Skip to content

Governance

Governance is Furl’s system for controlling whether a remediation runs automatically or requires human approval. It’s a layered evaluation that balances organizational policy with individual preferences, and it can only tighten controls — never loosen them.

When a strategy execution is about to be created, the governance evaluator runs a two-layer check.

Org-wide policies set by administrators:

RuleEffect
Global pauseAll remediations blocked across the org
Blackout windowsNo remediations during specified time periods (e.g., change freeze)
Confidence thresholdStrategies below a confidence score threshold require approval
Autonomy rulesConditional rules (e.g., “auto-execute critical findings, require approval for low”)

Every endpoint has an owner, and every person has a personal autonomy preference that controls how much automation Furl applies to devices they own.

PreferenceMeaning
Org defaultFollow whatever Layer 1 decided
Auto-executeAllow automatic remediation (Layer 1 can still block)
Require approvalAlways require approval, regardless of Layer 1

Each layer can make the decision more restrictive, but never less:

  • Org says auto-execute + person says require approval = require approval
  • Org says require approval + person says auto-execute = require approval
  • Org says auto-execute + person says auto-execute = auto-execute
OutcomeWhat happens
Auto-executeThe strategy proceeds immediately
Require approvalAn execution is created with pending_approval status; the end user is notified
BlockedA global pause or blackout window is active; the execution is deferred

When governance requires approval, the endpoint owner sees the pending remediation in the end-user portal with three options:

  • Approve — the remediation proceeds.
  • Reject — the remediation is cancelled (with an optional reason).
  • Defer — “remind me later”; Furl re-notifies after a delay.

If no action is taken before the severity-based deadline, the request is escalated to administrators.