Governance

Governance annex

This sets out exactly what our automation is allowed to do inside your monitoring runtime without asking you first, what it must ask you before doing, and what it will never do on its own. You accept this when you start analysis in the wizard, and it is the same document referenced in any commercial amendment.

Default deny

If an action is not explicitly listed below as allowed, our automation cannot perform it. There is no room for automation to improvise outside this list.

What automation can do without asking you

• Re-run a scheduled job

  Up to twice a day, and only for jobs with no financial effect.

• Clear the CDN cache

  Static assets only.

• Reassert monitoring

  Re-applies our health checks and injected snippets if a deploy removes them.

• Open an incident and page on-call

  When a monitor detects a problem.

What needs your approval each time

• Restart an application function

  For example, a serverless or edge function that has become stuck or unhealthy.

• Rotate a secret or credential

  Issuing a new value and retiring the old one.

• Block a range of IP addresses

  At the edge or CDN layer, in response to detected abuse.

• Change your database plan or tier

  Upgrading or downgrading compute or storage capacity.

What automation will never do

• Change your database schema
• Modify or delete your data
• Refund a payment
• Re-enable automation after an emergency stop -- only a human can do that

Audit and review

Every action automation takes is written to a tamper-evident record, the same hash-chained evidence log used across RunAssured, so it can be checked later. This annex itself is reviewed at least every 90 days.

How this applies to your workload

This annex is the same for every workload we operate. Accepting it in the wizard records the version you accepted against your workload’s operating contract, so there is always a clear answer to which rules applied at any point in time.