Waiting for Approval
The dangerous test was the one that appeared to work immediately. The workflow created the approval request and the callback arrived seconds later, so nobody noticed that a repeated callback could resume the same action twice.
We made the pause explicit. The run stored a correlation key and an expected state; the callback had to match both before resuming. A second callback became an idempotent “already handled” result. Rejected, expired, and malformed callbacks were recorded without touching the response action.
A webhook is not an approval by itself. It is an untrusted message asking a paused run whether it may continue.
A response action can be technically correct and operationally wrong. For a critical asset, we wanted the XDR workflow to pause, create an approval request, and resume only when the decision returned to the exact waiting run.
Pause is not failure
The workflow stores the incident ID, action type, target identity, and local request key before it waits. The paused state is explicit: approval pending. It is not a timeout and it is not permission to retry the action.
incident arrives
-> evaluate policy
-> create approval context
-> pause
-> receive authenticated callback
-> validate correlation and decision
-> resume once
The callback carries only the decision, correlation ID, approval reference, and timestamp. It does not carry broad XDR credentials or become a general command endpoint.
Validate before resuming
The receiver checks that the incident is still waiting, the action matches the request, the approval has not already been consumed, and the callback is authentic. A repeated callback returns the existing outcome instead of resuming the action again.
| Check | Reject when |
|---|---|
| Correlation | Unknown or completed request |
| Decision | Unsupported value |
| State | Workflow is not pending |
| Authentication | Signature/key invalid |
| Replay | Callback already processed |
The exact webhook URL and connector configuration vary by deployment; the pattern is documented here as a generalized design. It is a pause/resume control flow, not an API for creating a native XDR incident.
Show the audience the race
The strongest demo is a duplicate approval arriving twice. The first callback resumes the workflow; the second is acknowledged as already processed. The action runs once, and the audit trail explains why.