# Remediation

Finding a risk is half the job — remediation is how it gets fixed. Mesh
supports three complementary paths, from hands-on to fully automated.

## Guided remediation in Mesh

Every risk and profiling gap comes with context for resolving it. From an
investigation, Mesh shows what the finding means and the step-by-step
instructions to resolve it in the source system. See
[Investigate a risky identity](../getting-started/investigate-risky-identity.md)
for the end-to-end flow.

## Delegation with direct user notification

Often the person looking at a risk is not the person who can fix it.
[Delegation](./delegation.md) assigns the work to the right owner — for a
single identity, or in bulk for every task in a view.

The assignee is notified directly: Mesh sends an email with the scope of the
work, your notes, and a direct link that takes them straight to the relevant
page with step-by-step resolution instructions. They do not need to know
Mesh to receive the assignment — the notification carries everything needed
to get started.

## Automated external remediation through A2A agents

For remediation that lives in another system, Mesh supports the open
[A2A (Agent2Agent) protocol](https://a2a-protocol.org). Administrators
register external remediation agents with Mesh; the Mesh AI assistant can
then discover and invoke them during an investigation — for example, asking
an agent in your ITSM or access-management system to act on a finding.

Registered agents authenticate with the credentials your administrator
configures, nothing is connected by default, and the full data-handling
picture is described in
[AI features and data handling](../overview/ai-features-data-handling.md).

## Prioritizing what to fix first

Not every fix is worth the same. Mesh attaches a ranked list of **remediation
actions** to an identity, finding, or asset, ordered by the
[loss exposure](./risk-scoring.md#from-scores-to-loss-estimates) each one would
buy down — so the action at the top of the list is the one that reduces the most
dollars of risk, not just the most findings.

Each action names a concrete step — disable an account, rotate a credential,
enforce MFA, remove a role, migrate an asset to quantum-safe cryptography, revoke
an OAuth grant — against a specific subject, and carries the risk-score points
and loss exposure it is predicted to remove. A **remediation plan** view narrows
the list to the open work: the actions still proposed, accepted, or in progress.

Actions come from three places: a risk engine that recognizes a known fix, the
Mesh AI assistant (which proposes actions for a person to approve), or a
[what-if scenario](./risk-scoring.md#from-scores-to-loss-estimates) on the loss
model. These surfaces help you *decide and assign*; the fix itself still happens
through one of the three paths above.

## How resolution shows up in Mesh

Remediation happens in your source systems, so Mesh reflects it the way it
learns everything else: through collection. After the responsible connector's
next collection cycle, resolved risks clear and
[risk scores](./risk-scoring.md) recalculate — remediating a risk lowers the
score on a later cycle rather than instantly.

## Related concepts

- [Delegation](./delegation.md) — assigning remediation work
- [Risk scoring](./risk-scoring.md) — how resolved risks change scores
- [Identities](./identities.md) — what the risks attach to
- [Crypto agility](../use-cases/crypto-agility.md) — the certificate and
  software remediation lifecycle end to end