Decision recipes other teams already run.

SOC 2 CC8.1ISO 27001 A.8.34Checkout evidence trail

shopify~5 min

Shopify Margin Floor Guard

Never discount below margin. Holds the checkout before the payment token is issued when the cart would breach the floor.

SOC 2 CC8.1ISO 27001 A.8.34Fulfillment evidence trail

shopify~5 min

Shopify Oversell Prevention

Blocks fulfilling an order for stock oversold across channels — before the fulfillment token is issued.

HIPAA §164.312(a)SOC 2 CC6.2ISO 27001 A.5.18

servicenow~6 min

HIPAA-Grade Access Change Gate

Privileged-access and production-change controls for ServiceNow ITSM — proving every change followed the approved path.

SOC 2 CC6.2ISO 27001 A.5.18Access review evidence

servicenow~6 min

ServiceNow Just-In-Time Access

Temporary admin rights get a timed dossier and a revocation trail — so the grant expires whether or not anyone remembers.

SOC 2 CC6.1ISO 27001 A.5.19Procurement evidence

servicenow~6 min

ServiceNow Software Procurement Gate

Blocks unapproved OAuth grants and SaaS signups before anyone clicks through the terms.

Auditable enforcement trailAppeal-ready evidence

reddit~4 min

Reddit Moderation Safety Baseline

Toxicity, account-age, and brigading controls for automated moderation — with a signed reason for every removal.

SOC 2 CC8.1ISO 27001 A.8.32Change evidence

Claude Code Destructive-Shell Gate

Never let an agent run `rm -rf`, a force-drop, or a disk-level command without a human approval on the tool call.

SOC 2 CC6.1ISO 27001 A.8.24Secret-handling evidence

Claude Code Secrets & Credentials Guard

Stops an agent reading, printing, or committing credential files, and escalates any command that would rotate a secret.

SOC 2 CC8.1ISO 27001 A.8.32Change evidence

Claude Code Migration & Infra Gate

Holds agent-authored database migrations and `terraform apply` runs until a human signs the blast radius.

SOC 2 CC8.1ISO 27001 A.8.32Source-control evidence

Cursor Protected-Branch Guard

Never force-push to a protected branch, never rewrite shared history — the agent has to open a PR instead.

SOC 2 CC7.1ISO 27001 A.8.9Supply-chain evidence

Cursor Dependency-Install Whitelist

Blocks an agent installing a package from an unapproved registry or adding a dependency with no lockfile entry.

SOC 2 CC8.1ISO 27001 A.8.32Agent action evidence

Codex Blast-Radius Gate

Scores every Codex tool call by blast radius and escalates anything that could touch production before it runs.

SOC 2 CC7.2ISO 27001 A.8.9Client assurance

Copilot Agent Tool Whitelist

Only the tools you approved fire. Everything else is denied at the pre-tool boundary with a reason the agent can read.

SOC 2 CC7.2ISO 27001 A.8.9Spend evidence

Copilot Token-Budget Guard

Reserves projected model spend before the prompt is forwarded and restrains runs that would blow the project wallet.

SOC 2 CC8.1ISO 27001 A.8.32Change evidence

GitHub Deploy Approval Gate

Blocks production deploys during a freeze, escalates out-of-hours releases, and stamps the verdict on the PR.

SOC 2 CC8.1ISO 27001 A.8.32Source-control evidence

GitHub Branch-Protection Gate

Require review before a force push. Blocks history rewrites on protected branches and escalates protection-setting changes.

SOC 2 CC8.1ISO 27001 A.8.9Agent action evidence

GitHub AI-Authored Change Restraint

An agent can author the change; a human still has to sign the deploy. Restrains AI-authored diffs that touch deploy, infra, or migration paths.

SOC 2 CC7.2ISO 27001 A.8.9Payout evidence trail

LangChain Money-Moving Tool Gate

Wrap `send_refund`, `issue_payout`, or any tool that moves money — the inner tool only fires on an approve verdict.

SOC 2 CC7.2ISO 27001 A.8.9Agent action evidence

LangGraph Plan → Execute Gate

Drop a gate node between plan and execute so the graph's conditional edge branches on the verdict instead of a guess.

HIPAA §164.312(a)SOC 2 CC6.1ISO 27001 A.5.34

LangChain Regulated-Data RAG Gate

Gates retrieval and external API calls that touch regulated records — restricted subjects never leave the boundary.

SOC 2 CC8.1ISO 27001 A.8.32Decision evidence

Universal Action Gate Baseline

The starting policy for any point of execution: risk band, hard rules, and a signed dossier on every verdict.

SOC 2 CC6.1ISO 27001 A.8.20Integration evidence

Webhook Execution Receipt

Gate an inbound webhook before it mutates state — replay protection, signature checks, and a dossier per delivery.

SOC 2 CC6.1ISO 27001 A.8.20Cloud spend evidence

AWS Agent Egress & Spend Gate

Opens sandbox egress only for the exact target the grant covers, and stops a run that would blow the account budget.

SOC 2 CC7.2ISO 27001 A.8.9Agent action evidence

~7 min

Vertex AI Tool-Execution Gate

Gates the extension call a Vertex AI model wants to make, so an out-of-scope or unapproved tool never executes.

SOC 2 CC8.1ISO 27001 A.5.15Spend approval evidence

Zapier Spend-Approval Gate ($500+)

Require a named approver before any Zap releases spend over $500 — the approval becomes a signed verdict, not a thumbs-up.

SOC 2 CC6.1ISO 27001 A.5.19Vendor verification evidence

Zapier Unknown-Domain Invoice Block

Blocks an invoice or payment instruction from a domain that is not on the verified-vendor list before the Zap pays it.

