Define authority before implementation
A workflow is not safe merely because it is technically possible. The project should identify the account owner, allowed action, recipient, frequency and conditions that require renewed approval.
Automation must stop at authentication challenges, CAPTCHA, MFA, paywalls and other boundaries instead of bypassing them.
Practical checklist
- Use an authorized regular-user or service account.
- Document the permitted operation and prohibited actions.
- Keep credentials outside source, screenshots and logs.
- Require human handling for challenges and final approvals.
Prevent uncertainty from becoming duplication
Networks time out and third-party interfaces change. If a send action returns an unclear result, an immediate retry may duplicate a payment, message or filing.
Idempotency keys, observed delivery references and durable job states let the worker decide whether to retry, wait or escalate.
Practical checklist
- Observe the current state before each change.
- Assign a stable idempotency key to every job.
- Separate retryable failures from ambiguous outcomes.
- Escalate unresolved delivery without repeating the action.
Operate recovery as part of the product
Production automation needs more than a script. Durable queues, isolated service identities, internal-only ports, health checks, backups and an external alert path make the workflow recoverable.
Logs should identify job, state and error category without copying sensitive message content, credentials or complete documents.
Practical checklist
- Test restart and machine-reboot recovery.
- Restore a backup before calling the backup plan complete.
- Monitor third-party selector and API changes.
- Keep a manual completion path for important work.
Common questions
Why are idempotency keys important?
They give repeated attempts the same identity so the system can avoid performing the same external action twice.
Should automation retry every failure?
No. A known transient failure may be retryable; an ambiguous send or changed interface should stop for observation or review.
Can browser automation bypass CAPTCHA?
It should not. CAPTCHA and MFA are boundaries that require authorized human handling or a supported provider integration.