IT OPS
Newly Authorized High-Risk App to PagerDuty Alert
Detects when an employee newly grants a previously-unseen app a high-risk scope and immediately pages the on-call security engineer through PagerDuty for same-day review.
How it runs
The automated pipeline, trigger to output.
- TriggerFrequent schedule fires
- ActionFetch grants created since last checkpointCustom MCP server
- LogicKeep new apps with high-risk scope only
- ActionOpen PagerDuty incident per qualifying appPagerDuty
- OutputAdvance checkpoint timestampCustom MCP server
What it does
Watches for the most urgent signal in OAuth governance: a brand-new app appearing with dangerous permissions. Instead of waiting for the next batch review, it pages on-call so a human can look within minutes.
When to use it
Use it for tenants where a single malicious or compromised OAuth grant is a real breach risk. This is the real-time tripwire layered on top of your slower daily inventory and review queues.
How it works
- 1A schedule trigger runs a tight loop (for example every 15 minutes).
- 2A custom-MCP call fetches grants created since the last checkpoint.
- 3A logic step keeps only apps that are both newly authorized and carry a high-risk scope, dropping known and previously-approved apps.
- 4For each qualifying app a PagerDuty action opens an incident tagged with the app name, scopes, and the authorizing user.
- 5The output advances the checkpoint timestamp so the next run only sees newer grants.
Set it up
What you configure once, before turning it on.
- 1Connect Custom MCP serverConnect any MCP-compatible tool you own.
- 2Connect PagerDutyIncidents, on-call, escalations.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Indoor Air Quality Breach to Tenant Notice and Work Order
Listens for CO2, VOC, or humidity sensor alerts via webhook, and when a zone exceeds occupant-safety limits it emails affected tenants, opens a Monday remediation task.
Self-Service Reclaim Email for Idle Users
Detects users idle in a SaaS app past the threshold and emails each one a keep-or-release link; unanswered seats after the deadline are auto-flagged for removal.
Outlook Room Conflict Resolver with Approval Gate in Teams
When an Outlook room clashes, proposes a rebooking and asks the bumped meeting's organizer to approve the move in Microsoft Teams before any change is made.
Outlook Room Double-Booking Resolver with Auto-Rebook
Detects when two meetings claim the same Outlook room resource and automatically relocates the lower-priority meeting to a comparable free room.
Monthly Wasted-License Cost Report
Aggregates inactive-seat data across all tracked SaaS apps each month, computes total reclaimable spend, and delivers a ranked cost report to leadership in Notion and Slack.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.