Workflow overlay

Webex Sensitive System Change Governance

Govern privileged system changes proposed through Webex agents before production, infrastructure, or security-affecting execution is allowed.

Key
webex_sensitive_system_change
Version
webex_sensitive_system_change-v1
Rules
2
Domain
WEBEX_SENSITIVE_SYSTEM_CHANGE

Rules, in the order the evaluator tries them

Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.

  1. Evidence completeness gate

    priority 120

    evidence-required · WEBEX_SENSITIVE_SYSTEM_CHANGE

    When
    • evidence.attachments < 1
    Then

    REQUEST_INFO → REVIEW · elevated · SLA 45 min

    Do not finalize high-consequence decisions without evidence.

  2. Owner and escalation accountability

    priority 100

    owner-accountability · WEBEX_SENSITIVE_SYSTEM_CHANGE

    When
    • intake.owner exists
    Then

    REQUIRE_REVIEW → REVIEW · routine · SLA 60 min

    Every routed decision must have a named accountable owner.

Evaluate under it

Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.

decionis_evaluate arguments

{ "policy_pack": "webex_sensitive_system_change", "payload": { "action": "<decision type>" } }

In a hosted evaluate-decision request

"vertical_pack": "webex_sensitive_system_change",
"policy_version": "webex_sensitive_system_change-v1",
"require_exact_policy_version": true

Workflow keys that resolve to this pack: webex_sensitive_system_change.

What its rules read

Every fact below comes from the request's context.

  • evidence.attachments
  • intake.owner

Signals it maps

  • decision_cycle_countwebex_agentic_sensitive_system_change
  • escalation_ratiowebex_agentic_sensitive_system_change
  • evidence_completeness_ratewebex_agentic_sensitive_system_change