riskassessment
riskassessment copied to clipboard
List Decision Automation Rule # in `Decision By` field
Right now, the Database Overview
doesn't do a good job of maintaining the relationship between the automation rules and the Decision By
column seen below. Naturally, we'd want to see the rule responsible for assigning those decisions named in that column, like the current workflow that exists on the Upload Packages
tab. However, the relationship is disjointed because after an upload occurs, the decisions can become "stale" if an admin
or lead
changes the decision automation rules without re-assessing all the pkgs in the database. Therefore, if Rule 1 determined that package xyz was should be "High Risk" at timepoint A, and then an admin
changed Rule 1 completely, or perhaps just deleted it, we can no longer point to Rule 1 as being responsible for said decision.
As such, I think users should be prompted whenever changing rules if they'd like to "apply decision automation on current database". If not, we can continue to use the tag "auto assigned" here, which is intentionally vague. But if they confirm, we could launch a process that reassigns decisions. What's great is that this process wouldn't need to re-run pkg_ref()
or pkg_assess()
, or even re-score pkgs, thus preserving those metrics at the original timepoint they were assessed, and avoiding unnecessary compute resources. Instead, the process would unserialize the blob for each pkg and run it against the new rules. If the rules only include score-based rules, we wouldn't even need to unserialize the blob, since those are already stored.
Thoughts @Jeff-Thompson12?
I think this is still interesting to look into, but it is not necessary, and thus, a really low priority.