Automation patterns

Automation intent determines the credential, command, approval boundary, and meaning of success.

Open the PlantUML source

Pattern comparison

Pattern	Command	Credential	Mutation control
Pull-request validation	plan	Read-only for required repositories and settings	No apply step exists
Scheduled observation	audit	Read-only inventory access	Findings are reported; 0.3 still exits 0
Protected application	apply --yes	Minimum write permissions loaded only after approval	Trusted ref, reviewed policy, protected environment, controlled logs

Because the released package has no immutable plan artifact, a separate plan job cannot hand a cryptographically bound plan to a later apply job. Protected apply plans again in its own invocation and displays that plan before the external workflow approval or --yes execution boundary is considered.

Copy the supported workflows from the CI/CD automation guide.