Check quality

Check quality is where Owners and Admins adjudicate “this finding is a false positive” disputes raised by the team, track a check’s confirmed false-positive history, and mute a noisy check tenant-wide for a bounded time.

This entire area is gated to Owner and Admin. Anyone else who navigates here sees a plain permission-denied message instead of the tools below.

What’s on the page

Dispute queue — severity, finding, status, reporter, reason, when it was reported, and Confirm/Reject controls.
Check quality — search by check id, or browse cards that appear as disputes reference them, each showing confirmed-false-positive counts by check version and a button to create a suppression rule.
Active suppression rules — check, tool, reason, approver, expiry, when it was created, and a Revoke control.

All three lists are paginated independently, and the pagination state stays in the URL. There’s no page that lists every check that exists — the cards you see are limited to whatever the dispute queue has surfaced, plus whatever check id you search for directly.

What you can do

Everything on this page requires Owner or Admin, re-checked server-side. Note that this is a stronger requirement than filinga dispute in the first place, which Engineers can also do from a finding’s own page — reviewing a dispute is treated as a governance decision, raising one is not.

Confirm a dispute: Records a confirmed false positive and suppresses the finding for a long default horizon (currently ten years) — it will not reopen on future scans, and it counts toward the check’s false-positive metric.
Reject a dispute: Requires a resolution note. Rejecting doesn’t change the finding’s status at all — it’s a record that the dispute wasn’t accepted, not a triage decision.
Create a suppression rule: Requires a tool, a reason, and an expiry date. Every new finding that check raises anywhere in your tenant is born suppressed until the rule expires — existing findings are left alone. A check that already has an active rule can’t get a second one.
Revoke a suppression rule: Stops the rule from muting new findings going forward.

How to read it

Confirming a dispute isn’t a permanent exception — the resulting suppression still has a real expiry and goes through the same warn-then-expire lifecycle as any other suppression, it just defaults to a much longer horizon.
If the underlying finding was already resolved by the time someone reviews the dispute, confirming still records the false positive and still counts toward the check’s metric, but the suppression step is skipped — the record explicitly notes the finding was no longer active.
Suppression only ever affects new findings from that check going forward. Existing findings the check has already raised are untouched.
Revoking and letting a rule expire are not the same thing: revoking only stops new findings from being muted, while a rule reaching its natural expiry also reopens findings it had previously suppressed.
A suppression rule always requires an expiry — there’s no way to mute a check tenant-wide with no end date.

Before your first scan

With nothing to review yet, each section says so on its own: “No pending disputes,” “No checks to review — dispute a finding, or enter a check id above,” and “No active suppression rules.”