Run checks and handle findings
The checks run on every change and cost nothing. This guide opens the findings of the Claims Platform, shows one on the canvas, fixes it, and handles the ones you decide to keep.
On this page
Before you start
- A diagram open in the editor. The checks run on any diagram you can open; handling a finding (accept, dismiss, fix) needs a diagram you can edit.
- Facts on the model. The checks read what the model states: technologies, protocols, encryption, authentication, replicas, backups. The more it states, the more the checks find. See Check rules.
Open and read the findings
- Run the checks
Choose Run the checks in the Share menu or the Assistant menu. The review panel opens on its Checks part.
A line says what ran, for example 36 rules run without AI on v14 · 9 findings.
- Narrow the list
Filter by Severity (HIGH, MED, LOW, INFO), by Scope (the whole version, or only what changed since an earlier version) and by Status (Open, Risk accepted, Resolved, Dismissed). Type a rule or an element in the search field to find one.
- See it on the canvas
On a finding, select Show REL-01 on the canvas. The canvas shows the elements the finding is about, pinned on the drawing.
You can name the element at fault and the rule it breaks, for example REL-01 Single point of failure on Claims API.
Fix a finding
- Fix it yourself, or ask for a fix
Change the model: for REL-01, give the Claims API instance two replicas across zones, or state its high availability in the Inspector. Or select Ask the Assistant for a fix on the finding: the fix comes as a proposal, and nothing changes until someone applies it.
- Check that it is resolved
The checks run again on the change.
The finding moves to Resolved. A fix proposed by the Assistant says it beforehand, for example REL-01 resolved, no new finding.
Keep a finding, with a reason
Not every finding needs a change. Each one says why you kept it, so that a reviewer can read it later.
| You want to | Action on the finding | What it records |
|---|---|---|
| Live with the risk for now | Accept the risk | Why the risk is acceptable, and an optional review date. The finding shows Risk accepted by … |
| Accept a gap to a standard until a date | Request an exception… | An exception with its scope, expiry and controls. See Accept an exception |
| Record the choice as a decision | Create a decision (MADR) | A decision record linked to this version. See Record a decision |
| Say it does not apply | Dismiss… | A reason: By design, Accepted risk, False positive or Later, and an optional note |
Reopen puts a kept finding back to Open. Assign… gives it to a person.
The checks say what the model states, not what runs in production. A finding on a fact the model does not state (no backup stated, no authentication stated) is fixed by stating the fact, not by dismissing it.
Variants
- An Assistant review adds its own findings to the same list, marked Assistant review. Ask: “Review this view for security.” It uses credits; the checks do not.
- Threats from a threat model join the list too, after Add to the review. See Find threats with STRIDE.
- Standards findings (STD, GOV rules) appear only when your workspace keeps a technology radar, decisions or exceptions. See Standards.
- The full page of the review opens with Ctrl Shift R; its Standards tab shows the standards this diagram applies and its deviations.
If it doesn't work
“The checks run on every change and find nothing open here.”
No rule fires on what the model states. That can be good news, or a sign that the model states little: add technologies, protocols, replicas and backups, and the rules have something to read.
“No finding matches these filters.”
Select Show every finding to clear the filters, or set Status back to All.
A finding I fixed is still open
The change did not state the fact the rule reads. Open the rule in Check rules to see what to state, for example the zones of the replicas for REL-02, then check the element in the Inspector.
More: Check rules, Review and sharing.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.