Component VEX decisions

Open Gate policies > VEX & Exceptions > Org decisions at /ops/policy/vex/decisions. Recording or editing a decision requires vuln:operate; the Findings service enforces that permission. Read-only users can review the queue.

  1. Select New component decision.
  2. Enter the vulnerability identifier, the exact component PURL from the scan, and the immutable image digest. Preserve the PURL’s qualifiers, including its repository.
  3. Select Continue to decision, choose the status and record the justification, evidence, scope and validity window. Review the request before saving.
  4. Verify the effective status and the release’s promotion gate after Policy consumes the decision. A saved record does not establish that its effect is applied.

The component decision applies to the product across versions in the current tenant. An environment/project scope or a single SBOM-node scope is stored but does not change the tenant-wide gate. See the overlay contract.

To withdraw a decision, select Edit decision, choose Under investigation, and save. The Console updates the same decision identifier. Verify that Policy, the finding’s displayed status and the promotion gate return to their baseline results. An expired validity window also stops the status assertion.

The service reports the decision’s actual signing and attestation state. Saving does not guarantee a signed attestation. Missing artifact-triage projections remain explicit on the artifact workspace; this queue uses the served Findings decision contract.

Source verified against 3a83706af52cab1f80adb345bb8107c591cb3bca (2026-10-19). Re-verify the locator flow in src/Web/StellaOps.Web/scripts/live-vex-component-flow.mjs against an authenticated approved estate and the owning API outcomes. The dated live receipt records the tested source and scope.