ops-suppress-correctly

Config-level suppressions provide centralized auditability for AEGIS findings, while per-finding suppressions target individual scanner alerts. Both approaches require explicit rationale, designated ownership, and defined review dates to maintain compliant audit trails across workflows.

A primary anti-pattern when suppressing security auditing findings is masking real issues by omitting required metadata. Suppressing findings without verifying them first or missing the decay window and review date compromises audit trails and creates dangerous security blind spots.

Pattern-level suppressions apply canonical controls across platform-wide security findings. To apply them safely, you must enforce explicit rationale, assign an owner, and configure a decay window to ensure the suppression expires and receives mandatory future review.

Including a decay window and review date for security suppressions ensures findings are periodically re-evaluated rather than permanently ignored. This prevents outdated false positive suppressions from masking newly introduced real vulnerabilities over time, maintaining strict auditing compliance.