AI AGENTS
SOC2 Change-Management Drift Detector
Whenever a GitHub repository's branch-protection or required-review settings change, it captures the before/after, evaluates it against your change-management policy.
How it runs
The automated pipeline, trigger to output.
- TriggerGitHub branch-protection change webhookGitHub
- ActionRead new config and prior baselineGitHub
- LogicClassify change vs. change-management policy
- ActionWrite change record to evidence registerAirtable
- OutputPage on-call if a guardrail weakenedPagerDuty
What it does
Monitors the integrity of your SOC2 change-management controls (CC8.1) in real time. If someone disables required pull-request reviews, drops required status checks, or removes branch protection on a protected repo, this flow catches it immediately rather than at audit time.
When to use it
Use it on every repository that ships production code. It is the difference between proving "all changes were peer-reviewed" and discovering a six-month gap where protections were quietly turned off.
How it works
- 1A GitHub webhook fires on repository or branch-protection rule changes.
- 2The flow reads the new protection configuration and the prior known-good baseline.
- 3A logic step classifies the change as compliant, a benign tightening, or a weakening of a required guardrail.
- 4Every change, regardless of severity, is written to Airtable as a dated change-management evidence record.
- 5If a guardrail was weakened, it escalates a PagerDuty incident to the security on-call with the diff.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect AirtableBases, tables, views, automations.
- 3Connect PagerDutyIncidents, on-call, escalations.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Weekly On-Call Doc-Gap Digest
Each week the agent reviews every Sentry issue resolved in the last 7 days, ranks the ones whose runbook coverage is missing or thin.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.