QuantQFix — threat remediation
QuantQFix is the approved-fix layer of the NHI misuse threat library. Each finding carries a proposed playbook, and someone other than the proposer approves it. It runs under a credential scoped to that one action, and the case closes only when the source system shows the change.
Case · playbook · two approvals · evidence trail. Nothing runs until a person starts it.
Remediation at each stage of the attack path
The same five stages as the threat library. Reversible actions run once approved. Anything that cannot be undone, or could stop a release, stays a proposal the owning team carries out.
plan
Agent token issued for a routine task, then never rotated or owned.
Rotate the secret
Can be undonecode
Token used to author and merge a change it was never approved for.
Remove the elevated role
Can be undonebuild
Artefact signed by a build identity acting outside its approved scope.
Open a change record
Proposal onlydeploy
Promoted to production out of window, by a key nobody owns.
Open a change record
Proposal onlyrun
Credential still valid after revocation, used with no checkout behind it.
Contain and rotate
Can be undoneBuild and deploy stay proposals because revoking a signing key or a deploy key cannot be reversed and can stop a release. Quantlyx opens the record; your team decides when.
Four playbooks, reversible first
Each playbook names the systems it touches, the credential it runs with and how to undo it, before anyone approves it.
| Playbook | What it does | Credential it runs with | Undo |
|---|---|---|---|
| Rotate the secretPlan and code stages | Rotates one credential in the privileged access platform and confirms the next login uses the new value. | Rotate on one vault account, used once, expires in 15 minutes | Previous value held in escrow for 24 hours. Restoring it reopens the exposure. |
| Contain and rotateRun stage | Forces check-in of open sessions, rotates, and opens an incident with the unexplained logins attached. | Check-in and rotate on one vault account, used once, expires in 15 minutes | Rotation restorable from escrow. The incident stays open either way. |
| Remove the elevated roleCode stage | Captures current roles, reduces the identity to read, and routes an owner task to the resource team. | Membership change on the named repositories only, used once, expires in 15 minutes | Roles re-granted exactly as captured before the change. |
| Open a change recordBuild and deploy stages | Opens a change with the finding and its evidence attached, assigned to the owning team. | None. Quantlyx writes nothing to the target. | Nothing to undo. The team carries it out under its own change process. |
The life of a case
A playbook reporting success is not the end. The case closes when the next collection from the source system agrees.
Proposed
Finding, evidence and playbook
Approved
Never by the proposer
Started
By a person, not a schedule
Scoped execution
One credential, one action
Confirmed
By the source system
The proposer cannot approve
Refused at the point of decision, not reported afterwards. One approver cannot count twice.
Two approvals where it matters
Production or critical cases need two approvals, and one of them must come from an independent security approver.
Undo is part of the playbook
Every reversible playbook captures the state before it runs. Undoing a run reopens the finding with both the run and the undo on its record.
Every step is evidence
Proposal, approvals, each action and the source system's confirmation sit in one hash-chained trail beside the finding. An edit anywhere breaks the chain.
What each of the four findings gets
The findings neither register can raise alone, and the playbook proposed for each.
Approved for a person, made by a bot
Remove the elevated role from the automation identity, and route the change back for approval under the actor that actually made it.
playbook: remove the elevated role · approvals: 2 · undo: yes
Pipeline identities nobody enrolled
Reduce the identity to read and open an owner task, so it is either enrolled with a named human or retired.
playbook: remove the elevated role · approvals: 2 · undo: yes
Revoked in the record, still deploying
Rotate the token the revoked entitlement depended on, so the record and the pipeline finally agree.
playbook: contain and rotate · approvals: 2 · undo: yes
Break-glass used as the normal release
Open a change record with the recurring releases and the missing incidents attached. Quantlyx will not interrupt a release path.
playbook: open a change record · approvals: 1 · undo: not applicable
QuantQFix is ready for pilot, not yet generally available. The reconciliation core keeps its read-only credential; QuantQFix runs as a separate component with permission you grant per playbook and can withdraw without losing your findings.
QuantQFix acts on the misuse the NHI misuse threat library raises: a ranked worklist, an owner, an approved write, and the standing privilege removed. A person approves every action. It is the approval and execution layer of identity threat remediation.
ID entitlement. Rank by risk. Remediate.
Start with a two-week, read-only pilot against one lifecycle path. If nothing turns up, you keep a clean report.