Workflows
Procedures where Deixic fixes the failing control.
Each workflow names the request, the policy class, the approver, the change, the read-back, and the receipt attached to the control. Low-risk changes run within written policy, sensitive changes wait for a named approver who gives a reason, and out-of-authority actions go to your company as a decision. Execution requires a configured connection that supports the action. Systems named on these pages are examples; the connector catalog lists the rest.
Access and devices
Revoke a departed employee’s access, then read it back.
Close CC6.2: disable employee@example.com and revoke access in Google Workspace, GitHub, and AWS
View workflow →Privileged-access grantsGrant production admin for two hours, then let it lapse.
Grant production-admin to engineer@example.com for two hours
View workflow →Access reviewsRemove admin roles nobody uses, then read the role list back.
Delete the AWS administrator role legacy-deploy, unused for 180 days
View workflow →MFA enforcementTurn on MFA for the GitHub organization after the approver reads the list.
Require two-factor authentication for the acme GitHub organization
View workflow →Credential rotationThe payments owner checks dependencies before credential rotation.
Rotate the production payments API credential
View workflow →Device compliancePush disk encryption to every managed laptop and read each one back.
Push the disk-encryption profile to every managed laptop
View workflow →Customer-data access and exportPut a named data owner in front of a customer export.
Export records from customer-data/accounts
View workflow →Change management
Hold a production change for a named approver.
Apply a Terraform plan to production/networking
View workflow →Production deploymentsHold a production deployment until its owner reviews the release.
Deploy the current release candidate to production
View workflow →Database schema migrationsMigration 0421 waits for the database owner before it runs in production.
Apply migration 0421 to the production orders database
View workflow →Feature-flag rolloutsCheckout_v3 waits for its service owner before a full rollout.
Enable checkout_v3 for 100% of production traffic
View workflow →DNS changesA DNS record change stops before production traffic moves.
Change api.example.com from 203.0.113.10 to 203.0.113.24
View workflow →Production rollbacksThe service owner confirms both releases before rollback.
Roll the checkout service back from release 2026.08.28 to 2026.08.27
View workflow →Backup restoresA production restore waits on the database owner.
Restore backup orders-2026-08-28-0200 into production/orders
View workflow →Monitoring and response
Workload isolation stops for the Security operations owner.
Remove production access from workload checkout-worker-17
View workflow →Audit loggingTurn on log file validation and read the trail back.
Enable log file validation and multi-region coverage on the organization trail
View workflow →Other approved actions
Actions outside SOC 2 controls, held for the same named approver and kept with the same receipt.
Review a high-value refund before money moves.
Issue a $12,000 refund against order 8472
View workflow →External communicationsRequire approval before an agent sends an external message.
Send a service notice to the customer operations channel
View workflow →Production-data correctionsThe approval for order 8472 shows the current and proposed values.
Change order 8472 from duplicate to payable
View workflow →Customer-account deletionCustomer deletion waits for retention review and the Privacy owner.
Delete account cust_4821 and its retained application data
View workflow →Bulk customer importsRevenue operations reviews the mapping for an 8,421-record import.
Import 8,421 customer records into the production CRM
View workflow →Vendor paymentsA $38,500 invoice waits for the Controller.
Pay invoice INV-2408 for $38,500 to vendor_2041
View workflow →Subscription entitlementsEnterprise access waits for the signed order and Deal desk.
Grant Enterprise entitlements to customer account cust_7184
View workflow →Campaign publishingA 14,280-recipient campaign waits for its audience review.
Publish the renewal campaign to 14,280 customer contacts
View workflow →