IT OPS
Role-Based Access Request with Manager Approval
Routes a new hire's requested app access through their manager for approval, then provisions only the approved apps and logs the decision for audit.
How it runs
The automated pipeline, trigger to output.
- TriggerAccess request webhook receivedHTTP webhook
- ActionSend manager interactive approvalSlack
- LogicSplit approved vs denied apps
- ActionGrant approved drive permissionsGoogle Drive
- ActionWrite access audit recordPostgres
- OutputConfirm granted access in SlackSlack
What it does
Adds an approval gate to onboarding access. Instead of granting everything automatically, it asks the hiring manager to confirm the access profile, provisions only what they approve, and keeps an audit trail of who approved what.
When to use it
Use this in regulated or security-conscious orgs where access must be explicitly authorized, not just inferred from a job title. It satisfies least-privilege and SOC 2 access-review requirements while staying fast.
How it works
- 1An incoming webhook from the onboarding system starts the run with the hire's proposed access profile.
- 2A Slack action sends the manager an interactive approval message listing each requested app and scope.
- 3A logic step waits for the response and splits approved versus denied items.
- 4For approved items, a Google Drive action grants the relevant shared-drive and folder permissions.
- 5A Postgres action writes an immutable audit row (requester, approver, apps, timestamp).
- 6A final Slack reply confirms granted access to the manager and the new hire.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Connect Google DriveDocs, sheets, slides, files.
- 4Connect PostgresAny Postgres URL — query, write, migrate.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Recurring Sensor Fault Root-Cause Investigator
On a schedule, an agent reviews recent Monday work orders and BigQuery telemetry to identify equipment with repeating faults, drafts a root-cause hypothesis with a recommended fix.
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Agentic Inactive-Seat Reclamation Review
An agent investigates each idle SaaS seat by correlating SSO login gaps with HR status and ticket history, classifies it as reclaim, hold, or escalate, and drafts a reasoned…
Reconcile SSO logins against expense spend to find unmanaged tools
Joins SSO usage data with expense/payment records in Snowflake to surface tools that are being used but not paid for, or paid for but never logged.
Approved-Seat Deprovision Execution
Fires when an IT approver confirms a seat for removal, then executes deprovisioning via the IdP API and logs the action to an audit table and a Linear cleanup ticket.
HVAC Anomaly Detection to Severity-Routed Work Orders
Ingests building HVAC telemetry via webhook, flags out-of-band temperature, pressure, or runtime readings.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.