Define the authorized boundary
Every automation should state the account, target, allowed action and conditions that require a stop.
- Explicit task and identity scope
- Pre-action state validation
- Narrow permissions and protected credentials
- Human confirmation for important changes
Expect external systems to change
Web pages, APIs, provider responses and document formats are inputs that can drift.
- Resilient selectors and structured validation
- Timeouts, retries and clear error states
- Evidence that confirms the resulting state
- Safe abstention when confidence is low
Make operations recoverable
A production automation needs more than a successful demonstration.
- Useful logs without sensitive payloads
- Health checks and failure alerts
- Idempotent or reversible actions where practical
- Documented ownership and maintenance