GUIDES · RESPOND
Gated containment with approval queues.
Autonomy is a dial, not a switch. An approval gate lets a playbook act instantly where the blast radius is small and wait for a human where it isn’t — without anyone hand-running a console at 3am.
Add an approval gate
A gate pauses an action for sign-off. Give every gate a timeout and a fallback so a sleeping approver never strands a case in limbo.
YAMLin a playbook step - id: contain action: identity.disable gate: requires_approval: true approvers: [soc-oncall] timeout: 10m on_timeout: notify-only # never act past the timeout
The approval queue
Gated actions land in a queue the on-call works from — each entry carries the case, the proposed action, and its inverse, so the approver decides with full context in one click.
| Field | Why it's there |
|---|---|
| Proposed action | Exactly what will run, on which entity. |
| Inverse | How it gets undone — shown up front so approval is reversible. |
| SLA timer | Time left before on_timeout fires. |
When no one answers
The on_timeout path is the whole point of the gate. notify-only escalates without acting; proceed acts anyway for low-risk actions; page wakes the next tier. Choose per action, by blast radius.
Gate by risk tier, not by reflex. Disabling a sandbox token can be autonomous; disabling a domain admin should always gate. Tie
requires_approval to the target’s asset tier and you get speed where it’s safe and a human where it counts.Where to go next
- SOAR playbook authoring — where gates live in the graph.
- Response engine — the reversible action model.