The loop
Two properties of this loop matter more than any individual feature:- Every arrow is auditable. Each transition appends an event to an append-only audit trail, and the full lifecycle renders as an activity timeline on every incident in the dashboard.
- Failure escalates, it never loops. A failed verification triggers exactly one compensating action, and a rollback - whether it succeeds or fails - always leaves the incident escalated for a human. The system never retries indefinitely, never rolls back a rollback, and never silently resolves an incident it couldn’t fix.
Lifecycle states
Remediations and incidents move through first-class states - not free-form strings - so you can filter, alert, and reason about them precisely.Where to go next
Autonomy model
The four-level dial that decides what ChangeGuard may do on its own
Execution policy
The allowlist contract that bounds Auto mode - editable from the dashboard
Verification
How ChangeGuard proves a fix worked before claiming success
Compensating actions
Automatic rollback: pre-state capture, drift refusal, single attempt, escalation
Safety guarantees
The invariants that hold even when things crash mid-flight
RBAC boundaries
Why the control plane physically cannot exceed what you granted
Audit trail
The append-only record and the incident activity timeline