> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/workspace/settings/control-evaluation.md).
# Control Evaluation
Control Evaluation is where you configure which security controls are evaluated on your GitHub organization, and how strictly. Settings here apply org-wide, and are reflected in the [Overview](https://docs.stepsecurity.io/workspace/overview) dashboard and the control detail pages.
**To reach this page:** open the sidebar and go to Settings > Control Evaluation.
### **Pinning Exemptions**
**Exempted Actions from Pinning Control**
The [Actions should be pinned to a full-length commit SHA](https://docs.stepsecurity.io/workspace/overview#actions-should-be-pinned-to-a-full-length-commit-sha) control normally flags every third-party GitHub Action referenced by a branch or tag instead of a commit SHA. Use this field to exempt specific Actions from that control.
* Type an action name (e.g., `actions/dependency-review-action`) and press Enter to add it.
* Wildcards are supported, e.g. `actions/*` exempts every Action under that owner.
* Exemptions apply across the security scan and build-log analysis for the org, and are also honored by the automated pinning pull requests, so an exempted Action is never flagged or auto-pinned.
Click **Save** to apply changes.
### **PAT Governance Controls**
This card configures the org's PAT Governance policy, which is evaluated against your GitHub personal access token inventory on every scan. Violations appear as findings on the token controls in [All Controls](https://docs.stepsecurity.io/workspace/overview#all-controls), and per-control notification toggles live under [Settings > Notifications](https://docs.stepsecurity.io/workspace/settings/notifications).
Use the toggle at the top of the card to turn the whole policy on or off. While it's off, none of the controls below are evaluated, no findings are generated, and no notifications fire, regardless of how the individual toggles below are set. Turning it back on resumes evaluation on the next scan.
Once enabled, each control can be configured independently:
| Control | Severity | Setting |
| ------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Tokens should be rotated within max age** | High | **Fine-grained (days)** and **Classic (days)** set separate maximum ages per token class. Set either to `0` to disable that class's age check. Owners get pre-expiry reminders at the bands set in **Reminders (days before expiry)**, a comma-separated list (e.g. `30, 7, 1`). |
| **Tokens should have an expiration** | High | Toggle on to flag tokens created with no expiration, or with an expiration further out than the configured max age allows. |
| **Tokens should have minimum scopes** | Critical | Toggle on to flag classic tokens with a coarse scope such as `repo`, `admin:org`, or `workflow`, fine-grained tokens with all-repository write access, and full-scoped or global Azure DevOps PATs. |
| **Tokens should be actively used** | Medium | **Idle limit (days)** flags a token with no use for longer than this window. Set to `0` to disable the staleness check. A never-used token is measured from when it was granted. |
| **Tokens should belong to active users** | Critical | Always evaluated while the policy is on, to flag tokens whose owner was removed from the organization, has an unlinked SAML identity, or is suspended. It has no toggle of its own, since it turns off only with the master policy toggle. |
**Also open a GitHub issue per alert (optional)**: enter a repository in this organization to have each PAT governance alert file a summary issue there, in addition to any other configured notification channels.
Click **Save** to apply changes.
### **Repository Selection**
Control which repositories are included in control evaluation. When a repository's **Controls** checkbox is on, its workflows are evaluated against the enabled controls; when off, that repository is excluded from control checks (Harden-Runner and other scans are unaffected).
* Use the search box to find a repository by name.
* Archived repositories are marked with an **Archived** badge.
* The refresh icon on a row re-evaluates that repository's controls immediately, without waiting for the next scheduled scan. It's only available while controls are enabled for that repository.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/workspace/settings/control-evaluation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
