Approval Inbox for Ignored Issues

The approval inbox lets you require admin sign-off before users without ignore permissions can dismiss findings. Team members submit ignore requests with a reason, and admins review them in a central inbox before anything is removed from the feed.

Use cases

• 🛡️ Governance over risk acceptance: Keep security leads in control of which findings get ignored.
• 👥 Empower developers: Let engineers triage false positives without handing out full ignore rights.
• 📋 Audit trail: Every request records who asked, why, and who approved or declined.

Enabling ignore requests

Ignore requests are not enabled by default. Only workspace admins can turn them on from the Triage settings.

How it works

Whether a user can ignore an issue directly depends on their Ignore permissions (see Setting Roles and Permissions) and whether Allow Issue Ignore Requests is enabled for your workspace:

• With ignore permissions: Users ignore findings immediately, the same as before.
• Without ignore permissions, with ignore requests enabled: Users submit an ignore request with a reason. The issue stays in the feed until an admin approves or rejects it.
• Without ignore permissions, with ignore requests disabled: Users cannot ignore findings or submit requests.

Ignore requests apply to individual subissues only. Broader ignore rules (by path, CVE, or rule) still require ignore permissions.

When a user submits a request, admins are notified and can review it in the Request Inbox. The inbox lists the issue details, severity, location, requester, and their stated reason.

Review ignore requests

1

Open the inbox

Go to the Request Inbox, or click a pending notification in the messages indicator in the top navigation. The inbox shows a badge with the number of pending requests.

2

Review a request

Click a row or the Review button on a pending request. The review modal shows the full issue context and the requester's reason.

3

Approve or reject

Click Approve to ignore the issue with the requester's stated reason, or Reject to decline the request and keep the issue open.

Pending and handled

The inbox has two tabs:

• Pending: Requests waiting for a decision.
• Handled: Requests you have already approved or rejected, including who reviewed them and when.

Use the search bar to filter by issue title or requester name. If you have a team filter active in Aikido, the inbox only shows requests for issues in that team.

What happens after a decision

Approved: Aikido ignores the issue using the requester's reason. The finding moves to the ignored view and disappears from the main feed. The request is attributed to the original requester.

Rejected: The issue stays open or snoozed in the feed. The requester can submit a new request if needed.

Notifications

Admins or users with ignore permissions see new ignore requests in the messages indicator in the top navigation. Each notification shows the request type and who submitted it. Click the notification to open the Request Inbox.

Slack notifications

You can also receive Slack alerts when a new ignore request is submitted. Aikido posts a message to your chosen channel with a Review in Aikido button that links directly to the Request Inbox.

1

Connect Slack

If you haven't already, connect Slack from Slack integration settings. See Slack Notifications for setup steps.

2

Create a Slack alert

Go to the Request Inbox, open the Ignore Issues tab, and click Manage Alerts → Slack. Click Create Alert and select the channel that should receive ignore request notifications.

3

Test the alert

After saving, use Send test alert on the alert row to confirm messages arrive in the selected channel.