Skip to main content
Mitigation Actions allow ResolveAI to propose remediation steps during incident investigations — such as silencing a noisy alert or reverting a suspect commit — for you to review and approve before anything is executed.
Human-in-the-loop: ResolveAI only proposes actions. Every action requires explicit human approval before execution. Resolve never has direct access to execute write APIs on your monitoring platforms.

​
Supported Action Types

​
Alert Silencing/Snoozing

Temporarily mute noisy alerts.

​
Security and Safety

Mitigation Actions are designed with multiple safety layers to ensure you stay in full control. The model never executes write operations directly. During an investigation, Resolve evaluates whether a mitigation is warranted and, if so, creates a proposal. The proposal is then presented to your team for review. Only after a human explicitly clicks “Approve” does the execution engine carry out the action using your integration credentials. This is the same approach used for Git code remediation, where Resolve proposes PRs that require explicit approval before creation. Key safeguards:
  • Explicit approval required — Every proposal must be approved by a human via the Resolve UI or Slack before any action is taken.
  • No direct API access — The AI model that generates proposals is completely separated from the execution engine that interacts with your monitoring platforms. The model cannot call write APIs.
  • Encrypted credentials — Integration write credentials are stored encrypted and only used by the execution engine after human approval.
  • Full audit trail — Every action is recorded: who proposed it, who approved or rejected it, when, and what was affected. View the complete history in the Activity Dashboard.
  • Revocable — Approved alert silences can be revoked at any time, which deletes them from the monitoring platform immediately.
  • Auto-expiration — Proposals that are not acted upon automatically expire based on the proposed silence duration.
  • Scoped permissions — Write permissions are scoped to specific operations (e.g., silence management only) and do not grant broader access.

​
Prerequisites

​
Integration Permissions

If your integrations currently use read-only tokens (the default for investigation), you will need to upgrade them with write permissions to enable executing Mitigation Actions. Read-only tokens will continue to work for investigation and mitigation proposals — only mitigation execution requires write access.
You only need to update permissions for the platforms where you want to use Mitigation Actions. Other integrations can remain read-only.

​
Configuring Mitigations

Alert silencing is enabled by default for all organizations. An admin can opt out or customize settings on the Mitigations page.

​
Organization Defaults

  1. Navigate to Admin > Mitigation Activity in the Resolve UI
  2. In the Configuration section, you’ll see the available action types:
    • Alert Silencing — enable to allow silence proposals during investigations
  3. Click Save
All action types default to disabled — you must explicitly enable each one.

​
Team Overrides

You can customize mitigation settings for individual teams to override the organization defaults.
  1. In the Configuration section, expand Team Overrides
  2. Select a team from the dropdown
  3. Toggle the desired action types for that team
  4. Click Save
To remove a team override and revert to organization defaults, click Delete Override on the team’s configuration. Configuration hierarchy: Team override > Organization default > Disabled

​
How Mitigations Work

​
During an Investigation

  1. Alert evaluation — During an alert investigation, Resolve evaluates whether a mitigation action is warranted given all of the production context
  2. Proposal creation — If warranted, a proposal appears in the investigation canvas showing:
    • The proposed action (e.g., “Silence alert X for 60 minutes”)
    • The rationale for the proposal
    • Any other relevant metadata for the action (e.g., risk-level, duration, revertability, etc)
  3. Notification — If the investigation is connected to a Slack thread, the proposal is also sent there with interactive Approve/Reject buttons

​
Approving or Rejecting

  • In the Resolve UI: Click Approve or Reject on the proposal card in the investigation canvas
  • In Slack: Click the Approve or Reject button on the proposal message
On approval:
  • For alert silencing: A silence, downtime, or muting schedule is created in your monitoring platform. A “View in platform” link appears in the proposal.
On rejection:
  • The proposal is marked as rejected. No action is taken.

​
Revoking an Approved Action

For alert silencing, you can revoke an approved silence at any time:
  1. Find the approved proposal in the investigation canvas
  2. Click Revoke
  3. The silence is immediately deleted from the monitoring platform

​
Proposal Expiration

Proposals that are not acted upon automatically expire. The expiration window is based on the proposed silence duration — if a silence would no longer be useful by the time it’s approved, it expires instead.

​
Activity Dashboard

The Admin > Mitigation Activity page provides an overview of all mitigation proposals across your organization.

​
Overview Metrics

  • Total suggested — Number of proposals created
  • Approved — Proposals approved by a user
  • Rejected — Proposals rejected by a user
  • Pending — Proposals awaiting a decision
  • Revoked — Approved actions that were subsequently revoked
  • Failed — Proposals where execution failed after approval
  • Expired — Proposals that expired before a decision was made
  • Approval rate — Percentage of proposals that were approved

​
Activity Log

A filterable table showing all proposals with:
  • Status, action type, user who acted, timestamps
  • Link to the original investigation
  • Expandable details showing rationale, audit trail, and metadata
Filters:
  • Time range: Last 24 hours, 7 days, 30 days, or 90 days
  • Status: All, Approved, Rejected, Pending, Revoked, Failed, Expired
  • Capability: All, or filter by specific action type

​
Troubleshooting

No mitigation proposals are appearing during investigations
  • Verify that the desired action types are enabled in Admin > Mitigation Activity > Configuration
  • Confirm your integration tokens have the required write permissions (see Prerequisites)
  • Check that the integration health check is passing in the Integrations page
Execution fails after approval
  • The integration token likely lacks the required write permissions. Check the permissions table above and update your token.
  • Verify the integration health check is still passing
Proposals are expiring before I can act on them
  • Proposals expire based on the proposed silence duration window. Contact the Resolve team if you need to adjust the default duration.