Closed-Loop Remediation: Finding, Fix, PR, Re-Scan, Verified

The half of compliance nobody automates

Almost every compliance tool is good at the first half of the job: finding problems. Scan, list, assign a severity, show a red badge. Then it stops and waits for a human to do the actual work — figure out the fix, ship it, and, crucially, prove it worked. That last step is where findings quietly rot. A ticket gets closed, but was the underlying issue actually resolved, or did someone just mark it done?

KollGuard is built to close that loop. For eligible findings, it doesn't just report — it drives the finding all the way to verified.

The loop, end to end

For findings that qualify, the cycle looks like this:

1. Propose the fix. KollGuard generates the concrete change that would remediate the finding, not just a description of the problem.
2. Open a pull request. The proposed fix lands as a PR in your repository — reviewable, diffable, and subject to your normal code-review process. Nothing is applied behind your back.
3. Re-scan after merge. Once the PR is merged, KollGuard re-scans to check the change against reality.
4. Mark it verified. If the re-scan confirms the issue is gone, the finding is marked verified — closed because it was proven closed, not because a human clicked a button.

That verification step is the part a checkbox platform can't offer. "Mark as resolved" is an assertion; a re-scan is evidence. Closing the loop means the system, not a person's memory, confirms the fix held.

Autonomy on your terms

An agent that can open pull requests is powerful, and power without control is a non-starter for anyone serious about security. So the remediation loop is governed by an explicit agent action policy:

• Autonomy modes. You decide how much the agent is allowed to do on its own versus what requires a human in the loop. A team just getting comfortable can keep it conservative; a team that trusts the loop on low-risk fixes can let it run further.
• An approval inbox. Actions that need sign-off queue up in one place for a human to approve or reject, so nothing consequential happens without review when you want review.
• A master kill-switch. If you ever need to stop the agent entirely, one switch does it. No hunting through settings — a single, unambiguous off.

This is the difference between an autonomous agent you can trust and one you have to babysit. The controls are the feature, not an afterthought bolted on for compliance's sake.

Why the loop matters more than the fix

It's tempting to focus on the flashy part — an AI writes a patch. But the durable value is the loop, not any single fix. A one-off suggestion still leaves you responsible for shepherding it to done and confirming it worked. A closed loop means the path from finding to fix to PR to re-scan to verified is a single tracked motion, with the state of every finding reflecting what's actually true in your systems.

That's what "truly agentic" should mean in a compliance context: not just detecting drift, and not just suggesting remedies, but carrying an issue all the way to a verified resolution — under autonomy modes, an approval inbox, and a kill-switch that keep you firmly in control of how far it goes.