SOC 2 CC8.1ISO 27001 A.8.34Refund evidence trail

Zapier Refund-Within-Policy Gate

Lets the Zap issue refunds that sit inside policy and holds the rest — with the reason code attached to the record.

SOC 2 CC7.2ISO 27001 A.5.7Risk decision evidence

Zapier Risk-Score Change Pause

Pauses a Zap the moment a customer's risk score crosses the line, instead of letting the automation keep firing.

SOC 2 CC8.1ISO 27001 A.5.15Scenario evidence

Make Scenario Execution Gate

Evaluate any Make scenario before its protected module runs, using the HTTP V4 request recipe and the bearer key in Make's keychain.

SOC 2 CC8.1ISO 27001 A.8.32Workflow evidence

~7 min

n8n HTTP-Node Execution Gate

Call the evaluate endpoint from an HTTP Request node and branch the workflow on the verdict before the write step runs.

SOC 2 CC8.1ISO 27001 A.5.15Revenue recognition evidence

Salesforce Opportunity-Stage Guard

Never let an automation or agent move an opportunity above $1M into Closed Won without the approval chain.

SOC 2 CC8.1ISO 27001 A.5.15Pricing exception evidence

Salesforce Discount Approval Gate

Escalates quote discounts past the encoded band when the contract-value evidence is missing.

SOC 2 CC6.1ISO 27001 A.5.34Regulated action evidence

Salesforce Regulated-Account Action Gate

Holds account changes on regulated or restricted customers until the right reviewer signs the record.

SOC 2 CC8.1ISO 27001 A.8.34Refund evidence trail

Slack Refund-Approval Dossier

Turns the refund approval that happens in a Slack thread into a signed verdict carrying the policy version and reviewer authority.

SOC 2 CC8.1ISO 27001 A.5.15Spend approval evidence

Slack Discretionary-Spend Gate

Every spend approval ping above $5k carries the policy snapshot, the requester's authority, and a public verify URL.

SOC 2 CC8.1ISO 27001 A.5.19SOX payment controls

SAP Vendor Payment Release Gate

Holds a vendor payment run until the bank details, sanctions evidence, and dual approval all check out.

SOC 2 CC6.1ISO 27001 A.5.19Procurement evidence

SAP Procurement PO Release Gate

Stops a purchase order releasing to an unapproved supplier or past the requester's authority limit.

SOC 2 CC1.4ISO 27001 A.6.1SOX payroll controls

Workday Payroll Circuit Breaker

Catches an out-of-band payroll run — a bank-detail change, an off-cycle payment, a headcount jump — before the money leaves.

SOC 2 CC6.2ISO 27001 A.6.5Access review evidence

~7 min

Workday Offboarding Access Guard

When a termination event lands, prove access and payroll were actually revoked — not just ticketed.

SOC 2 CC8.1ISO 27001 A.8.34Checkout evidence trail

WooCommerce Margin Floor Guard

Never discount below margin. Holds a WooCommerce checkout whose net margin would breach the encoded floor.

SOC 2 CC8.1ISO 27001 A.8.34Pricing change evidence

Adobe Commerce Price-Drift Circuit Breaker

Catches a pricing feed or AI engine publishing a price far off the last-known-good value before shoppers see it.

SOC 2 CC8.1ISO 27001 A.8.34Listing evidence trail

eBay Listing Margin Gate

Folds eBay final-value fees and promoted-listing rates into the margin check before a listing or price change goes live.

SOC 2 CC8.1ISO 27001 A.8.34Fulfillment evidence trail

Amazon Oversell & Fee Gate

Blocks fulfilling an order for stock oversold across channels, and checks referral plus fulfillment fees against the margin floor.

SOC 2 CC8.1ISO 27001 A.8.34Order acknowledgement evidence

Walmart Referral-Fee Margin Gate

Folds the Walmart Marketplace referral fee into the margin gate before an order is acknowledged.

SOC 2 CC8.1ISO 27001 A.8.34Fulfillment evidence trail

TikTok Shop Fulfillment Circuit Breaker

Stops a viral-spike order releasing on stock you do not have, or on a creator-commission stack that breaks margin.

SOC 2 CC8.1ISO 27001 A.8.34Checkout evidence trail

Commerce & Retail Ops Pack

Over-selling, margin-floor, and coupon-stacking gates for orders and fulfillment — the three that leak the most money.

SOC 2 CC8.1ISO 27001 A.8.34AML evidence trail

Fintech Starter Pack

Velocity, sanctions, and treasury movement controls — automated proof of every KYC, AML, payout, and limit decision.

SOC 2 CC6.1ISO 27001 A.5.15Change evidence

SaaS Ops Pack

Cloud spend, discount, and entitlement gates — stop runaway burn, margin leakage, and unsupported entitlement changes.

SOC 2 CC6.2ISO 27001 A.5.18Access review evidence

servicenow~5 min

IT Ops Pack

Access, change, and procurement gates for internal automation — prove every sensitive change followed the approved path.

SOC 2 CC1.4ISO 27001 A.6.1Hiring decision evidence

HR & People Ops Pack

Fairness, approval-chain, and offboarding gates — prove every hire, promotion, and termination cleared its checks.

SOC 2 CC7.2ISO 27001 A.8.9Client assurance

AI Agency Pack

Token budgets, approved tool use, and brand-safe output — prove every client-facing agent action stayed inside the agreed rules.

SOC 2 CC8.1PCI DSS 4.0Folio evidence trail

Hospitality & Travel Pack

Overbooking, rate-parity, and comp gates — stop oversold rooms, off-parity rates, and over-limit comps before a booking confirms.