Governance work item

packs:security-governance

A governance work item is one named remediation task opened by a campaign item's revoke decision: the decision never revokes anything itself — it opens work for an operator, who completes the item with notes on what was actually revoked. Served by the v2 GovernanceService: ListGovernanceWorkItems and CompleteGovernanceWorkItem.

GovernanceWorkItem

GovernanceWorkItem is one named remediation task a revoke decision opened (a revoke never auto-revokes in v1 — it opens work for the operator; auto-remediation is later pack content).

Field	Type	Meaning
campaign_id	string	The campaign whose review opened this work.
closed_at	timestamp	When the work was completed; unset while open.
closed_by	string	Username of the completing operator; empty while open.
control_id	string	The control the campaign reviewed.
created_at	timestamp	When the record was created.
details	string	The reviewed subject's point-in-time summary.
id	string	The record's identity.
item_id	string	The campaign item whose revoke decision opened this work; one work item per item, however often the decision is re-recorded.
name	string	The work's name, e.g. "Revoke grant rule:/user:".
notes	string	The completing operator's notes (what was actually revoked, and where).
opened_by	string	Username of the reviewer whose revoke decision opened the work.
status	string	"open" | "done".
subject_id	string	The reviewed subject's id in its own table, copied from the campaign item.
subject_kind	string	The reviewed subject's kind, typed like an instrument ref (e.g. "policy_assignment").
updated_at	timestamp	When the record was last updated.

Related pages

• opschain docs resources/campaign — the review campaign and the decision that opens work items.
• opschain docs governance — the review lifecycle end to end.
• opschain docs packs-security-governance — the entitlement that serves the review surfaces.