you resolve, defer, or reject an item, you can tag the outcome with a predefined label, such as marking a rejection as a false positive or a resolution as a priority fix. The labels are a fixed set defined by nullplatform, so you pick from the list rather than typing your own. They give your team a consistent vocabulary for why items were closed out, which is useful when reviewing activity later.

Status flow​

The path an item takes depends on whether an approval action gates the transition. When one does, your action moves the item through a pending_* state first:

When no approval action gates an action, the item skips the pending_* state and transitions directly to resolved, deferred, or rejected. While the item sits in a pending_* state, an approval request waits for a reviewer to approve or deny it, through Slack, a webhook, or the approval request page. You can keep tabs on it from the list view or the Activity tab.

Reviewing AI suggestions​

Some items come with one or more AI-generated fix proposals. Open the AI Suggestions tab to see them. The tab label shows the number of pending suggestions as a badge.

AI Suggestions tab showing an approved suggestion with confidence score

Some suggestions include editable execution parameters (for example, the target version of a dependency upgrade) that you can adjust before approving.

Approve or reject​

Click Approve to authorize the fix. The owning agent picks it up and runs it. Click Reject to dismiss the suggestion.

After execution, the suggestion card shows whether the fix succeeded or failed. On success, you'll typically see a link to the resulting pull request or change. On failure, you can adjust the parameters and retry by approving the suggestion again.

Suggestions can have an expiration date. If you don't act on a pending or approved suggestion before that date, it expires and can no longer be applied.

The underlying endpoints are POST approve and POST reject on /action_item/{actionItemId}/suggestions/{id}.

curl -L -X POST 'https://api.nullplatform.com/action_item/xYz789AbCdEf/suggestions/sUg123AbCdEf/approve' \
-H 'Authorization: Bearer <token>'

Comments and activity​

The Comments tab is where you discuss the item with teammates and agents. Agent comments are labeled with a BOT badge, similar to how Dependabot leaves notes on pull requests. Add a comment with a POST request to /action_item/{id}/comments.

curl -L -X POST 'https://api.nullplatform.com/action_item/xYz789AbCdEf/comments' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "content": "Reviewed the affected resources. This should be prioritized for the next sprint."
}'

The Activity tab is an audit log that records every status change, field update, and approval decision on the item, along with the actor and timestamp. Use it to understand why an item is in its current state and who did what.

Activity tab showing the audit log with status changes, comments, and updates

Next steps​