Automation
Some classes of violations can be remediated safely and consistently via automation. Compliance Engine supports several patterns for automated response.
When to Automate
Automation is a good fit when:
- The fix is well understood and repeatable (for example, enabling an encryption flag, enforcing a tag).
- The blast radius is limited and reversible.
- You have clear ownership and approvals for running automated changes.
High‑risk changes (for example, deleting resources) are usually better handled via tickets and manual review.
Automation Patterns
Common patterns include:
- Webhooks or APIs that trigger remediation tools (for example, infrastructure pipelines, configuration management, or cloud‑native automation).
- Runbooks that are partially automated but still require human approval or oversight.
- Bulk operations where many similar findings are addressed via a coordinated change.
Compliance Engine provides the structured data and events; your automation platform performs the changes.
Guardrails
When designing automations:
- Start with non‑production environments and low‑risk controls.
- Implement approvals and change windows where appropriate.
- Instrument automations so you can see success, failure, and drift over time.
Automations should be reviewed periodically, just like policies, to ensure they still reflect your current standards and risk tolerance.