Standard planning flow

1. 1
   Choose type

   Select the exact domain or service.

2. 2
   Select targets

   Use collected, available resources.

3. 3
   Review plan

   Check every target payload, rollback, verification, and hash.

4. 4
   Choose route

   Direct, approval, or MOP only when policy offers it.

5. 5
   Follow evidence

   Track all targets until verified or stopped.

1. Select a network element.
2. Choose Capture Config if you have inventory permission.
3. Wait for the new append-only snapshot.
4. Select exactly two rows and choose Compare.
5. Review additions, removals, source, size, collector, and checksum.
6. Use Trace usage to find Change Requests, automation baselines, backups, or restores that reference the snapshot.

1. Choose concurrency from 1 to 8.
2. Select Run Manual Sync.
3. Open the run detail.
4. Review readiness, inventory, config, and errors for every NE.
5. Resolve incomplete targets individually.

Automatic backups

Select devices, choose New schedule from selection, then set Daily, Every N days, or Weekly, the local time, IANA timezone, source, and enabled or paused state. Editing or deleting a schedule never deletes its existing packages or audit history.

1. 1
   Create the draft.

   Select an approved template, target NE, and valid parameters. Review the frozen intent.

2. 2
   Run Pre-check.

   The platform captures fresh configuration, checks access and drift, and records current values for rollback.

3. 3
   Run Dry-run.

   Review the private-candidate diff. The candidate is discarded. An empty diff completes as a verified no-op.

4. 4
   Submit and approve.

   The approver reviews the exact hash and diff. Approval issues a one-use authorization with a limited lifetime.

5. 5
   Execute with another identity.

   The executor must differ from the approver. The worker reacquires evidence, matches the approved diff, commits, and runs post-check.

6. 6
   Close the lifecycle.

   Confirm verified or rolled back. Use a typed withdrawal for a standing resource. Resolve uncertain outcomes only with external evidence.

AI Assist and Provider configuration

After creation

1. Review the MOP detail and all target steps.
2. Collect the required signatures. The executor must differ from every applicable approver.
3. Select Proceed / Execute once. The MOP Worker dispatches native children in strict order.
4. Follow each child until verified. Any non-verified child stops later work.
5. Export Excel for operator review, Markdown when required, or HTML as execution evidence.
6. Use AI Review / Analysis only as advice. It cannot change frozen plans, hashes, approvals, or execution.
7. For a completed blueprint, create a new governed withdrawal or recovery MOP when removal is required.

Remove completed history from the operational list

1. A Platform Administrator selects one or more terminal runs, or chooses Clear completed history.
2. Review the warning and scope. Active workflows remain disabled and cannot be selected.
3. Enter an administrative reason of at least 8 characters.
4. Type the displayed phrase exactly: ARCHIVE N MOP RUNS for a selection or CLEAR TERMINAL MOP HISTORY for all terminal history.
5. Confirm once, then review the resulting audit event.

My account workflow

1. Open Users & Access from the sidebar or choose Profile & access from the account menu.
2. Review your duty group, effective permissions, and any explicit removals.
3. For a local platform account, update your display name or optional email and choose Save profile.
4. Choose Change password to update your password. Use at least 7 characters with uppercase, lowercase, and a non-space special character.
5. A password change signs out every session; a profile-only update keeps this session active.
6. Ask a Platform Administrator to change your username, group, account status, or permission overrides.

Group defaults workflow

1. Open Group defaults and choose Edit defaults for Read-only, Planner, or Reviewer & executor. Platform administrator is immutable.
2. Keep platform.read; it is mandatory.
3. Add or remove only the listed delegatable operational permissions.
4. Treat ai.configure as sensitive and default-off. It may be granted to a group or one user when required.
5. Do not look for terminal.admin here. Administrator SSH is available only as a special per-user permission.
6. Review the final set before saving. Saving writes an audit event and revokes active sessions for current group members.

Administrator workflow

1. Create the user with username, display name, optional email, duty group, and temporary password.
2. Set individual permissions to Inherit, Add, or Remove only when a clear business need exists.
3. Use terminal.admin only for a named user who needs audited Administrator SSH. It can never be a group default.
4. Review the Effective permissions summary before saving.
5. Tell the user that group, status, permission, password reset, or password change revokes existing sessions.
6. Review the audit event after every access change.