AC-1: RBAC Posture
Check whether automation ownership and access boundaries are clear enough to support accountability.
AC-7: Connection Scope Minimization
Check whether automation connections appear limited to the access they actually need.
ARC-1: Modular Design
Encourage automation designs that are easier to maintain, review, and safely change.
ARC-3: Coupling Management
Highlight automations with broad external dependency footprints that may be harder to operate reliably.
ARC-6: Scenario Complexity
Highlight automations that have grown too complex for safe day-to-day maintenance.
ARC-7: Module Fit
Check whether automations rely on supported, appropriate modules and approved connector choices.
ARC-10: Dead Letter Queue
Encourage automations to preserve failed work for investigation and recovery instead of dropping it.
COST-2: Budget Thresholds
Encourage budgets and cost guardrails so automation usage does not drift without visibility.
DI-3: Data Integrity Checks
Check whether automations validate important data before sending it to business systems.
DI-4: Data Error Handling
Check whether automations handle data-related failures in a controlled, recoverable way.
DI-5: Schema Drift Detection
Highlight automations that may be vulnerable to schema or mapping changes.
MON-6: Alert Channels
Check whether important automation failures can notify the right people quickly.
MON-9: Observability Hooks
Encourage logging and observability so teams can troubleshoot issues and retain useful history.
SEC-1: OAuth Token Refresh
Highlight OAuth connections that may stop working because token maintenance is not in place.
SEC-2: Credential Rotation
Encourage regular credential rotation to reduce long-lived exposure.
SEC-3: Webhook Authentication
Check whether public inbound automation endpoints require authentication.
SEC-5: Hardcoded Secrets
Detect signs that secrets may be stored directly in automation configuration.
SEC-6: Secrets Pattern Detection
Identify additional signs that sensitive values may be exposed or stored unsafely.
SEC-7: Failure Containment
Highlight automations with recurring failure activity that may not be well contained.
SEC-9: Encryption in Transit
Check whether automation network traffic uses encrypted transport.
SEC-10: Input Sanitization
Check whether automations validate and sanitize untrusted input before acting on it.