Automation
The Action Engine turns savings opportunities into controlled remediations with approval, guardrails, rollback support and receipt evidence.
User submits an action request from Today, Savings, or a supporting finding view.
Conflict detection validates policy, freeze windows and IaC ownership.
Role-based approval confirms execution authority.
Provider adapter executes the canonical action type.
Result metadata, provider response and evidence are recorded for the receipt trail.
Savings verification runs against post-action cost windows.
Rollback can run when the action type supports it.
suggest
Dry-run and planning mode with no cloud mutation.
safe
Guarded request mode; execution remains approval-gated while automation safety is frozen.
manual_approval
Default mode; execution requires approval.
auto
Disabled until preflight, approval, audit, idempotency and rollback evidence are verified.
Every state-changing action must leave an audit log entry and feed receipt verification. Rollback is handled as another audited action, not as an invisible undo.
Connect one AWS, Azure or GCP scope, approve the safest savings actions, and give finance a receipt when the savings verify.
