[dangrondahl]

Summary

Adds a how-to guide, Override an attestation's compliance, in Risks and controls → Implementing controls, and adds the override permission to the roles permissions matrix.

Overrides aren't public yet: the kosli attest override CLI command is hidden, and the override API endpoint isn't in the API reference. The page opens with a warning that both may change without notice, and that you should only use overrides if your organization's compliance process allows manual overrides.

The page covers:

• Who can override
• The CLI flags and API fields side by side
• CLI and curl examples for both directions (non-compliant to compliant, and compliant to non-compliant), each with a screenshot
• Linking an override to a ticket with the optional fields
• Overriding an attestation on an artifact, by fingerprint or by template name and commit
• How overrides behave, and where they show up in the audit trail
• An optional GitHub Actions workflow_dispatch workflow that takes the override fields as inputs

For reviewers

• Every example was run against a real org, with both the CLI and the API, including artifact overrides and the optional fields.
• The page warns that an override which doesn't point at an artifact lands on the trail as an unexpected attestation. That is a known server bug, tracked in the server repo; the warning can go once it's fixed.
• The permissions (Admin or Member) are taken from the server code, not tested. Please check that Admin or Member is the intended permission.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
kosli	🟢 Ready	View Preview	Nov 6, 2026, 12:56 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[claude]

Claude finished @dangrondahl's task in 1m 46s —— View job

---

Follow-up review (commits 9a01368..4db3e93)

This commit splits "Run overrides from a manually triggered workflow" into CLI and API tabs and reworks the KOSLI_HOST handling.

• Hardcoded EU host: still resolved — the fallback moved from the inline ${KOSLI_HOST:-https://app.kosli.com} shell default to vars.KOSLI_HOST || 'https://app.kosli.com' in the step's env, same effective behavior, now shared by both tabs. Closed out with an inline reply.
• Undocumented artifact-override shape: not touched by this commit (the "Override an attestation on an artifact" section is unchanged) — no reassessment needed, previously resolved status stands.

No new bugs or regressions in the changed lines — the new kosli attest override CLI invocation quotes its inputs and matches the flags documented earlier on the page, and the || GitHub Actions expression is valid. 1 inline comment posted (confirming the host finding).

[claude]

Follow-up review (commits ca201af..c708ac2)

The new commit only adds four optional override fields (repo_info, user_data, annotations, external_urls) plus a curl example for them, inserted at lines 39-42 and 46-62. Neither prior finding's location was touched:

• Hardcoded EU host in the workflow_dispatch example (line 203): not addressed — the workflow's curl command still hardcodes https://app.kosli.com; no KOSLI_HOST variable was added.
• Undocumented artifact-override shape (target_artifacts / artifact_fingerprint / git_commit_info, lines 36-38): not addressed — these rows are unchanged; no tested artifact example or git_commit_info shape was added, and they weren't removed.

No new bugs or regressions in the added lines — the new JSON examples are valid and match their field descriptions.

0 new inline comments posted.

[claude]

Follow-up review (commits 34a4a93..bc4dcc6)

• Hardcoded EU host in the workflow_dispatch example: resolved — the curl command now uses ${KOSLI_HOST:-https://app.kosli.com} and a KOSLI_HOST repo variable was wired into the step's env.
• Undocumented artifact-override shape: resolved — a new "Override an attestation on an artifact" section documents the git_commit_info shape and gives examples for both artifact_fingerprint and target_artifacts, plus a table update and a new "artifact must be reported first" behavior bullet. (Per the PR description this path is still untested against a real org, unlike the trail-level examples — worth a mental asterisk, not a blocker.)

No new bugs or regressions found in the changed lines. 2 inline comments posted, both closing out the previously open findings.