Workflows · DevOps

DevOps: Workflows

The observe, detect, diagnose, act loop, where automated remediation is allowed to close it, and the handoffs with Engineering, Security, Finance and Support.

Markdown. No sign-up, no email.

Two loops run here. A fast one that mostly closes without a person, and a slow one that must not.

What arrives#

FromWhatBecomes
Every systemMetrics, logs, tracesThe baseline, and departures from it
EngineeringDeploys and configuration changesThe correlation set for root cause
SecurityThreat and posture findingsWork, never automated remediation
FinanceBudgetThe ceiling on automated scaling
SupportCustomer reportsAn incident, and a detection gap to explain

A customer report is always also a detection failure. Fix the fault, then ask why monitoring did not see it first. That second question is what moves the self-detection rate.

What leaves#

ToWhat
EngineeringRoot-cause candidates with evidence, and the change most likely responsible
SecurityAnomalies with a security shape, immediately
FinanceCost per unit of load, unused resources, projected spend
The businessIncident communications, from a person
Knowledge ManagementPostmortems and what would have detected it sooner

The two loops#

The fast loop and the slow loop Observe: Telemetry () → Deviation from normal (). Fast loop: On the allowlist? () → Act, rate limited () → Log and verify (). Slow loop: Alert a person () → Root cause candidates () → Human decides () → Postmortem (). Observe Telemetry Deviation from normal Fast loop On the allowlist? Act, rate limited Log and verify Slow loop Alert a person Root cause candidates Human decides Postmortem
The fast loop closes without a person, but only for actions on the allowlist. Everything else joins the slow loop, where a human decides before anything changes.

The fast loop is deliberately narrow. Widening it is a quarterly decision with four tests to pass, never a convenience taken during an incident.

Handoff contracts#

With Engineering. They own the change; operations owns the environment. The root-cause agent hands over candidates with evidence rather than a verdict, because a confident wrong cause sends a team down a two-hour path.

With Security. Security findings are never automatically remediated. Changing a firewall rule or an access policy in response to an anomaly is exactly how an attacker gets a system to lock out its own operators.

With Finance. They set the scaling ceiling; operations may scale freely beneath it and never above it. Automated spending without a ceiling is the single most expensive thing an agent can be given.

To Support. Support hears about degradation from operations, not from the customer who is already typing.

Cadence#

ContinuousObservation, allowlisted remediation
DailyOvernight anomalies, automated actions and whether each held
WeeklyAlert hygiene, repeat incidents
MonthlyCapacity projections, cost review, 90-day expiry list
QuarterlyAllowlist review, incident trend analysis

The failure this design is built against#

An environment covered in dashboards where the first person to notice a problem is still a customer, and an automation layer that quietly restarts a failing service for a fortnight while the fault that causes it is never examined.

Both look healthy on a status page. The self-detection rate catches the first, and the stop-after-two rule catches the second.

Back to DevOps

Get new material when it is published

Everything here is free and stays free. There is no form in front of any document. If you want to know when new guides and templates go up, leave an email.

Roughly monthly. Unsubscribe in one click. We do not share your address, and we will not call you.