Working with cases
Every case lives in one Slack thread. This page covers the buttons, who can press them, and how a case ends.
One thread per case
Averil posts each case once, in your case channel. The top message says what happened, how severe it is, how confident Averil is, and the evidence behind each claim. As the case moves, Averil updates that message and replies in the thread, so the channel stays readable.
| Button | What it does |
|---|---|
| Approve plan | Approves the exact steps shown. Only people on your approver list. |
| Reject | Rejects the plan. Nothing runs. |
| Assign | Makes you the owner of the case. |
| It was intended | Closes the case as a deliberate change. |
| Accept risk | Opens the Averil console, where you give a reason and an end date. |
| Open case | Opens the case in the Averil console. |
Approving the exact action
A plan lists each step, its target and the outcome Averil expects. It also shows a short action hash. Your approval is bound to exactly those steps. If anything changes, the plan needs a new approval.
- Low and medium-risk plans can be approved from Slack by one person on your approver list.
- High-risk plans show no buttons. An admin approves them in the Averil console with a passkey. A change that can't be undone needs two different people, each with a passkey. Nobody can approve their own request.
- Right before each step, the executor checks your policy again and confirms the hash. Then it runs the step and reads back the result.
Answering Averil's questions
When an investigation needs something only a person knows, the question appears in the case thread. Reply in the thread and mention @Averil. Without the mention, Slack does not send your reply to Averil. Your answer goes on the case, and the investigation picks up again with it.
Accepting a risk
Sometimes the right call is to live with a problem for now. Accepting a risk needs a person (never a model), a reason, and an end date in the future, at most one year away. When the date comes, the case is due for another look.
Dismissing and reopening
- It was intended closes the case as confirmed intended. If the same thing happens again within 30 days, Averil attaches it to this case without posting, unless it is more serious.
- Any other dismissal needs a reason, which stays on the case.
- A closed case can reopen with a reason. It starts a new version, and the earlier outcome stays in the history. Reopens count toward the 30-day reopen rate.
Who can do what
| Role | Can |
|---|---|
| Viewer | Read cases, dashboards and the action log |
| Member | Comment, confirm ownership, ask Averil, approve low-risk actions on resources they own |
| Responder | Assign, dismiss, accept risk, reopen, export cases, approve low and medium-risk actions |
| Admin | Manage integrations, policies and playbooks, approve high and critical-risk actions |
| Owner | Billing, autonomy levels, members and deleting the account |
Stuck? Email averil@averil.ai or ask me in Slack.