BrettFullmer: Merged into the 5-phase Playbook restructure — redirect to Risk

2026-09-01T18:07:33Z

Merged into the 5-phase Playbook restructure — redirect to Risk

← Older revision		Revision as of 18:07, 1 September 2026
Line 1:		Line 1:
	~~Part of~~ [[~~The Playbook]]. This is the chapter that comes straight out of building [[MAC]] and running the [[Spacelift]] practice labs, not out of a CS textbook.~~		#REDIRECT [[Risk]]

	The whole design of the Spacelift setup rests on one rule: plan and apply are structurally separate, and nothing touches production without a human confirming. The automation API key is scoped read-only by design — it hard-fails on anything that tries to trigger a deploy. Read access for tooling, write access for a human, on two separate credentials. That's not a slogan, it's an enforced boundary.

	~~Apply the same boundary to the customer relationship, and you get the Confirm Gate.~~

	~~==Two tiers of access, not one==~~

	'''Detect and draft — automated, no gate.''' An AI agent can watch usage data, flag a [[Observability (Customer Health Scoring)\|health score]] crossing a threshold, pull the account history into a briefing, and draft a first-pass outreach email or QBR deck. None of that touches the customer. Let it run wide open.

	'''Send and commit — human, every time.''' Nothing customer-facing goes out — no email, no Slack message to a champion, no committed date, no pricing statement — without a human reading it and hitting send. This is the equivalent of the mandatory apply confirmation: automation gets you to the edge of the action, a person decides whether to take it.

	~~==Why the line sits exactly there==~~

	A bad Terraform apply is usually recoverable — you have state, you have version history, you can roll back. A bad customer email is not recoverable in the same way; it's read, it's judged, and the relationship absorbs it whether or not you catch the mistake five minutes later. The asymmetry in blast radius is the whole argument for where the gate goes. It's also why "AI is going to replace your job" is the wrong fear: automation removed the boring 60% of the work — the digging through account history, the first-draft QBR deck, the "let me check the ticket volume" busywork — and left the judgment-heavy 40% exactly where it belongs.

	~~==What this looks like in the Play Library==~~

	Every play in [[The Play Library]] should mark each step as either automated (detect/draft) or gated (send/commit). A play that's silent on this ends up either fully manual — slow, doesn't scale — or fully automated — fast, and one bad customer-facing message away from a real problem.

	~~==The tell that a team got this wrong==~~

	If an AI agent is sending customer-facing messages without a human in the loop "because it's usually fine," that's not efficiency, that's an unscoped write credential on a production system. The fix is the same fix as the Spacelift automation key: split the access, not the trust.

	~~[[Category:AI Agents]]~~
	~~[[Category:Customer Success Manager]]~~
	~~[[Category:Technical Account Manager~~]]

BrettFullmer: Publish The Confirm Gate page

2026-09-01T17:01:40Z

Publish The Confirm Gate page

New page

Part of [[The Playbook]]. This is the chapter that comes straight out of building [[MAC]] and running the [[Spacelift]] practice labs, not out of a CS textbook.

The whole design of the Spacelift setup rests on one rule: plan and apply are structurally separate, and nothing touches production without a human confirming. The automation API key is scoped read-only by design — it hard-fails on anything that tries to trigger a deploy. Read access for tooling, write access for a human, on two separate credentials. That's not a slogan, it's an enforced boundary.

Apply the same boundary to the customer relationship, and you get the Confirm Gate.

==Two tiers of access, not one==

'''Detect and draft — automated, no gate.''' An AI agent can watch usage data, flag a [[Observability (Customer Health Scoring)|health score]] crossing a threshold, pull the account history into a briefing, and draft a first-pass outreach email or QBR deck. None of that touches the customer. Let it run wide open.

'''Send and commit — human, every time.''' Nothing customer-facing goes out — no email, no Slack message to a champion, no committed date, no pricing statement — without a human reading it and hitting send. This is the equivalent of the mandatory apply confirmation: automation gets you to the edge of the action, a person decides whether to take it.

==Why the line sits exactly there==

A bad Terraform apply is usually recoverable — you have state, you have version history, you can roll back. A bad customer email is not recoverable in the same way; it's read, it's judged, and the relationship absorbs it whether or not you catch the mistake five minutes later. The asymmetry in blast radius is the whole argument for where the gate goes. It's also why "AI is going to replace your job" is the wrong fear: automation removed the boring 60% of the work — the digging through account history, the first-draft QBR deck, the "let me check the ticket volume" busywork — and left the judgment-heavy 40% exactly where it belongs.

==What this looks like in the Play Library==

Every play in [[The Play Library]] should mark each step as either automated (detect/draft) or gated (send/commit). A play that's silent on this ends up either fully manual — slow, doesn't scale — or fully automated — fast, and one bad customer-facing message away from a real problem.

==The tell that a team got this wrong==

If an AI agent is sending customer-facing messages without a human in the loop "because it's usually fine," that's not efficiency, that's an unscoped write credential on a production system. The fix is the same fix as the Spacelift automation key: split the access, not the trust.

[[Category:AI Agents]]
[[Category:Customer Success Manager]]
[[Category:Technical Account Manager]]

The Confirm Gate - Revision history

BrettFullmer: Merged into the 5-phase Playbook restructure — redirect to Risk

BrettFullmer: Publish The Confirm Gate page