Platform / Layer 3

Layer 3

Automatic response is easy to sell and hard to trust. So everything goes through one gate.

The reason teams leave automation switched off is not that it doesn't work. It is that when it does something at 3am, nobody can reconstruct why — and the second time it isolates a payroll server during month-end close, it gets disabled for good.

The argument

Every action that changes your world — isolating a host, killing a session, blocking an address, quarantining a file — crosses exactly one gate, and the gate is a chain of independent guards. Each guard answers on its own terms: is this host too important to isolate unattended, is this action reversible, has the requester the standing to ask, is the blast radius known.

The chain does not vote. A single hold is a hold. Three guards passing and one stopping is not mostly fine — it is stopped, and the guard that stopped it is the sentence you repeat in the review afterward. That is what makes automation something a team will leave switched on.

Put an action through the gate

authored example, not live data

Pick an action and watch the guards answer. Note that two of these can never be released by anyone — a refusal is not a stronger hold.

PASS Standing

The requester holds the authority to contain a machine in this tier.

PASS Reversibility

Isolation can be lifted without data loss, so this guard does not object.

HOLD Importance

web-07 serves production traffic. Machines in this tier are never isolated unattended — a named person must release it.

PASS Blast radius

Two dependent services are mapped and both tolerate the loss of this host.

Held for a person

Held — one guard is enough

Three guards passed and one held. The chain does not vote, so this action is stopped until a named human releases it. In the worked incident this took four minutes, and the sentence "importance held it" is what the review reads.

The honest limits

An allow is permission to begin, not to finish

Allowed actions go to one machine first, then a check, then the rest. A failed check rolls back without asking anyone — which means a green verdict is not a promise the action succeeded.

Not everything can be undone

Isolating a host is reversible. A killed session is not resumable, and a deleted file may be gone. Guards weigh reversibility, and irreversible actions are held more often by design.

"Affects nothing" usually means we could not tell

A blast radius of zero is the dangerous reading. Where a machine's owner and dependencies are unmapped, the number is unknown rather than small, and the board says so.

A refusal has no appeal button

Looking for one is the commonest mistake made on this board. Changing a refusal means changing the policy that produced it, deliberately, somewhere else.

What this layer deliberately does not do

It does not decide what is suspicious — that judgement is made a floor below, and arrives here as a proposal with its reasoning attached. Keeping the two apart is what lets you audit a decision independently of the thing that acted on it.

It also has no quiet path. There is no way to run an action that skips the gate, including for us, including in an emergency. An emergency stop exists, and it halts the whole automation plane rather than waving one action through.

Words this page introduced

Full glossary →

The gate — the one place every world-changing action must pass, and the one place to ask why one happened.

Guard — one independent check with one concern. Guards do not negotiate with each other.

Hold — stopped, waiting for a named person to release it.

Refusal — already decided. No approver can release it and no button exists that would.

Canary — trying an action on one machine and verifying before the rest.

This layer's capabilities

All 88 →

The approval gate

included

Containment and isolation