Remediation Plans & Safety Boundaries

When risk assessment identifies an over-privileged, stale, or exposed machine identity, NHI Security can generate a Remediation Plan. To protect production infrastructure from accidental disruption, remediation operates under strict safety boundaries:

Plans must be validated via dry-run simulations before execution.
Execution against external cloud providers is gated by the deployment flag REMEDIATION_EXECUTION_ENABLED (disabled by default in self-hosted deployments).
Approved actions require Two-Person Integrity (dual admin approval).

1. Remediation Lifecycle

[ Risk Finding ]
       |
       v
+------------------------+      Dry-Run Simulation      +-------------------------+
| Generate Remediation   |  ------------------------->  | Verified Plan & Diff    |
|         Plan           |                              | (Expected Provider Ops) |
+------------------------+                              +------------+------------+
                                                                     |
                                                                     v
                                                        +-------------------------+
                                                        | Dual Admin Approval Gate|
                                                        | (Requester != Approver) |
                                                        +------------+------------+
                                                                     |
                                                                     v
                                                        +-------------------------+
                                                        | Provider Executor Run   |
                                                        | (AWS, GitHub, K8s, etc.)|
                                                        +------------+------------+
                                                                     |
                                                                     v
                                                        +-------------------------+
                                                        | Hash-Chained Audit Trail|
                                                        +-------------------------+

2. Generating a Plan

A remediation plan specifies the exact sequence of provider operations needed to mitigate a finding:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/remediations/plans \
  -H "Authorization: Bearer $ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "findingId": "find-01J9...",
    "strategy": "revoke_stale_access_key"
  }'

Example response showing planned operations and blast radius:

{
  "id": "rem-plan-84920",
  "findingId": "find-01J9...",
  "status": "pending_approval",
  "targetIdentity": "arn:aws:iam::123456789012:user/ci-deployer",
  "operations": [
    {
      "provider": "aws",
      "action": "iam:UpdateAccessKey",
      "parameters": {
        "userName": "ci-deployer",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "status": "Inactive"
      }
    }
  ],
  "dryRunPassed": true,
  "simulationResults": {
    "impactedServices": 0,
    "lastObservedUse": "112 days ago"
  }
}

3. The Execution Safety Gate

Before any change is dispatched to a cloud provider, NHI Security checks the deployment configuration:

Setting	Default	Behavior
`REMEDIATION_EXECUTION_ENABLED`	`false`	When `false`, plans can be generated and approved for governance records, but cannot mutate external infrastructure.
`REMEDIATION_REQUIRE_DUAL_APPROVAL`	`true`	The administrator approving the plan must be a different individual from the requester.

Check if execution is enabled in your environment:

curl -s https://app.trustivan.com/nhi/api/v1/remediations/summary \
  -H "Authorization: Bearer $ADMIN_SESSION" | jq .executionEnabled

4. Approving and Executing Plans

Once verified, an independent Organization Admin approves execution:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/remediations/plans/{id}/approval \
  -H "Authorization: Bearer $SECOND_ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "decision": "approved",
    "notes": "Verified CI pipeline migrated to OIDC; legacy access key is safe to deactivate."
  }'

Execution runs immediately upon approval. If the provider returns an error, the plan status is marked partially_failed, and an alert is recorded.

5. Audit Logging

Every plan generation, dry-run simulation, approval, and provider execution is permanently committed to the immutable audit trail:

curl -s "https://app.trustivan.com/nhi/api/v1/audit/records?category=remediation" \
  -H "Authorization: Bearer $ADMIN_SESSION"

Each record contains the operator’s identity, the target provider ARN, the parameter diff, and the cryptographic hash chaining this event to the previous record.

Get started

Inventory

Govern

Reference

Remediation Plans & Safety Boundaries

1. Remediation Lifecycle

2. Generating a Plan

3. The Execution Safety Gate

4. Approving and Executing Plans

5. Audit Logging

​1. Remediation Lifecycle

​2. Generating a Plan

​3. The Execution Safety Gate

​4. Approving and Executing Plans

​5. Audit Logging

1. Remediation Lifecycle

2. Generating a Plan

3. The Execution Safety Gate

4. Approving and Executing Plans

5. Audit Logging