> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/working-with-nullify.md).

# Working with Nullify

## Overview

Nullify runs autonomously, but the best security programs are a partnership. There are moments where Nullify needs a human decision — a judgment call it shouldn't make alone, a piece of context only your team has, or an approval before it acts. This page covers how that back-and-forth works: the **action items** Nullify raises, the **chat** you can hold with it anywhere, and the **escalations** it sends when something needs attention.

## Action Items

An **action item** is a tracked unit of work that Nullify files when it genuinely cannot proceed on its own. Rather than guessing or stalling silently, it asks — and once you answer, it picks the work back up automatically. There are a few kinds:

* **Escalated finding** — Nullify wants your call on a finding before acting: approve it, reject it, or ask for changes.
* **Clarifying question** — Nullify is missing a piece of context (a policy, an environment detail, an ownership rule). Answer once, and it re-triages every finding that was waiting on that answer.
* **Unmapped user** — Nullify knows the person involved in one system (say, a GitHub handle) but needs help mapping them to another (say, their Slack account) so it can route work to them.
* **Unassigned team** — a repository or finding has no owning team. Assign one, and every unassigned finding in that scope is routed.

You resolve an action item simply by supplying the judgment it asked for — from the dashboard, or by replying in the Slack thread or ticket comment where it reached you. Nullify only marks an action item complete once the underlying work has actually happened, not because it *said* it would; and it never auto-closes one just because time passed. If the underlying problem goes away on its own, Nullify resolves the item for you.

You also have a few deliberate controls of your own: reopen a finding Nullify dismissed (with a reason), re-route ownership, or just answer in chat.

## Chat with Nullify

You can talk to Nullify wherever you already work — the dashboard, [Slack](/connectors/slack.md), [Microsoft Teams](/connectors/microsoft-teams.md), and in pull request and ticket threads. Ask it about:

* **Findings** across code, dependencies, containers, secrets, cloud posture, and pentests.
* **Remediation campaigns** and their progress.
* **Security metrics and trends.**
* **Threat investigations** and which repositories are affected.

Nullify answers in plain language and links back to the relevant place in the dashboard. From the dashboard chat it can also **act** on your behalf — reassign a pull request's reviewers, reassign, comment on, or close a ticket, rebase or promote a stalled fix PR, allowlist a finding, or create a ticket. In Slack and Teams, chat is oriented toward questions and answering Nullify's action items; for state-changing actions it points you to the dashboard.

## Escalations

When a finding needs developer action and isn't moving — a fix PR is open but unreviewed, a fix is blocked, or a secret needs rotating — Nullify sends an **escalation**. Each one carries the finding's facts, why it needs attention, the risk and SLA, and a link to the finding, delivered as a direct message to the owner, to a channel, or both. Reply in the thread to discuss, answer, or ask for more context.

See [Slack notifications & escalations](/connectors/slack/slack-notifications.md) for how to configure where escalations land. Escalation paths and the autonomous actions Nullify is allowed to take are part of [Security Program Management](/capabilities/program-management.md).