Tasks

Tasks are the individual pieces of work that keep your compliance program moving: collect this evidence, review that policy, remediate this finding. Each task has an owner, a due date, and links back to the objects it's about, so the work and the context stay together, without a separate tracker on the side.

The goal is that your team logs into Openlane and knows what's due, who owns it, and what it relates to.

Missed compliance work is easy to overlook: an access review that slipped a quarter, evidence nobody collected in March. Tasks give every piece of recurring work clear ownership and a deadline, and completed tasks become part of your audit trail: proof the work happened, when, and by whom.

The home dashboard surfaces tasks that are due soon, so the answer to "what needs doing?" is the first thing people see when they log in.

Where tasks come from

Source	How it works
The Tasks page	Create a task on the Tasks page with a title, type, assignee, due date, and any related objects.
Another object	Open a control, risk, or policy and create a task from there, and the link back is made for you. This is the most common path: you spot a gap while looking at a control, and the follow-up work is one click away.
A template	Reuse a task template for repeatable work like offboarding an employee, with the details and linked objects already filled in.
A CSV import	Upload a CSV to create many tasks at once, like a full set of evidence-request tasks at the start of an audit period.

Creating a task

Create a task from the Tasks page with Create → From Scratch (or From Template, see task templates), or from the object that needs the work. Two fields on the form warrant explanation:

• The Type list (Evidence, Risk Review, Policy Review, Other) is customizable through custom data, so it can match how your team categorizes work
• Associated objects are what carry context to the assignee. A task linked to its control tells them exactly what evidence goes where; an unlinked task makes them reconstruct that from the title.

Task templates

Some work happens the same way every time it comes up, such as offboarding an employee. A template holds that task's instructions and links once, so each new instance starts from the template instead of a blank form.

A template is a task with This is a template turned on. When you create a task from it, the new task starts with these fields filled in:

Field	Copied from the template
Title, type, details, and tags	Yes
Associated objects, such as controls and policies	Yes
Assignee	Yes, when the template has one
Assigner	No. The assigner is whoever creates the task.
Due date	No. Each task gets its own deadline.

Set an assignee on the template when the same person always does the work, such as the IT lead who handles every offboarding, and each new task goes to them without another step. Leave the assignee blank when it changes each time, and choose who to assign as you create the task.

To create a template:

1. On the Tasks page, select Create → From Scratch.
2. Fill in the task the way you want every copy to start. An "Employee offboarding" template might hold the offboarding checklist in its details and link to your access control policy and its controls.
3. Turn on This is a template.
4. Click Save as template, or click Save as template and use to also create the first task from it.

To create a task from a template:

1. Select Create → From Template and search for the template.
2. Pick the template to open a new task form filled in from it.
3. Change what is specific to this task, such as the person being offboarded, then set the due date and the assignee if the template left it blank, and save.

Editing the new task leaves the template unchanged.

Templates stay out of your normal task lists and counts. Use the Templates quick filter on the Tasks table to find, edit, or retire them, and look for the Template badge on each one.

Bulk task creation

To create many tasks at once, such as a full evidence-request queue, import a CSV:

1. Open Import tasks, or select Bulk Upload from the ... menu on the Tasks page.
2. Upload your CSV. Title is the only required column, and your column names do not need to match ours.
3. Map your columns to task fields, remap any values your file spells differently (such as a status), and preview the tasks before importing.

See Import data from CSV for a walkthrough of each step. The field reference on the upload step lists every supported field and links to an example CSV.

What teams use tasks for

Use Case	Example
Evidence requests	"Upload the Q3 access review export for CC6.1" assigned to the platform lead, due before the audit window closes
Policy reviews	Annual review tasks for each policy owner, created in bulk at the start of the year
Remediation	A finding from a scan or gap analysis becomes a task with a deadline, linked to the risk it addresses
Audit preparation	Walkthrough scheduling, document collection, and auditor requests, tracked in one place
Automated collection	A developer wires the Openlane Go client into a CI/CD pipeline to create and close evidence tasks automatically

API examples

CSV

# Create
Title,Details,Status,Due
Collect quarterly access review evidence,Upload IAM review output for Q1,OPEN,2026-03-31T00:00:00Z
Verify vendor SOC 2 refresh,Confirm latest report and attach evidence,IN_PROGRESS,2026-03-15T00:00:00Z

# Update
ID,Status,Due,AssigneeEmail
TSK01J9TASK11111111111111,IN_REVIEW,2026-03-20T00:00:00Z,[email protected]
TSK01J9TASK22222222222222,COMPLETED,2026-03-12T00:00:00Z,[email protected]

GraphQL

mutation {
  createTask(
    input: {
      title: "Collect quarterly access review evidence"
      details: "Upload IAM review output for Q1"
    }
  ) {
    task {
      id
      title
    }
  }
}

mutation {
  updateTask(
    id: "TSK01J9TASK11111111111111"
    input: {
      details: "Evidence package moved to final review"
    }
  ) {
    task {
      id
      details
    }
  }
}

Go Client

ctx := context.Background()

details := "Upload IAM review output for Q1"
_, err := client.CreateTask(ctx, graphclient.CreateTaskInput{
	Title:   "Collect quarterly access review evidence",
	Details: &details,
})
if err != nil {
	return err
}

updatedDetails := "Evidence package moved to final review"
_, err = client.UpdateTask(ctx, "TSK01J9TASK11111111111111", graphclient.UpdateTaskInput{
	Details: &updatedDetails,
})
if err != nil {
	return err
}

CLI

openlane task create \
  --title "Collect quarterly access review evidence" \
  --details "Upload IAM review output for Q1" \
  --due 72h

openlane task update \
  --id "TSK01J9TASK11111111111111" \
  --details "Evidence package moved to final review"

FAQ

When should something be a task versus a workflow?

A task is a single piece of work with an owner and a deadline. Recurring collection from many people at once (quarterly attestations, annual vendor reviews) fits a recurring campaign, and changes that need review before they take effect fit a workflow.

Can I assign a task to a group?

Tasks are assigned to individual users for clear accountability, but you can use groups to control who can see and manage them.

Who can see a task?

By default, only the task's assignee and assigner can see it, along with organization owners and super admins, who can see everything in the organization. A task also inherits access from the objects it is linked to. Link a task to a program, and anyone who can view that program can view the task, and the same goes for a linked control, policy, risk, or asset. To share a task with someone outside those groups, link it to an object they can already see or give them or their group access directly.

Task templates work differently: everyone in your organization can see them, so anyone can create a task from one.

What fields does a task support?

The common ones are listed above; the complete list lives in the GraphQL object reference.

---

For programmatic access, see the Tasks GraphQL examples in the developer docs.