Workflows

Route fixes through the right gates.

Risky fixes move through approvals, execution steps, and evidence in a governed workflow, never as an out-of-band change.

DAG-based execution
Approval gates
Retries and timeouts
Manual, cron, or webhook

ops0 is preventive cloud security. Workflows route risky infrastructure fixes through approval gates, execution steps, retries, and evidence, so nothing reaches production outside a governed, reviewed path.

ops0.ai/features/workflows
ops0 workflow run: a governed remediation for a critical database exposure, from finding to Terraform plan, human approval gate, apply in a maintenance window, and Slack notify, with a completed run showing 0 add, 2 change, 0 destroy, PR #842 approved, and an archived evidence bundle
Step types

Chain the steps a real fix needs.

IaC deploy

Plan and apply Terraform, OpenTofu, or Oxid changes as one step in the flow.

Config deploy

Push configuration changes to services and infrastructure outside a full IaC apply.

Script

Run a custom script for checks, migrations, or actions the other step types do not cover.

Webhook

Call an external system and continue once it responds, with secrets and retries built in.

Approval gate

Pause the run for human signoff before anything downstream is allowed to proceed.

Workflow: sg-ingress-remediationActive DAG
01Find
Done
02Fix
Done
03Approval
Pending
04Deploy
Waiting
05Evidence
Waiting
Trigger
Manual
Steps
5
Gate
Approval
DAG engine

The governed workflow.

DAG-based execution with dependencies between steps.
Triggers are manual, scheduled, cron, or webhook.
Steps chain IaC deploys, config deploys, scripts, and webhooks.
Approval gateAwaiting
Restrict ingress on sg-0af1b2c3d4e5f67890 before IaC apply
Step
Approval gate
Required signoffs
2
Expires in
18 hours
Platform ownerApproved
Security leadAwaiting
On approve
Deploy step runs
On reject
Workflow halts
Notify
Slack + email
Branching
Route by outcome
Approval gate

Human review inside the flow.

Approval gates pause the flow for signoff.
Branching and notifications route the right people.
Nothing applies to production before that approval.
Runs today
46
executed
Success rate
98%
30 days
Retries
3
this run
Timeout
10m
per step
iac_deploy: plan completeok
iac_deploy: apply startedrunning
http_webhook: retry 1/3 (timeout)retry
http_webhook: deliveredok
Reliability

Execution you can trust.

Retries and timeouts on every step.
A live execution stream while it runs.
Webhook secrets and mid-run cancellation are built in.
4
Trigger types
manual, scheduled, cron, webhook
Approval
Gates
built in
Retries
+ timeouts
on every step
Live
Execution stream
while it runs
Cancel
Any run
mid-execution

Common questions

ops0 workflows can automate infrastructure checks, operational tasks, approvals, deployment steps, remediation paths, and repeatable cloud operations.
RelatedGoverned DeploymentsConfigurationsIaC

Route the fix
through a governed gate.

Workflows execute the steps and hold for approval. Compliance keeps the evidence those approvals leave behind.

Explore Compliance